Agentic Commerce Fraud
Emerging risks as AI agents buy and pay for users: agent impersonation, hijacked agents, intent and authorization gaps, disputes, and bot controls colliding with legitimate agents.
What it is
Traditional fraud controls assume a human customer at a device. Agentic commerce breaks that in three ways. Each one is a trust question the transaction must answer:
| Trust question | Human-present world | Agent world | Fraud opportunity |
|---|---|---|---|
| Who is acting? | The customer, judged by device, behavior, authentication | Software: possibly a known agent platform, possibly a script claiming to be one | Agent impersonation: malicious automation presenting as a trusted agent to get past bot defenses |
| On whose behalf? | Authentication binds the session to the account holder | Delegation: the user gave the agent credentials or a token | Credential and delegation abuse: stolen or over-broad delegations, and agents holding raw passwords |
| Was this intended? | The click is the evidence of intent | The agent decided from a prompt, a mandate or its context | Intent gaps: purchases the user didn't want, triggered by error, manipulation or a disputed instruction |
The industry response pairs identifiable agents with tokenized, scoped credentials and a record of user intent. As of October 2026, the main building blocks are:
| Layer | Initiative (owner, date) | What it gives a risk team |
|---|---|---|
| Network credentials | Visa Intelligent Commerce (Visa, announced April 30, 2025) | Agent-specific tokenized credentials kept separate from the user's card; passkey-authenticated user payment instructions; network checks that the authorization matches the instructed merchant and amount; post-purchase "commerce signals" that Visa positions as dispute evidence. Visa's developer page still describes it as in development. In December 2025 Visa reported hundreds of controlled, agent-initiated transactions in live pilots. |
| Network credentials | Mastercard Agent Pay (Mastercard, April 29, 2025) | Agentic Tokens built on Mastercard's existing tokenization; agents must be registered and verified before they can pay; agent-initiated transactions identifiable to every party; consumer-set purchase permissions. Extended by Agent Pay for Machines (June 2026) and, on September 30, 2026, an intelligence layer: an AI-initiated-transaction probability score (in US testing), shared risk signals on unusual agents, merchants and credentials, and Skyfire's know-your-agent verification. |
| Agent identity at the merchant edge | Web Bot Auth (proposed by Cloudflare in 2025; IETF webbotauth working group) | Automated clients sign their HTTP requests using HTTP Message Signatures (RFC 9421), with public keys published in a directory, so a site can verify which operator sent the traffic. It became a working-group draft in September 2026: standards track, but not final. The current draft covers key rotation but defines no revocation mechanism. Mastercard and American Express said in October 2025 that they would use it. |
| Agent identity at the merchant edge | Visa Trusted Agent Protocol (TAP) (Visa with Cloudflare, October 14, 2025) | Built on Web Bot Auth. Uses agent-specific signatures, plus context: whether the agent intends to browse or buy, whether the consumer already has a relationship with the merchant, and optional payment data. Akamai joined later in 2025. |
| User intent | Agent Payments Protocol (AP2) (Google with 60+ organizations, September 16, 2025) | Cryptographically signed Intent Mandates and Cart Mandates. In human-present flows the user signs the cart. In human-not-present flows the user pre-signs a detailed intent (price limits, timing), and the agent generates the cart when conditions are met. Payment-method agnostic, and usable as an extension of A2A and MCP. A companion x402 extension covers stablecoin payments. |
| User intent | Mastercard Verifiable Intent (with Google, March 5, 2026) | Open-sourced specification for a tamper-resistant, selectively disclosed record linking cardholder identity, the user's instructions and the agent-to-merchant interaction. Aligned with AP2 and UCP but protocol agnostic, and positioned as dispute evidence. |
| Checkout | Agentic Commerce Protocol (ACP) (OpenAI and Stripe, September 29, 2025; Stripe's documentation now lists Meta as a co-creator) | Open standard for agent checkout in which the seller remains merchant of record. Delegated payment tokens are constrained by amount, currency, expiry and merchant; Stripe's Shared Payment Token is scoped to one merchant and cart total. It launched with Instant Checkout in ChatGPT. In March 2026 OpenAI moved checkout into merchants' own ChatGPT apps, and ACP continues as connecting infrastructure. |
| Checkout | Universal Commerce Protocol (UCP) (Google with Shopify, Etsy, Wayfair, Target and Walmart, January 2026) | Open-source standard covering discovery, cart, checkout and post-purchase. Separates payment instruments from payment handlers; uses tokenized payments and verifiable credentials; compatible with AP2. Visa, Mastercard, American Express, Stripe and Adyen are among its endorsers. |
| Interoperability | Know Your Agent (KYA) framework (Ant International, Mastercard and Visa, September 2026) | Early-stage effort to bridge Visa TAP, Mastercard Verifiable Intent and Ant International's Agentic Mobile Protocol around three goals: tie every agent to a verified operator, apply shared certification standards, and monitor agents continuously. No specifications or timelines yet. |
- EMVCo, the card industry's technical standards body, said in November 2025 that it was working on how its specifications can support agentic payments. It discussed agentic payments and digital payment credentials at its April 2026 Board of Advisors meeting, and in September 2026 requested industry feedback on a framework for card-based agentic payments.
