Preventing Fraud and Chargebacks in Agentic Commerce

A practical guide from Ben, Chargeflow’s Fraud and Chargeback Strategist and Mentor at the MRC

Agentic Commerce Is Rewriting the Risk Playbook

Agentic commerce fraud is fraud, disputes and wrongful declines that occur when an AI agent, rather than the cardholder, completes the checkout. This guide is the operations playbook for legitimate agent orders: how to verify the agent, tokenize its credentials, score the order after checkout and be ready for the dispute. For attacks by malicious agents and spoofed bot traffic, read our guide to preventing AI agent fraud.

AI agents are not only affecting purchases, but they are also starting to make them. As these automated systems handle more of the buying process, new problems arise in how merchants detect fraud, understand customer intent, and avoid chargebacks. 

I see this change every day. Dispute data reveals a rising trend of customers disputing charges that resulted from automated decisions they did not fully understand or expect. Through my work mentoring fraud teams, participating in the MRC’s Fraud Committee, and collaborating daily with merchant operations, I observe how both customers and fraudsters are adjusting to this new way of shopping. 

This guide focuses on issues already appearing in dispute queues, rather than predictions about the distant future. These cases show how quickly agent-driven purchasing is shaping post-purchase risk. Who ends up paying for those disputes is covered in our guide to AI agent chargeback liability.

What Agentic Commerce Changes About Fraud

Traditional fraud tools assume a human is behind every action. That assumption begins to falter the moment the buyer is an autonomous agent.

Visa’s own research on agentic commerce makes the same point: current payment infrastructure was designed around human interaction and will need to adapt (The Rise of Agentic Commerce). At Sibos on September 29, 2026, Federal Reserve Governor Christopher Waller described the authentication shift in his speech Payments in the Age of AI Agents: the question moves from proving that a buyer is an authorized payer to proving that an agent has the authority to pay on the buyer’s behalf. He added that fraud models and rules will need to be recalibrated for agent payment patterns.

As agents gain greater control, many of the longstanding signals lose their reliability. Device fingerprints, behavioral profile patterns, friction signals, and navigation paths are rooted in human-based behaviors. Agents are now acting in predictable and "machine-consistent" ways that existing systems cannot process.

Intent becomes much harder to verify. Sometimes the customer expected the agent to take action, but not in the specific manner in which it was taken. Sometimes the agent acted on learned logic that the customer had overlooked or forgotten. Fraudsters are leveraging that lack of clarity. Legitimate customers are, at the same time, disputing charges because of their own confusion versus deliberate misuse. Stopping that loss means building chargeback fraud prevention into the order flow, not only the dispute queue.

The risk extends far beyond fraud. There is increasing misalignment between what customers expect and what their agent decides.

The figures below explain why fraud teams now treat agent orders as their own risk class instead of a variation of card-not-present fraud.

Sources: Mastercard, What is the true cost of a chargeback for businesses? (updated June 2026, research by Datos Insights); Mastercard, September 2026; Visa, November 2025.

Real-World Scenarios Ben Is Already Seeing

Among merchants using agent-driven purchasing, several consistent patterns are emerging. They appear in dispute reports, customer support threads, and fraud reviews, reflecting how quickly agentic commerce is changing post-purchase risk. Frank Frantz’s Money20/20 insights on agentic commerce and its impact on fraud and chargebacks show the same shift: AI-driven purchasing is already altering fraud and customer intent.

Four patterns show up most often:

A. AI Purchases the Customer Cannot Recall

Many merchants are already experiencing disputes related to orders that were technically authorized but not consciously requested by the customer. An agent may reorder items based on past behavior, availability, or preference learning. Still, the customer may not remember granting that approval or may never notice the automation running in the background.

When the charge appears, the customer's instinct is to deny any involvement. Even though the order is legitimate, the merchant cannot easily demonstrate intent because the human did not complete the transaction. The Agent did. 

In most cases, confusion directly results in a chargeback. Because the cardholder genuinely does not recall the approval, it behaves like friendly fraud on a legitimate order.

B. Delegated Mistakes

Agents are designed to optimize, not to interpret human context. They may choose a slightly different product than expected, select a merchant the customer wouldn't normally use, or buy the wrong quantity based on how they analyzed the prompt or data.

