AI Agent Chargeback Liability: Who Pays When Agentic Commerce Goes Wrong

AI agent chargeback liability is the question of who absorbs the loss when a purchase made by an AI agent is disputed: the cardholder, the agent platform, the issuing bank or the merchant. The card networks' public dispute rules were written for a human buyer and say little about agents, so a disputed agent purchase generally follows the card-not-present rules: the merchant carries the loss unless it wins the dispute or the transaction was authenticated in a way that moves fraud liability to the issuer.

This guide covers who pays and which rules decide it. For what counts as an authorized agent purchase and how each consent scenario maps to a dispute category, see our guide to agentic commerce chargeback liability.

What Is Agentic Commerce and Why Does It Matter for Chargebacks?

Agentic commerce is when AI agents autonomously research products, compare options, and complete purchases on behalf of a consumer. The consumer sets preferences and grants permission, but the agent handles the rest without requiring approval for each individual transaction.

This matters for chargebacks because every dispute rule on the books was designed for a two-party model: a buyer and a seller. One person decides to buy. The other person fulfills the order. When something goes wrong, the card networks have clear processes to assign fault between those two parties.

AI agents break that model. Now there is a third party making purchasing decisions, and the existing chargeback frameworks do not account for it. The agent is not the buyer. The agent is not the seller. Yet the agent is the one that initiated the transaction.

The volume is already visible. Visa reported in October 2025 that AI-driven traffic to US retail sites had grown 4,700% over the previous year (Visa press release), and the card networks have since launched agent-specific programs, covered below. For the wider picture, see the impact of agentic commerce on fraud and chargebacks and how AI is changing online payments more broadly.

For merchants, this creates a direct threat. You accepted a legitimate-looking order, fulfilled it in good faith, and now face a dispute where the consumer says they never approved the purchase. The rules that are supposed to help you fight back were not built for this scenario.

The Chargeback Liability Gap: Three Parties, No Clear Owner

When an AI agent makes a purchase that gets disputed, three parties could be on the hook.

The consumer delegated authority to the agent. They gave it permission to shop, set a budget, or defined preferences. But did they authorize this specific purchase? That answer is rarely clear.

The AI provider built and operates the agent. They designed the decision-making logic. If the agent misinterprets a preference or makes a purchase the consumer did not want, the provider's product caused the problem.

The merchant accepted the order and fulfilled it. You processed a transaction that looked valid, shipped the product, and now face a chargeback.

The issuer and acquirer sit behind them. The issuing bank decides whether to credit the cardholder and which dispute category applies, and the acquirer passes the cost to the merchant through the processing agreement. Neither takes part in the agent's decision, but both decide how the dispute is routed.

Understanding who is liable for AI agent purchases requires looking at each party's role, what they control, and where their exposure sits.

No existing framework cleanly assigns responsibility among these parties. There is no rule that says "if an AI agent made the purchase, the AI provider is liable." There is no regulation that says "if the consumer gave broad permission, they cannot dispute individual transactions."

The result is a liability gap. And right now, merchants sit in the most exposed position. When a chargeback lands, you are the one who loses the revenue, pays the chargeback fees, and absorbs the operational cost of fighting the dispute, regardless of whether the AI agent or the consumer caused the problem.

Who Is the Merchant of Record in an Agent Purchase?

The merchant that sells the goods and takes the payment stays the merchant of record. The agent platform does not take that role. OpenAI's production guidance for its Agentic Commerce Protocol says the merchant selling the goods and taking payment is the merchant of record, that OpenAI and payment service providers are not, and that the merchant manages refunds and chargebacks. The Universal Commerce Protocol likewise states that businesses remain the merchant of record with ownership of the customer relationship. The protocols that make agent checkout possible also confirm where disputes land: on the seller.

Why Traditional Chargeback Rules Break Down

Chargeback rules were built around two concepts: authorization and evidence. Both fall apart in AI-agent transactions.