- Agent identity ("know your agent") is the common thread. Agents present a verifiable identity, such as a signed request tied to a registered operator. Merchants and their bot-management layers can then tell a known shopping agent from generic automation, and issuers can see which agent initiated a transaction.
- None of these settles liability. They supply identity, scoping and evidence. Who eats a loss from a hijacked agent or a mandate dispute is still a matter of network rules and contracts (see the liability section below).
How it works
Attack and failure points, conceptually:
- Impersonation. Generic automation (scalpers, card testers, promo farmers, scrapers) presents itself as a legitimate agent to bypass bot defenses.
- Hijack or manipulation. A legitimate agent reads malicious content (product pages, reviews, emails, documents) containing hidden instructions, and is steered into buying, paying, or leaking data. A Google DeepMind paper on "AI agent traps," summarized in April 2026, reported that simple prompt injections in ordinary web content partially hijacked agents in up to 86% of tested scenarios.
- Delegation abuse. Agents that hold users' raw credentials (screen-scraping style) are themselves a high-value target, and their traffic is indistinguishable from ATO at the bank or merchant.
- Mandate drift. The agent buys the wrong item, the wrong quantity, from the wrong seller, or at the wrong price. That's not fraud, but it produces disputes that look like fraud.
- First-party abuse. A user who regrets a purchase claims "my agent did it" (Chargeback and Friendly Fraud), or uses agents to automate Promo Code Abuse and offer claiming at scale.
Transaction footprint
| Stage | What you see in the data | Decision point |
|---|---|---|
| Arrival | Automated traffic, sometimes declaring itself as an agent; non-human interaction timing; headless or cloud infrastructure | Bot Management and CAPTCHA policy: block, allow verified agents, or route to agent-specific flows |
| Account access | Logins with shared credentials from agent infrastructure; many accounts from the same agent provider IPs | Login Anomalies, IP Reputation and Proxy Detection; offer scoped, revocable delegation instead of password sharing |
| Checkout | Few page views, fast cart-to-pay; tokenized credentials; agent identifiers (where present) in the request | Real-Time Transaction Risk Scoring with agent-aware features; 3-D Secure and Card Verification or step-up when intent is unclear |
| Authorization | Issuer sees the agent token, merchant, amount; may or may not see the user's mandate | Check the transaction against the mandate (price ceiling, merchant category, expiry) where networks provide it |
| Post-purchase | Returns or refunds; "I didn't order this" or "not what I asked for" contacts | Dispute and Return History; collect agent logs and mandate evidence |
| Dispute | Reason-code fight: unauthorized vs not-as-described vs processing error | Evidence: signed intent, agent identity, delivery. Liability rules are still forming. |
Measurement note. Agent traffic is growing faster than agent fraud labels. LexisNexis Risk Solutions reported a 450% rise in agentic AI traffic between January and December (as summarized in April 2026), while saying it had found no current evidence of malicious intent in that traffic. Fraud models trained on human sessions will treat legitimate agents as anomalies. Plan for a separate labeling stream for agent-initiated transactions (Fraud Labeling and Feedback Loops).