Instead of contacting support, many customers go directly to their issuer when the agent’s choice falls outside their expectations. The dispute becomes the customer’s way of correcting what they see as an error, even though the transaction was technically valid from the agent's perspective. These expectation gaps are also the main dispute driver for AI shopping assistants, covered in AI shopping chargebacks.

C. Abuse of Automation APIs

Fraudsters now understand that automated traffic blends in considerably better than human or manual traffic. By spoofing agent patterns or exploiting automation endpoints, they can generate transactions that appear structured, consistent, and low-risk to legacy fraud systems.

Because these flows bypass many human indicators, to the merchant, the activity appears normal and in line with legitimate automation. Only after the dispute is filed does the pattern reveal itself as synthetic. This approach is gaining traction because it passes through the gaps created by agent-driven workflows. The attacker side of this problem, including spoofed agents and fake storefronts, is covered in the companion guide on malicious agents.

D. False Positives Creating Future Chargebacks

Some merchants are encountering disputes that originate from friction created within the fraud stack, rather than with fraud itself.

Agent-driven flows sometimes trigger fraud rules, require extra verification, or get declined. The customer is then confused and frustrated with the process, especially when the agent handled the flow "out of sight." Later, when a legitimate charge appears, the customer disputes it simply because their trust in the flow was already broken.

These are entirely preventable, but they show how easily agentic behavior and human expectations fall out of sync.

The table maps each pattern to how the dispute is usually framed and the first control that helps. Which reason code each scenario lands in, and what counts as an authorized agent purchase, is covered in who is liable when AI agents shop for your customers.

Why Legacy Fraud Tools and Playbooks Break Down

Most pre-payment fraud systems and tools were developed during a time when a human was involved in every step of the customer journey. Agent-driven commerce breaks that foundation, which means some of the strongest tools in a merchant’s stack no longer behave as expected.

Device-based risk models lose meaning.

Traditional models rely heavily on device characteristics to identify suspicious behavior. When the “buyer” is an agent running through servers or cloud environments, the device attributes no longer map to human identity or intent. This removes a major anchor point in existing fraud detection logic.

Velocity rules begin to misclassify automated flows.

Agents often operate on schedules or logic loops that repeat with predictable timing. Legacy velocity rules (e.g., based on the actual hour of the activity) are designed to flag repeated human behavior. They incorrectly escalate normal agent activity, creating false positives that lead to friction, missed revenue, and downstream disputes.

Behavioral analytics cannot interpret non-human patterns.

Models that rely on mouse movement, scrolling, pause time, or speed between actions lose effectiveness because agents do not adhere to human interaction norms. What appears suspicious in a human context may be entirely legitimate when an agent is executing the flow.

Manual review becomes unmanageable.

Agent-driven transactions increase volume while reducing visibility. Cases that once required a few minutes of analysis now lack the human signals reviewers rely on. Manual review cannot scale with automation, and even when teams attempt to do so, the outcomes are inconsistent because the underlying signals are incomplete. Treating chargeback management as a system, not a fire drill, pays off.

The biggest gap appears during disputes.

Even when a merchant knows a transaction is legitimate, proving intent becomes significantly harder. Issuers expect evidence that shows a clear connection between a customer and a purchase. In agentic commerce, part of that action is delegated. Without new types of supporting data, merchants lose cases simply because the evidence cannot resolve the dispute.

Legacy systems are not failing because they are weak. They are failing because they were never designed for environments where agents, not humans, complete major parts of the purchase journey.

How To Verify a Legitimate AI Agent at Checkout

Because device and behavior signals no longer identify the buyer, verification moves to the agent itself. Five signals exist today. None is universal yet, so log each one and feed it into scoring instead of treating any single signal as a gate.

When no signal is present, treat the order as an unverified agent order and log that no agent identity was presented. Do not decline it automatically, because that creates the false-positive disputes described in pattern D. Send it to the scoring step below instead. Authentication at mandate creation, such as a 3D Secure 2 challenge when the customer first authorizes the agent, also gives you an issuer-backed record of the customer’s participation. Network programs change quickly, so track them in agentic commerce regulation.

Scoring Signals That Still Work for Agent Orders

Once the agent is identified, score the order itself. These signals do not depend on a human device or mouse movement, so they stay usable on agent traffic. They sit on top of your baseline ecommerce fraud prevention controls such as AVS, 3D Secure and velocity limits.

