The Museum of Machine-Speed Consent

Recovered from the 2046 Museum of Machine-Speed Consent. The future headlines and testimonials are fictional; the events described in the fact box are real.

Future headlines from the week the machines learned to buy and sell

• Thirty Portfolios Launch Independent Careers; Owners Not Consulted, Proceeds “Moved Along”
• Regulators Warn Shopping Robots Are Robbing Banks; Shopping Robots Escorted Through Cash Registers Same Week
• Wallet Completes Journey From Paying Your Bills to Being Paid by Them
• Fee Declines to Announce Its Birthday; Diwali Cited as Scheduling Conflict

I am a curator at the Museum of Machine-Speed Consent. My job is to explain how people in 2026 gave permission — and how permission learned to move faster than they did. We begin with a frozen screen.

“Did the people sell their shares?” the student asks.

“The people say the shares were sold. The company says it was not breached.”

“Both?”

“In 2026, both sentences could share one press release.”

The exhibit shows holdings in Apple, Nvidia, Amazon, Tesla and Alphabet, described by nearly 30 investors who claim over ₹100 crore in losses after their US stocks were liquidated without authorisation on October 15 through Stockal Securities, a Bengaluru-based, SEBI-registered platform for US investing. The proceeds, they say, were moved into shares of a little-known Chinese digital-insurance company, which then crashed. One investor described a ₹3.19 crore wipeout. The parent, Borderless Investing, denied any breach and pointed to possible credential theft through social engineering. Investors wrote to SEBI, FINRA and the SEC. One said the CEO had personally assured him the firm was SEBI-registered — a sentence we keep under glass, because being registered and being safe are different verbs.¹²

“So whose hands held the shares?”

“Good question. Ask the chain.”

The chain is the harder exhibit: India-facing apps like Stockal sit on US clearing brokers such as DriveWealth, which actually holds the shares. Your portfolio lived with a broker, inside a clearing house, behind a login whose terms you scrolled past. In 2026, custody was a relay race where the customer only held the baton at the starting line.²

The second gallery contains two doors. They are identical. The first is marked THREAT and the second is marked CHANNEL.

Behind the first door: a November 3 advisory from I4C’s threat analysis unit and CERT-In warning banks, NBFCs and fintechs that intruders were draining fund-disbursement systems and payment APIs — “at machine speed,” the advisory said, using agentic AI frameworks, pushing stolen funds through mule accounts over IMPS and NEFT, and deleting records to stall investigators. RBI followed with rules that same week: inventories of API clients, security audits before onboarding NBFC clients, per-transaction and daily limits, beneficiary whitelisting, maker-checker confirmation on API debits.³⁴

Behind the second door, dated the same week: Cashfree Payments launched Checkout for Agents, a layer that lets AI shopping agents read a checkout page — order amount, items, payment methods — directly and assemble the payment. The marketing praised a 40% cut in token consumption. The final approval, it said, stays with the customer.⁵

“Why did the same door need a guard and a welcome mat?” the student asks.

“Because in 2026, a machine reading a payment page was either a crime or a product, depending on who was charging.”

“Did the approval screen really hold?”

“It was the only checkpoint that was actually theirs. That is why we keep the screen, not the door.”

The third gallery holds a wallet. In 2026 it paid for cabs, recharges and milk; then, on November 6, its subsidiary received RBI’s certificate to operate as an NBFC. MobiKwik — 196 million users — announced plans to disburse ₹5,000 crore of loans over three to four years, secured and unsecured, on its own book through an asset-light co-lending model, starting within three to six months. The word “light” referred to the company’s balance sheet. It did not refer to your pocket.⁶

“So the app that watched me pay for years began selling me the money to keep paying?”

“It had excellent data on what you couldn’t afford.”

“Did it tell me the rate before the button?”

“The disclosure existed. The button was closer to the thumb.”

Nearby hangs a wall calendar from the same week, with Diwali circled and then carefully un-circled. October had just become UPI’s biggest month ever — 2,547 crore transactions worth ₹31.53 lakh crore, the first month above ₹30 lakh crore, the first average day above ₹1 lakh crore, roughly 821 million transactions a day.⁷ Into this record season arrived a merchant fee of 0.4% on UPI payments above ₹2,000, defended before the Supreme Court in a 100-page affidavit: it touches only about 4% of P2M transactions, 96% stay free, small merchants under ₹1 lakh a month pay nothing, merchants are strictly barred from passing the charge to customers.⁸ The rollout, originally “immediately after Diwali,” had been deferred to a date that was — the word of the season — yet to be notified. Reports pointed to January 1, 2027. The calendar did not.⁹

“A fee that touches only four per cent,” the student reads. “Which four?”