Authorization Becomes Ambiguous

In a traditional transaction, authorization is straightforward. The cardholder entered their payment details and clicked "buy." That action is the authorization, and it ties directly to a specific purchase.

With AI agents, authorization gets layered. The consumer authorized the agent to act on their behalf. But that blanket permission does not automatically cover every transaction the agent completes. If a consumer tells an agent "buy me groceries this week" and the agent orders a premium item the consumer did not expect, was that transaction authorized?

Current card network rules have no clean answer. The authorization happened at the agent level, not the transaction level. And when a consumer disputes the charge, the merchant is left trying to prove authorization for a purchase the consumer may have never seen before it arrived.

Consumer-protection law draws the same line. Under Regulation Z, unauthorized use of a credit card means use by someone without actual, implied or apparent authority, and Regulation E excludes transfers by a person the consumer gave access to the account. A consumer who deliberately delegated purchasing power to an agent has arguably given it that authority, so a dispute over what the agent bought may fall outside the "unauthorized" category and be handled as a billing error or merchant dispute instead. Regulators have not applied these definitions to AI agents, so treat this as an open question rather than settled law.

Traditional Evidence Disappears

Merchants defend chargebacks with evidence: IP addresses, device fingerprints, browsing history, session data. These signals prove a real human interacted with your site and made a deliberate purchase decision.

AI agents erase all of that. An agent often does not browse your site the way a human does, and when it does, the device and network data it presents belong to the agent platform, not the cardholder. It does not generate session history that shows comparison shopping and deliberate selection. The behavioral signals merchants rely on to win disputes are missing or misleading for agent-initiated transactions.

Here is what changes when you move from traditional disputes to agentic commerce chargebacks:

This puts you in a bind. You need evidence to fight a chargeback. The best evidence comes from human behavior. And the transaction had no human behavior to capture.

Which Rule Decides Who Pays Today

According to a May 2026 legal analysis by FBT Gibbons, Visa's rules as of April 2026 expressly address agentic transactions by requiring identity verification under Visa Intelligent Commerce specifications and a provisioned token, while Mastercard's public Transaction Processing Rules stay silent and govern agents through programs such as Agent Pay and agentic tokens. The analysis also notes that 3-D Secure struggles with agent traffic because agents lack the device telemetry and biometrics it expects.

Reason codes describe the cardholder's claim, not the agent's role. The same agent purchase can arrive as a fraud code or a consumer dispute code depending on what the cardholder says, so review the Visa chargeback reason codes and the wider set of chargeback reason codes before you decide which evidence to build. In a July 2026 analysis, Worldpay's head of agentic commerce put the unresolved part plainly: when agents authenticate through network frameworks, liability follows existing tokenized-transaction rules, and the murky cases are everything short of outright fraud, such as an agent that misread an instruction. For the general rules on who carries fraud losses, see who bears the loss in payment fraud.

How AI Agents Create New Chargeback Risks for Merchants

AI agents do not just break existing chargeback processes. They create entirely new dispute scenarios that merchants need to prepare for.

Unauthorized AI Purchases

An AI agent tracks a consumer's buying patterns and places an order based on past preferences. The consumer receives a product they did not explicitly ask for and disputes the charge. From the consumer's perspective, they never approved this specific purchase. From your perspective, the agent placed a valid order with valid payment credentials.

This is the most straightforward AI-agent dispute scenario. Whether the consumer's claim holds depends on what the mandate covered: if the order falls inside it, the dispute is closer to buyer's remorse than fraud, and if it falls outside, the consumer did not approve it. Without a stored mandate record, you cannot show which case you are in. Expectation gaps create the same disputes when an assistant's product summary does not match the listing; see AI shopping chargebacks for how that changes dispute volume.

Friendly Fraud Gets Harder To Fight

Friendly fraud is already one of the biggest chargeback challenges merchants face. AI agents make it worse.

