When the Bot Buys: Who's Liable When AI Agents Shop for Your Customers?

A dispute lands in your inbox. The order looks clean: same card, same address, same customer history. You check the transaction. Everything matches. But the customer says they never placed the order.

They did. Their AI assistant did.

This is not a hypothetical anymore. Agentic commerce, where AI agents research, decide, and complete purchases on behalf of consumers, is moving from demo to default. Adobe Analytics recorded a 4,700% year-over-year jump in generative AI traffic to US retail sites between July 2024 and July 2025. And chargeback volume is predicted to grow 24% from 2025 to 2028, reaching 324 million disputes globally. Those two trends are on a collision course, and for merchants, the impact is not arriving as an opportunity first. It is arriving as a dispute.

What Is Agentic Commerce and How Does It Affect Your Store?

Agentic commerce refers to AI systems that go beyond answering questions and actually take actions, including making purchases, on a consumer's behalf. Think of platforms like OpenAI that now allow customers to research and buy in the same place, with stored payment credentials already attached.

As Frank Frantz, Chargeflow’s Business Development Executive, noted following Money20/20:" Platforms like OpenAI are now letting customers research and buy in the same place, with their stored payment credentials. The biggest changes in eCommerce aren't happening on storefronts, they're happening in the invisible layers of automation underneath them."

Companies like PayOS are building the infrastructure that makes this possible today, enabling agents to access delegated permissions, stored credentials, and purchasing authority across merchants. The technology is real, it is live, and it is already interacting with your store.

For merchants, understanding this shift is not optional. It directly affects how orders get placed, who is accountable when something goes wrong, and how disputes get resolved.

How Do AI Agents Make Purchases on Behalf of Customers?

At a basic level, AI agents are given purchasing authority through one of three mechanisms: stored credentials connected to a customer's account, delegated permissions granted explicitly by the user, or API-level access to checkout flows.

The agent then acts on learned preferences, shopping history, and real-time data to complete a purchase, often without the customer being present at the moment of checkout. In many cases, the customer has no idea the purchase has been made until the charge appears on their statement.

This is where the friction begins.

The agent may have followed its instructions perfectly. But the customer may not recall setting those parameters, may have forgotten the delegation was active, or may simply not recognize the merchant name on their bill. From the customer's perspective, the charge looks unauthorized. From the merchant's perspective, the order was entirely legitimate.

Intent is now invisible. Chargeback systems were not built for invisible intent.

Why Are AI Agent Purchases Causing Chargebacks?

Ben Herut, Chargeflow's Fraud and Chargeback Strategist and MRC mentor, has documented the patterns already appearing in dispute queues. They fall into four consistent categories.

1. Purchases customers cannot recall. An agent reorders items based on past behavior or preference learning. The customer never consciously approved the specific transaction. When the charge appears, their instinct is to dispute it — even though the order was technically authorized. In most cases, confusion directly results in a chargeback.
2. Delegated mistakes. Agents optimize for efficiency, not for human context. They may choose a slightly different product, select a merchant the customer would not normally use, or buy the wrong quantity. Instead of contacting support, customers go straight to their bank. The dispute becomes their way of correcting what they see as an error, even though the transaction was valid from the agent's perspective.
3. Fraudsters mimicking agent patterns. Fraudsters now understand that automated traffic blends in far better than manual traffic. By spoofing agent patterns or exploiting automation endpoints, they generate transactions that appear structured and low-risk to legacy fraud systems. The activity looks like legitimate automation until the dispute is filed.
4. Legacy tools misreading agent behavior. Device fingerprinting, behavioral analytics, and velocity rules were built around human buying behavior. When the buyer is an agent running through servers or cloud environments, these signals lose their meaning. The tools cannot tell the difference between legitimate automation and fraud.

As Frank put it at Money20/20: "Agentic commerce brings efficiency, but also a new layer of fraud and confusion that legacy systems cannot interpret."

Who Is Liable for Chargebacks in Agentic Commerce?

This is the question no one in payments has fully answered yet. And for merchants, it is the most important one.

When an AI agent makes a purchase, the authorization chain becomes complicated. The human cardholder gave the agent permission to act on their behalf, but did they authorize this specific transaction? At this specific merchant? For this exact amount?

When the dispute hits, you have to prove intent. But the traditional evidence that works in a chargeback response, customer IP address, device fingerprint, navigation path, time on site, was generated by an agent, not a human. Issuers expect to see a clear link between a customer and a purchase. When part of that purchase was delegated, that link is harder to establish.

The liability question extends further. Where does the platform enabling the agent bear responsibility? Where does the merchant of record absorb the loss? What counts as meaningful consent when a customer sets up an AI agent months before a disputed purchase?

There are no clean answers yet. Card networks, issuers, and platform providers are all working through these questions. But disputes do not wait for the industry to catch up. They land in your inbox now,  and you have to respond with the evidence you have.

The merchants who will win these disputes are the ones building better post-purchase evidence trails today, before the rules are written.

How Can Merchants Prevent Agentic Commerce Chargebacks?

The shift to agentic commerce requires a shift in how merchants think about risk. Pre-purchase fraud controls were built for a world where a human was present at every step of the transaction. That world is changing. Here is where to focus.

• Audit your fraud stack for non-human transaction patterns. If your fraud tools rely primarily on device attributes, behavioral biometrics, or human navigation signals, they are likely to misclassify agent-driven transactions, either flagging legitimate orders or missing fraudulent ones. Understand what your tools are measuring and whether those signals still hold when the buyer is not human.
• Shift toward post-purchase intelligence. The most important signals in agentic commerce often appear after the transaction, not before it. Does this order make sense given the customer's history? Has this agent pattern appeared before across other merchants? Are there inconsistencies in identity that suggest manipulation behind the automation? Post-purchase intelligence answers questions that checkout-stage tools cannot, and it is where Chargeflow Prevent is built to operate.
• Update your dispute evidence strategy. Agent authorization logs, delegation records, and purchase context data are becoming the new evidence layer. If a customer set up an AI agent to make recurring purchases, documentation of that setup is your strongest defense in a dispute. Start thinking now about what evidence you would need to win a chargeback where the buyer was non-human.
• Communicate clearly with customers about agent permissions. Many disputes in agentic commerce are not fraud, they are confusion. Customers forget what they authorized, do not recognize the merchant, or do not understand what their agent did. Clear communication at the point of setup, and clear billing descriptors at the point of charge, can prevent a significant portion of these disputes before they start.

The Merchants Who Adapt Now Will Win Later

Agentic commerce is not a future problem. It is a present one. The dispute patterns are already appearing. The fraud techniques are already evolving. The liability questions are already unresolved.

The merchants who treat this as a distant concern will find themselves unprepared when agent-driven transaction volume accelerates – and it will accelerate fast.

The window is still open. Not for long.

Chargeflow helps merchants prevent and recover chargebacks across Shopify, Stripe, WooCommerce, and more. See how Chargeflow Prevent protects your revenue, before agentic commerce hits your dispute queue.