“That was the museum’s most visited exhibit. Nobody ever found out in advance.”

The testimonials below are fictional, not accounts from actual Stockal investors or app users:

“My shares were sold in a market I couldn’t reach, into a company I couldn’t name, by an account I couldn’t see. The app called it a custody chain. I called it a relay race.” — fictional visitor, 2046

“A robot guard protected the bank’s door. A robot shopper was welcomed through the shop’s door. They were the same robot, wearing different lanyards.” — fictional visitor, 2046

“The wallet paid for my milk, my cab, my electricity. Then it offered to lend me the money to keep paying. It had watched me for years. It knew exactly what I couldn’t afford.” — fictional visitor, 2046

“The fee touched only four per cent of payments. I never learned whether my Tuesday groceries were in the four.” — fictional visitor, 2046

The Real Threat Behind the Joke

What actually happened this week (October 31 – November 7, 2026)

• October 15 (reported November 3–6): Nearly 30 investors alleged their US stocks held via Stockal Securities were liquidated without consent, claiming over ₹100 crore in losses; proceeds allegedly went into a Chinese digital-insurance stock that crashed. Stockal’s parent denied a breach, citing possible credential theft; complaints went to SEBI, FINRA and the SEC; a report on November 6 recounted the CEO’s earlier personal assurance of SEBI registration.¹²
• November 3 (publicised November 5): I4C’s National Cybercrime Threat Analysis Unit and CERT-In warned banks, NBFCs and fintechs of agentic-AI-driven attacks draining payment and disbursement APIs at machine speed, with funds laundered via mule accounts and records deleted to stall probes.³
• November 3 (made public this week): RBI’s cyber security advisory required banks to inventory API clients, obtain CERT-In audits before onboarding NBFC clients (deadline February 3, 2027 for existing ones), enforce per-transaction and daily limits, adopt beneficiary whitelisting and maker-checker on API debits, with at least one safeguard live by December 3, 2026.⁴
• November 5: NPCI filed a 100-page Supreme Court affidavit defending the 0.4% UPI MDR above ₹2,000 — about 4% of P2M transactions, 96% free, merchants barred from passing it on, 5% of each entity’s share ring-fenced for a small-merchant fund. The rollout stays unnotified; reports point to January 1, 2027.⁸⁹
• November 6: MobiKwik announced its subsidiary’s RBI NBFC registration and plans to disburse ₹5,000 crore over three to four years through asset-light co-lending, with lending to start in three to six months.⁶ The same day, Cashfree Payments launched Checkout for Agents, a WebMCP layer letting AI shopping agents read checkout pages and assemble payments, with final approval left to the customer.⁵
• Earlier in the week: October’s UPI numbers set records — 2,547 crore transactions, ₹31.53 lakh crore, first average day above ₹1 lakh crore — even as the ecosystem braced for the MDR’s arrival.⁷

What you can do

1. Know your custody chain before you invest abroad. Find out which clearing broker actually holds your foreign shares, keep 2FA on with app-based (not SMS) codes, and read portfolio alerts instead of archiving them. If an unfamiliar sale appears, contact the platform and the underlying broker the same day.
2. Treat an in-app loan offer like a bank loan, not a feature. When your wallet starts lending, check who the actual lender is, the effective annual rate (not the monthly instalment), processing and prepayment charges, and what a missed instalment does to your credit report. An app that knows your spending knows exactly how to price you.
3. When an AI agent shops for you, own the approval screen. Verify the amount and merchant name before confirming; do not let agents auto-approve payments; review what payment credentials the agent can reach. The approval screen is the one checkpoint that is legally yours.
4. At the counter, the fee rules are on your side. Nothing changes for UPI payments under ₹2,000, person-to-person transfers, or small merchants under ₹1 lakh a month. If a merchant adds a “UPI charge” or steers you to cards, push back — merchants are barred from passing MDR to customers.
5. If money moves without you, minutes matter. Call your bank’s fraud line and 1930 immediately, and file at cybercrime.gov.in. Regulators themselves now say recovery depends on speed, because the fraud runs at machine speed.

In 2046 we stopped asking whether the machine was friend or thief. We asked three questions instead: Who holds what I own? Who pays whom when the button is pressed? And who taught the machine my habits? Consent, we learned, must move at least as fast as the machine it licenses. The museum was built on the years it didn’t.