The bot-management conflict
Most fraud stacks were built to stop automation at login and checkout. That was a sensible default when nearly all automation was hostile. Agentic commerce breaks the default:
- Block everything: you protect against impersonators but lose legitimate agent-driven sales, and invite workarounds (users sharing passwords with agents that then evade detection).
- Allow everything: card testers, scalpers and promo farmers simply claim to be agents.
- Allow only verified agents: requires an agent identity scheme you can verify, which is still being standardized. It also creates a new impersonation target (stolen agent keys, rogue registered operators).
The market is already splitting. In October 2026, PaymentsJournal reported that Amazon had blocked Meta's new Muse agent from shopping on its site. Royal Bank of Canada had discussed blocking it, and JPMorgan Chase and other large banks planned broader agent blocks. Separately, major US banks reportedly found unauthorized third-party AI agents operating in customer accounts, some apparently acting without user instruction. Some institutions restricted agent access and were weighing read-only access as a middle ground.
Liability and dispute questions
These are open questions, and the practitioner's job is to have a position before volume arrives:
| Question | Why it's hard | What to watch |
|---|---|---|
| Is an agent purchase "authorized"? | The user authorized the agent, maybe not the specific purchase | Network rules on agent transactions; how mandate evidence is treated |
| Debit and account transfers (US Reg E) | Reg E excludes from "unauthorized" any transfer by a person the consumer furnished the access device to, unless the consumer has told the institution that person is no longer authorized. If an agent counts as that person, users who share credentials may lose protection. | CFPB interpretation; bank terms requiring users to log in themselves |
| Hijacked agent | Neither the user nor the agent operator intended the purchase | Allocation among agent platform, merchant, issuer; contract terms |
| Mandate drift (wrong item, price) | Not fraud, but customers will dispute | Whether "not as described" or "processing error" reason codes apply; merchant return policies for agent orders |
| Friendly fraud | "My agent did it" is a new first-party excuse | Compelling-evidence standards using agent logs and signed intent |
| Brokerage | Agents placing trades or moving funds | FINRA 2026 flags agents acting without human validation and beyond the user's actual or intended authority, and outcomes that are hard to trace |
Common variants
| Variant | What's different | Where it shows up |
|---|---|---|
| Agent impersonation | Hostile bots claim agent status to bypass controls | Checkout, account creation, promo endpoints |
| Prompt-injection purchases | Malicious content steers a real agent to buy or pay | Marketplaces with user-generated content; email-reading agents |
| Malicious merchants for agents | Listings or sites built to rank well with agents and capture their purchases | Open-web agent shopping |
| Credential-holding agent compromise | Breach or abuse of an agent provider that stores user passwords | Banks, brokerages, retailers |
| Agent-scaled first-party abuse | Automated offer claiming, price-match and refund requests | Rewards apps, retailers; see Business Logic Exploitation |
| Machine-to-machine micro-payments | Agents paying APIs and services autonomously | Emerging; Mastercard's Agent Pay for Machines (June 2026) |
Where it shows up
- Retail and Ecommerce, Online Marketplaces: the first venue for agent checkout, returns and disputes, and the main bot-management battleground.
- Payments and P2P: networks, wallets and issuers decide how agent tokens, mandates and liability work.
- Neobanks and Consumer Fintech: agents operating accounts (bill pay, transfers) with shared credentials. Banks are already reporting unauthorized agents.
- Cashback, Coupons and Rewards: agents that automatically find and claim offers turn per-user promotions into per-agent ones. Promo economics assume human attention (Promotion Design Guardrails).
- Brokerage and Investing: trading and money-movement agents raise suitability, authority and ATO-detection questions.
Impact
- Today: small direct losses, a large modeling impact (false positives on legitimate agents), and a strategic impact (whether to block or welcome agents).
- Near term: dispute volume and new first-party patterns as agent checkout scales; cross-platform credential exposure from agents holding passwords.
- Regulatory: FINRA's 2026 oversight report lists agent risks (autonomy without validation, exceeding authority, poor traceability, data misuse) and suggests monitoring agent access, defining human-in-the-loop oversight, tracking agent actions, and setting guardrails.