A consumer may genuinely not recognize a purchase their agent made. They check their credit card statement, see a charge they do not remember approving, and file a dispute. This is not malicious fraud. It is confusion, and it looks identical to friendly fraud from the merchant's side.

The difference is that traditional friendly fraud at least has behavioral evidence you can use in a dispute response. You can show the consumer browsed your site, added items to a cart, and completed checkout. With agent-initiated purchases, that evidence trail does not exist, making these disputes harder to fight in either direction.

Card Network Monitoring Programs at Risk

Every merchant lives with chargeback ratio thresholds set by the card networks. Visa's VAMP program flags a merchant as Excessive at a 1.5% ratio in most regions (effective April 2026), counting fraud reports and disputes together. Mastercard's ECM program applies at a 1.5% to 2.99% ratio with at least 100 chargebacks in a month. Penalties range from fines to increased processing costs to losing your merchant account entirely, and chargeback thresholds across both networks differ by region. Volume is already heading up: Mastercard forecasts that the global cost of chargebacks to merchants will rise from $36.9 billion in 2026 to $46.1 billion in 2029 (Mastercard, What is the true cost of a chargeback for businesses? (updated June 2026, research by Datos Insights)).

AI-agent disputes add volume to your chargeback risk regardless of whether the disputes are legitimate. If agent-initiated transactions become a meaningful share of your order volume, the resulting disputes can push you toward those thresholds fast. And the monitoring programs do not distinguish between a traditional dispute and one caused by an AI agent acting on a consumer's behalf.

How Much Can Agent Orders Raise Your Chargeback Ratio?

The practical rule is to tag agent-originated orders with the identifier you log and track their dispute rate as a separate segment, so you see the problem before the blended ratio moves.

Industry Protocols Merchants Should Know About

The payments industry is building agent-specific identity and authorization layers. None of the protocols below publishes a rule that allocates chargeback liability between merchants, issuers and agent platforms, and American Express's program covers cardholders only. Status as of October 2026:

Visa's Trusted Agent Protocol (TAP), published on October 14, 2025 with Cloudflare, uses cryptographic signatures so merchants can identify trusted agents, verify their legitimacy and tell them apart from malicious bots. It carries agent intent, consumer recognition data and payment information. Visa Intelligent Commerce Connect, announced on April 8, 2026 and in pilot with select partners, supports TAP alongside the Machine Payments Protocol, Agentic Commerce Protocol and Universal Commerce Protocol. That signed record is the kind of evidence that can support a dispute response, although Visa's announcements do not describe dispute treatment.

Mastercard's Agent Pay issues agentic tokens, dynamic credentials tied to a registered agent, and captures verifiable purchase intent before the transaction. Its Agent Pay Acceptance Framework lets merchants recognize registered agents through Web Bot Auth checks at the CDN layer without new code, with deeper integrations available.

Google's Agent Payments Protocol (AP2), announced on September 16, 2025 and now developed with the FIDO Alliance, uses a checkout mandate that captures purchase details and user authorization and a payment mandate that authorizes a specific amount. The protocol describes the result as a non-repudiable audit trail, which is the record you want when a cardholder says they never approved a purchase. The Universal Commerce Protocol, built by Google, Shopify and other companies, covers discovery through checkout and builds on AP2 for payments.

OpenAI's Agentic Commerce Protocol (ACP), built with Stripe, defines how agents pass payment credentials and order data to merchants through a Shared Payment Token. OpenAI discontinued its native Instant Checkout in March 2026 in favor of merchant-owned checkout, and ACP continues to power merchant integrations.

American Express announced Agent Purchase Protection on April 14, 2026. It protects eligible cardholders from charges tied to the error of a registered AI agent, provided the cardholder authorized the agent and the agent sent authenticated purchase intent, and terms and conditions apply. The announcement does not say how merchants are treated. Because American Express runs a closed-loop network, it can set cardholder protection without waiting for thousands of banks to agree, which is harder under the four-party Visa and Mastercard model.

