Agentic Commerce’s Blind Spot: Card Networks Solved Fraud, Not Mistakes

Visa and Mastercard have spent the past eighteen months building the plumbing for AI agents to shop with your card — tokenized credentials, cryptographic agent authentication, real-time revocation. Ask either network what happens when a scammer hijacks that plumbing, and the answer is confident: the same zero-liability protections that cover a stolen card number cover a hijacked agent. Ask what happens when your own agent, acting exactly as authorized, books the wrong dates or pays double for a flight, and the confidence disappears. Card networks have built an impressively engineered answer to the fraud question and left the far more common question — agent error — largely unaddressed, right as Visa predicts millions of consumers will let an agent complete a purchase this holiday season.

In Short – Key Takeaways

• Four agentic-commerce protocols shipped between April 2025 and March 2026 — Visa’s Trusted Agent Protocol, Mastercard’s Agent Pay, Google’s open Agent Payments Protocol (AP2), and Stripe/Tempo’s Machine Payments Protocol — and most production flows will touch more than one.
• Fraud liability on agent-initiated purchases largely mirrors existing rules: Visa’s zero-liability guarantee extends to AI-initiated transactions, and Mastercard’s issuer carries fraud liability when an Agentic Token is validly issued and its policy honored at authorization.
• Neither network has published a binding chargeback rule specifically for disputes where the agent — not a fraudster — made the mistake; one existing specification that does address it assigns the loss to the consumer.
• The legal reason the gap exists: Regulation E’s zero-liability and dispute-resolution machinery is built around the concept of an unauthorized transfer — and a purchase an agent made within its granted scope, however badly judged, does not obviously meet that definition.
• Rails are converging with crypto infrastructure at the same time: Mastercard agreed to acquire stablecoin infrastructure firm BVNK for $1.8 billion in March 2026, explicitly to connect on-chain payment rails to agentic commerce flows — adding a second layer of unsettled liability questions on top of the first.

Two different problems wearing the same name

“Liability for AI agent payments” is being talked about as one problem. It is actually two, and the networks have only solved one of them. The first is impersonation: a bad actor pretending to be a legitimate agent, or hijacking a real one, to move money that was never authorized. That is a fraud problem the card networks understand deeply, and both Visa’s Trusted Agent Protocol and Mastercard’s Agentic Tokens address it with real cryptographic rigor — binding a credential to a specific agent, merchant scope, and consent policy, so the network can distinguish a verified shopping agent from a scraper or impostor.

The second problem is judgment: an agent that is exactly who it claims to be, acting exactly within the authority it was given, making a decision the consumer would not have made — the wrong travel dates, an inflated price it failed to flag, a substitution it shouldn’t have accepted. That transaction was authorized in every technical sense. It just wasn’t correct. Payment executives themselves acknowledge this is the harder question: Visa’s own leadership has said publicly that agent disputes add a genuinely new party to a process that used to involve only the cardholder, issuing bank, acquiring bank, and merchant, and that the industry is still working out how responsibility should be assigned.

Why “zero liability” doesn’t automatically cover this

Zero-liability guarantees and Regulation E protections are built on the legal concept of an unauthorized electronic funds transfer. When a consumer grants an agent standing authority to transact within a defined policy — a budget, a merchant category, a set of preferences — a transaction the agent completes inside that policy is, by construction, authorized. The consumer did not lose their card. Nobody impersonated them. The agent simply exercised judgment the consumer disagrees with after the fact. That is a strong candidate for falling outside the protections both regulators and card networks currently guarantee, and at least one agentic-commerce specification already in circulation resolves the ambiguity by assigning the loss to the consumer by default.

This is not a hypothetical edge case designed to sound alarming. It is the modal failure mode of the technology: language models are far more likely to misjudge a nuanced instruction than to be successfully impersonated by a cryptographically-blocked bad actor. The networks have spent their engineering effort on the less probable failure and left the more probable one to be sorted out later, contractually, deal by deal.

A second liability layer is stacking on top

The standards race is not settling the question either — it is adding a second axis of complexity. Four protocols are live across the card-network, open-protocol, and processor layers, and most real transactions will cross more than one before checkout completes. Mastercard’s move to acquire stablecoin infrastructure provider BVNK specifically to link on-chain rails into agentic commerce means some agent-initiated purchases will settle through crypto infrastructure with its own reserve, custody, and reversibility characteristics — layering a second, less mature liability regime underneath the first, unresolved one.

What this means for issuing banks

Card-issuing banks, not the networks, are the ones who answer the phone when a customer disputes a charge their agent made. Under current tokenized-transaction rules, issuers already carry fraud liability when a token was validly issued. The open question is what happens to the much larger category of disputes that aren’t fraud at all — an agent that technically did what it was told, badly. Absent a published chargeback rule for that category, issuers are exposed to a choice between eating the loss as a goodwill gesture, denying the dispute and absorbing the reputational cost, or waiting for case law and regulators to decide for them. None of those are comfortable positions to be in heading into a holiday season Visa itself expects to be the mainstream debut of agentic checkout.

The practical move for bank leadership is to stop treating this as a wait-and-see infrastructure rollout and start treating it as an unresolved contract term. Issuers have leverage now, while adoption is still ramping, to push the networks for an explicit agent-error dispute framework — before volume make that negotiation much harder to win.

Sources

1. What Is Mastercard Agent Pay? AI Agent Commerce Protocol in 2026
2. Visa Has Completed Hundreds of AI-Initiated Payments – Here Is What Every Fintech Builder Must Know
3. banksandbankers.com/category/fintech-and-innovation/
4. Who Vouches for the Bot? Agent Checkout Authentication
5. Who Pays When an AI Agent Makes the Wrong Purchase?

This article is for informational purposes only and does not constitute financial advice.