When the Bot Buys: Who's Liable When AI Agents Shop for Your Customers?

An agent-authorized purchase is a card payment that an AI agent completes inside permissions the cardholder granted in advance, such as a spend cap, a product category or a standing reorder. A chargeback follows when the cardholder, the issuer and the merchant disagree on whether those permissions covered this specific order.

This page covers the consent side of agentic commerce chargebacks: what counts as an authorized agent purchase, which dispute reason code each agent mistake lands in, and which records prove consent. For who ultimately pays, see our guide to AI agent chargeback liability.

Agent traffic and chargeback volume are both climbing, and the first place they meet is your dispute queue.

Sources: Adobe Analytics (traffic growth, July 2024 to July 2025), Mastercard, What is the true cost of a chargeback for businesses? (updated June 2026, research by Datos Insights) (volume and cost).

What Is Agentic Commerce and How Does It Affect Your Store?

Agentic commerce is shopping where AI systems act instead of only answering: they research products, choose one and complete the purchase on a consumer's behalf, often with stored payment credentials already attached. For a merchant, the order arrives from an agent instead of a person, so the signals you used to prove a human bought it, such as device, session and navigation path, now describe the agent.

Chargeflow's Business Development Executive Frank Frantz covered the shift after Money20/20 in agentic commerce and its impact on fraud and chargebacks: the biggest changes in eCommerce are not happening on storefronts but in the invisible layers of automation underneath them. Infrastructure providers such as PayOS are already building the delegated permissions, stored credentials and purchasing authority that let agents transact across merchants.

How Do AI Agents Make Purchases on Behalf of Customers?

An agent receives purchasing authority through one of three mechanisms:

• Stored credentials connected to the customer's account.
• Delegated permissions the user grants explicitly, such as a budget or a product category.
• API-level access to checkout flows.

The agent then acts on preferences, shopping history and live data, often while the customer is away, so the customer may first learn of the purchase from a card statement. From the customer's side the charge can look unauthorized; from yours the order was legitimate. Chargeback systems were built to judge a human's intent at checkout, and that intent is now recorded somewhere else, if it is recorded at all.

What Counts as an Authorized Agent Purchase?

Card disputes turn on whether the cardholder authorized the transaction, and delegating to an agent in general does not settle that for each order. Three separate questions decide the outcome:

1. Was the agent authorized? Did the cardholder delegate to this agent, and with what scope: spend cap, categories, merchants, expiry?
2. Was the agent real? Can the network, issuer or merchant verify the agent's identity and that it acts for this cardholder?
3. Was this order inside the mandate? Do the item, price, quantity, merchant and shipping address match what the cardholder approved or the limits they set?

A yes on the first two with an unknown on the third is the gap that newer standards are built to close, which is why they record the instruction and the cart, not only the agent's identity. The table lists the main consent records networks and protocol owners have published, with the date each was announced. Several are still rolling out, so check each owner's page for current availability.

None of these records is guaranteed to reach you. Ask your processor whether agent identity or mandate data travels with the authorization, and keep your own copy of the cart, price and shipping address the agent submitted.

Why Are AI Agent Purchases Causing Chargebacks?

Ben Herut, Chargeflow's Fraud and Chargeback Strategist and MRC mentor, has documented four patterns in dispute queues, covered in depth in preventing fraud and chargebacks in agentic commerce.

1. Purchases customers cannot recall. An agent reorders based on past behavior and the customer never consciously approved that order. Confusion, not fraud, produces the dispute.
2. Delegated mistakes. Agents optimize for efficiency, not human context, and may pick a different product, an unfamiliar merchant or the wrong quantity. Instead of contacting support, the customer goes to the bank to correct what they see as an error.
3. Fraudsters mimicking agent patterns. Automated traffic blends in, so spoofed agent patterns look structured and low-risk to legacy systems until the dispute is filed.
4. Legacy tools misreading agent behavior. Device fingerprinting, behavioral analytics and velocity rules were built around human buying. When the buyer is an agent running on servers or cloud environments, those signals lose their meaning.

The Money20/20 takeaway was that "Agentic commerce brings efficiency but also a new layer of fraud and confusion that legacy systems can't interpret." For how AI-assisted shopping changes dispute drivers and volumes more broadly, see AI shopping chargebacks.

Which Dispute Reason Code Does Each Agent Scenario Land In?

The published Visa and Mastercard code lists show no agent-specific reason code, so an agent dispute files under whichever existing code matches the cardholder's claim. The claim, not the fact that an agent was involved, decides the evidence you need. Codes below are the standard ones listed in Visa chargeback reason codes and Mastercard chargeback reason codes.

The first and fourth scenarios are the agent version of accidental friendly fraud: the customer is not trying to cheat, they simply do not connect the charge to an instruction they gave. The last scenario often starts with account takeover fraud, where a criminal gains control of the account that holds the delegation.

Visa's Compelling Evidence 3.0 applies only to code 10.4. As described in the Checkout.com guide to Compelling Evidence 3.0, it needs two earlier undisputed transactions between 120 and 365 days old and at least two matching data elements, one of which must be the IP address or the device ID. Agent orders may carry the agent platform's IP address or device rather than the cardholder's, so test whether your earlier orders would actually match before you rely on it.

Who Is Liable for Chargebacks in Agentic Commerce?

Liability follows consent. The cardholder, the agent platform and the merchant are all exposed in theory, but no network rule assigns agent errors to the platform, and the merchant is the party answering the dispute, so merchants carry the burden today. A merchant holding an intent record that matches the cart is in the position of any authorized card-not-present sale; a merchant with only device and session data is not.