EMVCo published a draft EMV Agentic Payments framework on September 1, 2026, with public feedback open through September 30, 2026. It introduces Intent Services, a shared layer for registering and retrieving consumer-authorized intent, and does not address disputes or liability.

Here is how these protocols compare at a glance:

Treat these as an evidence source first. Until the networks publish dispute rules for agent purchases, a signed agent record strengthens your response, and only the tokenized, authenticated flows described above move fraud liability toward the issuer.

Agentic Commerce Regulation 2026: Where Things Stand

As of 2026, no government has enacted agentic commerce regulation that specifically addresses who is liable when an AI agent makes a purchase autonomously.

The EU AI Act, the most comprehensive AI regulation on the books, does not address autonomous purchasing or payment liability. It focuses on AI risk classification and transparency requirements. The EU's AI Omnibus, formally adopted in mid-2026, moved the high-risk system deadlines to December 2, 2027 for stand-alone systems and August 2, 2028 for systems embedded in regulated products.

PSD3, the next revision of Europe's Payment Services Directive, and the new Payment Services Regulation reached political agreement in November 2025 but are not yet applicable. Legal summaries of the agreed texts, such as this April 2026 review, focus on bank-transfer impersonation scams and outsourcing duties, so merchants should not assume they will settle agent card disputes.

In the United States, Regulation Z and Regulation E, described above, remain the consumer-protection baseline, and no federal rule addresses agent-initiated purchases specifically. Worldpay's analysis notes that Regulation E assumes a binary view of authorization and has no answer for an agent that bought something more expensive than the consumer intended.

The bottom line: the payments industry is moving faster than regulators. Card network protocols and platform-level agreements will likely define the rules of engagement before legislation catches up. Merchants cannot wait for regulation to protect themselves.

How Merchants Can Protect Themselves Now

You do not need to wait for regulators or industry protocols to finalize. There are concrete steps you can take today to reduce your exposure to AI-agent chargebacks.

Build an Evidence Strategy for Agent-Led Transactions

The evidence gap is your biggest vulnerability. Start closing it now.

Build this evidence infrastructure before disputes arrive. Retrofitting your systems after chargebacks start rolling in costs more time and money. The chargeback evidence source map shows where each piece of proof lives across your payment stack.

Visa's Compelling Evidence 3.0 relies on matching identifiers such as IP address, device and account across past undisputed orders. Agent traffic often arrives from the agent platform's servers, so check whether your prior agent orders actually produce matching identifiers before you count on that route.

Chargeflow Automation collects 1,000+ data points per dispute to build the evidence package, so the agent identifiers and mandate records above sit alongside the standard order, delivery and customer-history evidence in the same response.

Prevent Chargebacks Before They Happen

Preventing agentic commerce fraud starts with stopping disputes before they become chargebacks. This is especially true for AI-agent transactions, where your evidence position is weaker from the start.

Chargeback alert programs such as Verifi and Ethoca notify you when a cardholder disputes a charge. You can resolve the issue, often through a refund, before it becomes a formal chargeback on your record.

Post-purchase fraud detection adds another layer on top of standard ecommerce fraud prevention. These tools analyze order patterns after the purchase to flag suspicious activity, including orders placed by a hijacked or rogue agent the consumer never authorized, a pattern that often starts with account takeover. For the operations playbook on verifying legitimate agent orders, see preventing fraud and chargebacks in agentic commerce.

Chargeflow Alerts works through Verifi RDR, Ethoca and the Chargeflow Network, refunds each alert automatically and claims up to 90% deflection. Chargeflow Prevent scans each order after checkout and before fulfillment, scoring device, IP, email and payment behavior against a network of 20,000+ merchants, so you can cancel or verify risky orders before they ship.

