The Agent With Your Credit Card: Spend Mandates, Merchant Fraud, and Disputes When the Buyer Is Software

During the 2025 holiday season, AI agents drove roughly 20% of global e-commerce orders — about $262 billion in sales. That number hides a much stranger fact: almost none of the payment infrastructure those orders flowed through was designed for a non-human buyer. The card networks' entire trust model — the device fingerprint, the IP address, the behavioral biometrics, the "cardholder present" signal — assumes a person is on the other end of the transaction. When an agent checks out, every one of those signals is either missing or synthetic.

The industry's answer is arriving as a delegation layer: cryptographically signed mandates that prove a human authorized a purchase before the software made it. But between the protocol announcements and the operational reality sits a set of unsolved problems that anyone building agentic checkout — or selling through it — needs to understand. The most important one has no answer yet: when the agent buys the wrong thing, who eats the loss?

This isn't a hypothetical for 2030. AI referral traffic to US retail sites grew 393% year over year in Q1 2026, and AI-referred shoppers now convert dramatically better than social or search traffic. The buyers are already software. The question is whether the payment rails, the fraud models, and the dispute process can catch up before the chargebacks do.

Card Networks Never Designed for a Delegate

Card payments encode a simple assumption: the entity presenting the credential is the cardholder or someone physically handed the card. Every layer built since — 3-D Secure, tokenization, risk scoring — refines how confident the network is that the human is really there. None of it models a third possibility: the cardholder is absent, but a software process is acting under their instruction.

That gap is exactly what the new protocols try to fill, and it's worth understanding the three main stacks because they make different bets:

• Google's Agent Payments Protocol (AP2), launched with Coinbase in late 2025, represents every purchase as a chain of signed mandates: an Intent Mandate (what the user asked for, with limits), a Cart Mandate (what the agent actually assembled), and a Payment Mandate (what gets charged). The design goal is non-repudiation — a verifiable audit trail from human intent to settled transaction. By early 2026 it had over 60 partner organizations, including Adyen and Worldpay.
• Stripe and OpenAI's Agentic Commerce Protocol (ACP) powers Instant Checkout in ChatGPT. Its payment primitive is the Shared Payment Token: the buyer's real credentials never reach the agent platform; Stripe issues a scoped token the application can use to initiate exactly the authorized payment. Merchants keep the order — they remain merchant of record, control fulfillment, and integrate with roughly one line of code if they're already on Stripe.
• The card networks themselves are extending tokenization. Mastercard's Agent Pay issues Agentic Tokens that bind a card credential to a specific agent, a merchant scope, and a consent policy. Visa's Intelligent Commerce does the analogous thing with agent-bound pass-through tokens plus an agent identity layer (the Trusted Agent Protocol). American Express went furthest on the liability question: registered agents on its network get payment credentials only after cardholder authentication, and Amex has committed to covering erroneous purchases made by those verified agents.

The shared architecture across all three: the agent never holds the card, and every purchase carries a signed proof of delegation with explicit scope — spend caps, merchant restrictions, expiry. That's the "spend mandate." It's the payments equivalent of an OAuth scope, except the resource being scoped is your money.

The Mandate Is a Contract Your Prompt Writes

Here's where it gets uncomfortable for engineers. The Intent Mandate is generated from a natural-language instruction. "Find me the cheapest direct flight to Denver next Friday, under $400" has to compile into a machine-enforceable envelope: max spend $400, category air-travel, date constraints, one transaction. Every ambiguity in the instruction becomes a degree of freedom the agent can exercise — and a dispute waiting to happen.

Consider the failure modes that mandates handle well versus badly:

• Handled well: hard-cap violations. The agent tries to spend $450 against a $400 mandate. The token is scoped; the authorization fails. This is the easy case, and it's genuinely solved by the new infrastructure.
• Handled badly: correct-but-wrong purchases. The agent buys a direct flight for $380 — to Denver International, when you meant a regional airport. Or it interprets "cheapest" as basic economy with no carry-on. The transaction is inside every limit of the mandate. Cryptographically, you authorized it. Practically, you didn't want it.

That second category is where the delegation layer's neat cryptography meets the messy semantics of intent. A signed Cart Mandate proves what the agent bought; it cannot prove the purchase matched what the user meant. The gap between those two is precisely where liability disputes will live, and no signature scheme closes it.

The practical implication for agent builders: treat mandate construction as a UX surface, not a plumbing detail. Show the compiled constraints back to the user before execution. Log the reasoning chain from instruction to cart. The teams that win disputes in 2027 will be the ones whose agents produced legible evidence in 2026.