Three points sit outside the dispute itself. An AI agent is software and not a party to a card dispute. The agent platform's exposure comes from its contracts and from network requirements for agentic payment providers, not from a reason code. And the merchant of record, the business that appears as the seller on the card transaction, stays responsible for the dispute even when an agent assembled the cart. Because an agent order is still a card-not-present sale, the standard rules for card-not-present fraud are the baseline.

Every dispute also counts toward your monitoring ratios, whichever party failed on consent. Visa's merchant "Excessive" level under VAMP is a 1.5% ratio (effective April 2026), and Mastercard's Excessive Chargeback Merchant tier starts at a 1.5% ratio with 100 chargebacks, both covered in Mastercard chargeback monitoring programs. For consumer-protection rules such as Regulation E and the EU framework, see agentic commerce regulation.

How Can Merchants Prevent Agentic Commerce Chargebacks?

Pre-purchase fraud controls assume a person is present at every step. Treat consent as data you collect instead of something you infer.

• Capture consent at three points. Log the delegation (scope, spend cap, categories, expiry), the cart the cardholder approved, and the order as placed, including price, shipping address and the agent's credential reference. Together they answer the three consent questions above.
• Make agent orders recognizable. Many agentic disputes are confusion, not fraud. A clear billing descriptor and a confirmation message that names the agent that bought keep the charge from reading as unknown.
• Audit your fraud stack for non-human patterns. If your tools rely on device attributes, behavioral biometrics or human navigation signals, they may flag legitimate agent orders or miss fraudulent ones. Review your wider ecommerce fraud prevention setup with that in mind. Teams building their own agents also invest in AI agent development solutions that log what the agent decided and why.
• Screen orders after checkout, before fulfillment. Agent traffic is hard to judge at the moment of checkout, so check the order afterward: does it fit the customer's history, has the pattern appeared at other merchants, does identity data agree? Chargeflow Prevent scans every order after checkout and before fulfillment and scores it with network data, so you know whether it is safe to ship. Chargeback alerts add a pre-chargeback step for charges the customer does not recognize, so you can refund before a dispute opens.
• Set a refund line for agent errors. When an agent buys the wrong variant inside its mandate, an early refund or return often costs less than a dispute and keeps the order out of your ratio. The trade-offs are laid out in chargeback vs refund.
• Match evidence to the claim. Use consent records for authorization claims and cart and delivery records for product claims, the same approach as when you win an unauthorized transaction chargeback. The full checklist and templates are in the evidence playbook for agentic commerce chargebacks, and Chargeflow Automation collects the evidence and submits the response for you.

Agentic Commerce Chargebacks FAQs

Who is liable when an AI agent makes an unauthorized purchase?

No agent-specific network rule assigns it yet. The cardholder, the agent platform and the merchant are all exposed in theory, but the merchant answers the dispute, so the merchant carries the burden unless it can prove the cardholder's consent covered the order. A hijacked agent or stolen credential is ordinary third-party fraud and follows the usual fraud rules.

Can merchants win chargebacks from AI agent purchases?

Yes, when the evidence matches the claim. Device fingerprints and navigation history describe the agent, so the strongest evidence is the delegation record, the approved cart or recorded instruction, and proof of delivery.

What counts as consent for an AI agent purchase?

Consent has three parts: the cardholder delegated to the agent, the agent's identity can be verified, and the specific order falls inside the limits or the cart the cardholder approved. Delegation alone rarely settles a dispute over a single order.

Which chargeback reason code applies to an AI agent purchase?

The same codes as any other card-not-present sale, chosen by the cardholder's claim. An unrecognized or unauthorized order files as Visa 10.4 or Mastercard 4837 or 4863, a wrong item as Visa 13.3 or Mastercard 4853, a continued standing order as Visa 13.2 or Mastercard 4841, and a missing delivery as Visa 13.1 or Mastercard 4855.

Who is the merchant of record when an AI agent completes a purchase?

The business that appears as the seller on the card transaction and settles with its acquirer, normally the merchant selling the goods. An agent platform becomes the merchant of record only if it takes the payment itself and settles to the merchant afterward.

Is an AI agent itself liable for a chargeback?

No. An agent is software and not a party to a card dispute, which runs between the cardholder's issuer and the merchant's acquirer. Any exposure for the agent's operator comes from its contracts and from network requirements for agentic payment providers, such as those Visa added to its rules in April 2026.

Do legacy fraud detection tools work on AI agent transactions?

Not reliably. Device fingerprinting, behavioral biometrics and velocity rules were built around human buying patterns, and an agent running on servers or cloud environments makes those signals lose their meaning. That is why checking the order after checkout is becoming more important than checkout-stage screening for this transaction type.

What should merchants look for in a checkout setup that supports agent-driven purchases?

Look for fraud checks designed around non-human signals, clear billing descriptors so agent-initiated charges are recognizable, and a way to store the agent's credential reference, the approved cart and the delegation record as dispute evidence.

How should merchants update their dispute process for agent-led transactions?

Add a consent record to every agent order, tag the orders you can identify as agent-placed so you can track their dispute rate separately, route authorization claims and product claims to different evidence templates, and set a refund threshold for clear agent errors. Tagging depends on what your processor passes through with the authorization.

Chargeflow helps merchants prevent and recover chargebacks across Shopify, Stripe, WooCommerce and more. See how Chargeflow Prevent screens every order after checkout and before fulfillment.