Stripe, OpenAI, and Google shipped protocols that let AI agents complete purchases inside a conversation. The rails are already fast enough. The problem is that fraud detection was architected around a human clicking buy on a trusted surface, and agents break that assumption.
Payments runs on documents - checks, wires, invoices, KYC files - and the OCR that reads them chokes on handwriting and damage. DeepSeek-OCR processes a page as roughly 100 visual tokens instead of a thousand text tokens, and it is open source. The headline accuracy comes with a compression ceiling worth knowing.
Train GPT-2 on Shakespeare and ask it the capital of France - it forgets Paris. That is catastrophic forgetting, one of several failure modes that surface the moment fine-tuning meets production, especially in regulated banking where "the model flagged it" is not an answer.
The AI race everyone watches is the application layer. The one that decides it runs four layers down, in chip design, fabs, and export controls. When the US cut China off from the best GPUs, DeepSeek answered with efficiency instead of scale - and that is the lesson worth keeping.
GPT-5 ships as one model with an automatic router that decides how hard to think for you. Convenient, until you watch a simple question quietly trigger a web search, a page read, and a reasoning chain you never asked for - and burn through a capped Plus plan in an afternoon.
Nearly three-quarters of banks claim AI-powered fraud detection, but when a wire has to clear in under 100ms the model steps aside and deterministic rules make the call. The honest architecture is hybrid - and saying so is becoming a regulatory and legal requirement.