Your Legitimate Buyer Looks Exactly Like Fraud

Now flip to the merchant side, where the picture is worse. Merchant fraud models were trained on a decade of signals that agentic traffic destroys:

• Device and network fingerprints now point at a datacenter, not a living room. The same agent platform IP range may originate thousands of purchases per hour for thousands of different cardholders — which is also exactly what a card-testing botnet looks like.
• Behavioral signals — mouse movement, dwell time, navigation path — are either absent or machine-generated. An agent that goes straight from search to checkout in 400 milliseconds trips every velocity rule written since 2015.
• The bot/customer boundary has dissolved. More than 60% of visits to online retailers are already automated. Fraud systems spent years learning that "bot equals block." Suddenly a meaningful and growing share of revenue arrives via bots, and older detection stacks simply cannot distinguish a ChatGPT checkout from a scraper probing stolen cards.

Merchants face an ugly trade-off. Block agent traffic and you forfeit the fastest-growing, highest-converting channel — AI-referred shoppers convert around 7× better than social referrals. Allow it blind and you've disabled half your fraud stack for the exact traffic class attackers will imitate first. Because make no mistake: once "I'm a legitimate shopping agent" becomes a lane that bypasses bot defenses, fraudulent software will dress up as legitimate agents, the same way credential-stuffing tools learned to mimic browsers.

The emerging answer is identity over behavior: verified agents present cryptographic attestations (signed requests, registered agent credentials, network-issued agentic tokens), and merchants shift from "does this session behave like a human?" to "is this agent registered, and does its mandate check out?" That works — but only for the traffic that adopts the protocols. For everything else, merchants are back to guessing, now with fewer usable signals than before.

The Chargeback Question Nobody Can Answer

Dispute processes assume two parties who disagree about a human decision. Agentic commerce inserts a third party — the agent platform — and a genuinely new dispute type: "I authorized the agent, but not this."

Walk through what happens today when an agent buys the wrong thing and the cardholder files a dispute:

1. The cardholder claims the purchase was unauthorized or "not as described by my instruction."
2. The merchant assembles its usual defense — and discovers the evidence (IP, device, session behavior) describes the agent platform, not the customer. It proves nothing about human intent.
3. The card network's dispute categories have no code for "authorized delegate exceeded semantic intent." It gets shoehorned into fraud or buyer's-remorse categories.
4. Under current rules, the merchant usually eats it — the issuer sides with the cardholder, the agent platform has accepted no liability, and the model vendor certainly hasn't.

That default is unstable, and everyone in the chain knows it. Merchants are being asked to absorb the error rate of software they didn't build, chosen by a customer they never saw. The plausible end state, which the mandate architecture quietly enables, is liability following the signature: if the agent platform signed a Cart Mandate that deviates from the Intent Mandate, the platform eats the loss. If the cart matched intent and the user simply regrets it, it's on the cardholder like any buyer's remorse. If the merchant shipped something that didn't match the signed cart, it's on the merchant. Amex's promise to cover erroneous purchases by its registered agents is the first public move toward that regime — liability as a feature of the verified-agent program, priced into the network.

Until the networks formalize this, the operational advice is unglamorous: keep everything. Agent authorization logs, the raw user instruction, the compiled mandate, the cart-to-intent diff, timestamps of any human confirmation step. In agentic disputes, the party with the legible delegation trail wins by default, because nobody else has evidence that means anything.

What to Build Before the Rules Arrive

The protocols will keep consolidating — AP2, ACP, and the network token schemes are already converging on compatible primitives, and analysts project agentic commerce reaching up to 25% of US online sales by 2030. The rules of liability will lag the volume by years. That gap is where engineering choices matter now:

• If you're building agents that spend money: compile instructions into explicit, user-visible mandates; default to a human confirmation step above a spend threshold; and log the full intent-to-cart reasoning chain as dispute evidence, not just debug output.
• If you're a merchant: don't treat agent traffic as bots to block or humans to trust — build the third lane. Adopt at least one verified-agent integration (ACP is the lowest-effort entry point if you're on Stripe), and start tagging agent-originated orders in your fraud and returns analytics so you know your actual agentic error rate before a network rule assigns you the bill for it.
• If you're issuing or processing: the scarce asset is delegation evidence. Whoever standardizes the "proof the human meant it" layer — and prices the residual error — captures the trust position card networks held for fifty years.

The credit card was a bet that merchants would accept payment from a stranger because a network vouched for them. Agentic commerce is the same bet one level up: accepting a purchase from software because a signature chain vouches that a human meant it. The cryptography for that chain now exists. The consensus about what happens when the chain and the human disagree does not — and until it does, every agent purchase is a small, unpriced liability looking for an owner.