Red flags
- Automation fingerprints claiming to be known agents without verifiable identity → Automation and Headless Browser Signals, Device Fingerprinting
- Many accounts accessed from one agent provider's infrastructure → IP Reputation and Proxy Detection, Login Anomalies
- Purchases inconsistent with the user's history, outside a declared mandate, or to newly listed sellers → Payment Instrument Signals, Session Behavior Anomalies
- Bursts of offer claims or promo redemptions with agent-like timing → Promo and Reward Redemption Patterns, Velocity Signals
- Disputes citing the agent → Dispute and Return History
- Behavior that is too fast or too regular to be human → Behavioral Biometrics
Prevention and detection at a glance
| Layer | Control or signal | What it does here |
|---|---|---|
| Prevent | Agent-aware Bot Management and CAPTCHA and AI Agent Verification (Know Your Agent): verify-then-allow lanes for identifiable agents | Separates known agents from impersonators |
| Prevent | Scoped, revocable delegation (tokens with limits) instead of password sharing; Passkeys and Phishing-Resistant Authentication and Device Binding and Trusted Devices for the human | Limits what a compromised or confused agent can do, and keeps step-up confirmations on the user's own device |
| Prevent | Velocity and Exposure Limits per agent, per mandate | Caps blast radius of hijack or drift |
| Detect | Real-Time Transaction Risk Scoring with agent features (agent ID, mandate fit, merchant novelty) | Stops treating every agent as anomalous |
| Detect | Step-up to the human (Risk-Based Authentication and Step-Up, 3-D Secure and Card Verification) when the transaction is outside the mandate | Turns uncertain intent into confirmed intent |
| Respond | Evidence capture: agent logs, signed intent, delivery | Needed for disputes and Card Network Dispute Rules |
| Govern | Product and policy decision on agent access (New Product and Promo Launch Review, Fraud Risk Assessment) | Make block or allow an explicit product decision; otherwise bot rules decide it by default |
Emerging variants and adversary adaptation
- Impersonation will follow verification. Once "verified agent" lanes get lighter friction, expect theft of agent credentials and abuse by registered but rogue operators. Agent identity has to be revocable and monitored, the way merchant IDs are.
- Prompt injection as social engineering. Agents that read untrusted content can be socially engineered at machine speed. Defenses move to the agent platform (content isolation, purchase confirmations), but merchants and issuers still absorb the losses.
- Promotions designed for humans will leak. Agents that systematically find, stack and claim offers will make human-scale promo assumptions obsolete. Expect a first wave of agent-driven Business Logic Exploitation.
- Fragmentation and gatekeeping. Large platforms are blocking some agents and welcoming others. Fraud teams will have to support several agent protocols and identity schemes at once, each with different evidence for disputes.
- Scams aimed at agents. Merchant listings, reviews and payment requests built to manipulate agents rather than people, plus scams that persuade users to give agents broader authority than they should.