Automate Your Dispute Response

Manual chargeback management cannot keep up with AI-agent dispute volume. Every dispute requires evidence gathering, formatting, and submission within tight deadlines. Miss a deadline, and you lose by default.

Automated chargeback platforms handle the entire dispute lifecycle without human bottlenecks. They collect evidence, build response packages, submit representations on time, and optimize strategies based on outcomes. This is not optional for merchants facing a new category of disputes on top of their existing chargeback volume.

Chargeflow Automation handles chargebacks end to end, from evidence collection to submission, with a 4X ROI guarantee and a 25% fee on recovered chargebacks only. A dispute from an agent-placed order is still a card dispute with the same reason codes and deadlines, so it runs through the same workflow. What changes is the evidence you attach.

Read more about: Preventing AI Agent Fraud

Set Clear Customer Guardrails

Prevention starts with communication. Make sure your customers know when an AI agent initiates a transaction on their behalf.

Chargeflow covers all three stages: Alerts deflect disputes before they post, Prevent screens orders after checkout and before fulfillment, and Automation builds and submits the evidence response when a chargeback still lands.

Start for free

FAQ

Who Is Liable When an AI Agent Makes an Unauthorized Purchase?

No card rule assigns liability to the agent platform. An agent purchase is handled like a card-not-present sale: if the cardholder claims fraud and the transaction was authenticated through a network agent program, fraud liability typically sits with the issuer. Otherwise the merchant bears the loss unless it wins the dispute. Consumer-protection rules such as Regulation Z do not yet address agents.

Can Merchants Dispute Chargebacks From AI Agent Transactions?

Yes. You respond through the same process and deadlines as any chargeback, but you build the case from agent identifiers, the mandate record and order confirmations because device and browsing data may be missing. See how to fight a chargeback for the response workflow.

How Does Agentic Commerce Affect Chargeback Ratios?

AI agents can increase dispute volume through unauthorized purchases, duplicate orders, and consumer confusion. Those disputes count toward Visa's VAMP ratio, where merchants are Excessive at 1.5%, and toward Mastercard ECM, which applies at a 1.5% to 2.99% ratio with at least 100 chargebacks.

How Much Can Agent Orders Raise My Chargeback Ratio?

Blended ratio equals agent share times agent dispute rate, plus the remaining share times your baseline. A merchant at a 0.60% baseline where 10% of orders come from agents that dispute at 3% lands at 0.84%. No public source reports a dispute rate for agent orders, so track your own agent segment.

What Is the Visa Trusted Agent Protocol?

TAP is Visa's framework for verifying AI agents acting on behalf of consumers. Published in October 2025 with Cloudflare, it uses cryptographic signatures to help merchants identify trusted agents and tell them apart from malicious bots, and it carries agent intent and consumer recognition data. Visa has not published how disputes are treated.

Who Is the Merchant of Record When an AI Agent Completes a Purchase?

The merchant that sells the goods and takes the payment. OpenAI's production guidance and the Universal Commerce Protocol both say the agent platform and payment service providers do not become the merchant of record, so the merchant handles refunds and chargebacks.

Does American Express Agent Purchase Protection Cover Merchants?

The announcement covers eligible cardholders who authorized a registered agent that sent authenticated purchase intent, subject to terms and conditions. It does not state how merchants are treated, so confirm the dispute process with your acquirer.

Can an AI Agent Be Held Legally Responsible for a Purchase?

An AI agent is software, not a legal person, so no card rule makes the agent itself liable. Responsibility attaches to the parties around it: the consumer who delegated authority, the company that operates the agent, and the merchant that accepted the order. Who pays a chargeback is decided by card network rules and contracts.

How Can Merchants Prevent Chargebacks From AI Agents?

Merchants should use chargeback management best practices to intercept disputes early, deploy post-purchase fraud detection for agent-initiated transactions, automate evidence collection, and ensure clear customer communication about AI-initiated purchases.