The phrase of the week is “AI versus AI”. Criminals are using generative tools to produce convincing identities, cloned voices and scripts that coach a victim through a payment in real time. Some already run agents that will try a control, fail, adapt and try again, faster than an analyst can read the alert. It is a real shift and it deserves a serious answer.

The answer on offer at most stands is an autonomous defence: a system that detects, decides and acts on its own. We think that framing skips the hardest question a bank’s risk committee will ask, which is where accountability sits when the machine is wrong.

Our position is simple. The machine should score, explain and recommend. The institution should decide. Everything else in the architecture follows from that.

It means oversight has to be configurable rather than assumed. During business hours a high-risk alert can go to the fraud team for a human call. Overnight the system can stop the payment and notify the duty manager, because a held payment can be released in the morning and a settled one cannot be recovered. Which mode applies, and at what threshold, is the institution’s policy expressed in the system. It is not a vendor default.

It means explainability has to work at two depths. An analyst, a branch colleague or a board member needs three plain-language reasons and the decision, and nothing more. Model risk, compliance and the regulator need to click through to the full trail: the input data, the features, the model output, the rules that fired, the incumbent score, the final decision. Both views come from the same record. If a vendor can only show you one of them, ask why.

It means the evidence has to survive a dispute. A signed, tamper-evident record of what was known, what was scored and what was decided is what a Regulation E or UCC Article 4A investigation will ask for. Reconstructing it afterwards is not the same thing.

And it means the new intelligence has to work with what the institution already owns. Banks have paid for incumbent scores, rules and case tools. An arms-race pitch that opens with “replace all of it” is asking the risk committee to accept a second, larger risk in order to address the first. We prefer to add behavioural context and network signals to the incumbent score, produce one decision with one explanation, and let the institution decide over time what it keeps.

The uncomfortable truth inside the AI-versus-AI story is that the attacker has no governance and the defender must have it. That is not a handicap. Governance is what makes a bank a bank. A defence built around a scored recommendation and a human-owned decision takes longer to describe and less time to trust.

About RS Software
As the payments ecosystem transitions toward an AI-driven, real-time, and increasingly autonomous model, where TRUST is the new currency, RS Software (India) Limited's product portfolio modernizes the most critical areas across the value chain, leveraging decades of work building mission-critical payment infrastructure globally. Each product is purpose-built to address specific structural shifts in the market while collectively enabling a unified, AI-led financial ecosystem. RS IntelliEdge™ is designed to address evolving transaction-level controls and shift to continuous, identity-centric intelligence systems, protecting approximately 95% of India’s digital payment transactions and screening billions of transactions each month. RS DigitalEdge™ is designed to enable real-time routing, optimization, and decisioning across payment flows. Payabbhi® is designed to enhance the acceptance and acquiring layer, transforming it into a data-driven revenue engine.