Related mechanisms
- Card-Not-Present Fraud, Card Testing, Digital Wallet Provisioning Fraud: card-rail mechanics agents inherit
- Chargeback and Friendly Fraud: the dispute layer where agent liability will be decided
- Account Takeover (ATO): the credential-sharing problem
- Fake Account Creation (Bots), Promo Code Abuse, Business Logic Exploitation: automation-driven abuse that impersonating agents will amplify
- Generative AI and Deepfake Fraud, Fraud-as-a-Service Ecosystem: the wider AI and industrialization context
Real-world examples
No public, sourced case of large-scale agent-initiated payment fraud exists yet. Current signals are market events:
- October 2026: reports of unauthorized third-party AI agents in customer accounts at major US banks, and bank moves to restrict agent access
- October 2026: a major retailer blocked a newly launched consumer AI agent from shopping on its site, citing credential-handling concerns
- 2026-09-10 Ant International, Mastercard and Visa begin know-your-agent interoperability work: networks start on shared operator traceability, certification and monitoring for agents, with no liability rules yet
Sources and further reading
- Mastercard: Mastercard unveils Agent Pay, pioneering agentic payments technology to power commerce in the age of AI (April 29, 2025): Agent Pay launch: Agentic Tokens, agent registration and verification, consumer-set permissions
- Mastercard: Mastercard launches Agent Pay for Machines (June 10, 2026): machine-to-machine agent payments (title and date confirmed via the newsroom listing)
- Mastercard: Mastercard advances agentic commerce with new trust and intelligence services (September 30, 2026): AI-initiated transaction probability score, shared intelligence signals, Skyfire KYA and Cloudflare partnerships
- Mastercard: Verifiable Intent (March 2026): open-sourced intent-record standard co-developed with Google; alignment with AP2 and UCP; dispute use
- Visa: The Future is Here: Visa Announces New Era of Commerce Featuring AI (April 30, 2025): Visa Intelligent Commerce announcement and launch partners
- Visa Developer: Visa Intelligent Commerce: agent-specific tokens, passkey-authenticated instructions, network-level controls, commerce signals; in-development status
- Visa: Visa Introduces Trusted Agent Protocol: An Ecosystem-Led Framework for AI Commerce (October 14, 2025): TAP built with Cloudflare on HTTP Message Signatures and Web Bot Auth; agent intent, consumer recognition and payment fields
- FinTech Global: Visa pilots prove secure AI-driven payments are ready for mainstream use (December 23, 2025): hundreds of live agent-initiated pilot transactions; Akamai joining TAP
- Cloudflare: Cloudflare Collaborates with Leading Payments Companies to Secure and Enable Agentic Commerce (October 14, 2025): Web Bot Auth adoption by Visa, Mastercard and American Express
- IETF: HTTP Message Signatures for automated traffic (draft-ietf-webbotauth-httpsig-protocol-00, September 2026): Web Bot Auth working-group draft: signed requests, key directory, rotation without a revocation mechanism
- Google Cloud: Powering AI commerce with the new Agent Payments Protocol (AP2) (September 16, 2025): Intent and Cart Mandates, human-present and not-present flows, 60+ organizations, A2A and MCP extension
- Stripe: Stripe powers Instant Checkout in ChatGPT and releases Agentic Commerce Protocol codeveloped with OpenAI (September 29, 2025): ACP launch; Shared Payment Token scoped to merchant and cart total
- Agentic Commerce Protocol: Architecture: seller remains merchant of record; delegated payment tokens with amount, currency, expiry and merchant constraints
- Stripe Docs: Agentic Commerce Protocol: ACP building blocks; Stripe, OpenAI and Meta listed as creators
- Digital Commerce 360: OpenAI shifts checkout plans in agentic commerce strategy (March 6, 2026): Instant Checkout moving to merchant ChatGPT apps; ACP's continuing role
- Google Developers Blog: Under the Hood: Universal Commerce Protocol (UCP) (January 2026): UCP scope, co-developers, endorsers, AP2 compatibility, tokenized payments
- Ant International, Mastercard and Visa initiate collaboration on Know-Your-Agent interoperability (Business Wire via UNI India, September 2026): KYA framework bridging TAP, Verifiable Intent and Agentic Mobile Protocol; early stage
- EMVCo: EMVCo Working on How Global Specifications Can Support Agentic Payments (November 2025): standards-body engagement
- EMVCo: Requests Feedback on Framework for Card-Based Agentic Payments (September 2026): proposed card-based agentic payments framework
- FINRA 2026 Oversight Report: GenAI, Continuing and Emerging Trends: AI agent risks, including exceeding the user's authority, and suggested guardrails
- PaymentsJournal: Unauthorized AI Agents Have Accessed Bank Accounts at Top U.S. Banks (October 22, 2026): bank detection of unvetted agents; restrictions and read-only options
- PaymentsJournal: AI Agents Face a Long Road, Despite Muse's Strong Downloads (October 21, 2026): retailer and bank blocking; credential-capture concerns
- This Week in Fintech: This Week in Fraud (April 14, 2026): summaries of the DeepMind "AI agent traps" prompt-injection findings and LexisNexis agentic-traffic growth
- CFPB: Regulation E § 1005.2 definitions: the "unauthorized EFT" definition and the furnished-access-device exclusion