Two more signals need data from outside your store: whether the same agent has produced clean, undisputed orders over time, and whether it or its credential has produced disputes at other merchants. Raise the review threshold for new or inconsistent agents and relax it for agents with a clean history. Replace velocity rules based on the hour of human activity with per-agent and per-credential velocity, so a scheduled reorder is not flagged as a burst.

The Move to Post-Purchase Intelligence (Ben’s POV)

As agent-driven commerce grows, the signals that matter most often appear after the transaction, not before it. Pre-purchase controls were designed to address human behavior and struggles when intent is shared between a human and an agent. In this environment, preventing losses requires stronger visibility into what becomes clear only once the order exists.

Post-purchase intelligence fills in the gaps that legacy systems leave behind. It helps answer questions that cannot be resolved at checkout, including:

• Does this order make sense given the customer’s past behavior, or does it indicate confusion or unintended automation?
• Does this agent have recognition across a wider merchant network, or is it new, unverified, or behaving inconsistently?
• Have similar transactions at other merchants resulted in disputes that signal misuse or new fraud techniques?
• Are there inconsistencies in identity or device attributes that suggest manipulation behind the automation?

These signals offer context that pre-purchase tools cannot. They help determine when an agent acted outside customer expectations, when automation is being abused, and when a familiar pattern is likely to convert into a dispute. The wider goal is to prevent eCommerce chargebacks across the store.

Until today, in many cases, the only reliable way to understand intent well enough to intervene before the issuer becomes involved has been post-purchase analysis. It gives merchants a chance to reach out, verify, correct mistakes, or cancel orders before they become chargebacks, and for physical goods, before the products are shipped.

Post-purchase intelligence is more than an upgrade. It is a necessary shift in how merchants protect revenue in an environment where agents, not humans, initiate more of the buying process.

Canceling or refunding an order can prevent a later dispute, but does not guarantee that a fraud report or dispute already filed disappears from monitoring. Visa’s VAMP standard Excessive Merchant criteria in Asia Pacific, Canada, EU and US (effective April 1, 2026) apply when the acquirer is not Above Standard or Excessive: at least a 1.5% ratio using the sum of the TC40 fraud count and TC15 dispute count, divided by the count of settled TC05 card-not-present VisaNet payments in the same month, AND at least 1,500 monthly fraud-and-dispute reports, and Mastercard ECM uses 100–299 current-month chargebacks and a 1.5%–2.99% ratio, calculated against the previous month's captured payments (see VAMP and ECM chargeback thresholds).

Check the Visa fact sheet and your acquirer's applicable notice. The standard merchant criteria above apply when the acquirer is not Above Standard or Excessive; other regional, local and acquirer criteria differ. The VAMP ratio is the sum of the TC40 fraud count and TC15 dispute count, divided by the count of settled TC05 card-not-present VisaNet payments in the same month. Certain pre-dispute resolutions and qualifying CE3.0 TC40 records are excluded, depending on extract timing; one payment can appear in both reports. A ratio alone does not establish enrollment, fines or closure, and being below these standard merchant thresholds does not guarantee freedom from acquirer or processor review.

Use a simple triage rule for every agent order:

Dispute Readiness for Agent Transactions

Some agent orders will still be disputed, so capture the record at the time of purchase: the agent identifier and its verification result, the mandate or consent record (scope, limits, timestamp), the order confirmation sent to the customer and any reply, delivery proof, and the account and delivery-address history. The full checklist and templates are in the agentic commerce chargebacks evidence playbook.

Visa’s Compelling Evidence 3.0 can move liability back to the issuer on Visa 10.4 fraud disputes when you show at least two prior undisputed transactions made 120 to 365 days earlier, with matching data points such as IP address, device ID, account login and delivery address. Agent traffic usually runs from provider infrastructure, so IP and device matches may point to the agent instead of the customer. Capture the account login and delivery address on every agent order so the match still holds. Details are in Visa Compelling Evidence 3.0 explained.

How Chargeflow Prevents and Supports Merchants in Agentic Commerce

Although this guide is not focused on products, it is important to recognize that merchants need tools that reflect the realities of agent-driven purchasing. Automation introduces gaps that traditional fraud systems were never meant to handle, and many merchants are looking for practical ways to close those gaps without adding friction or manual effort. As Mysterium VPN points out, a residential VPN can also support safer remote store access by encrypting device-wide traffic on public or shared Wi-Fi, helping merchant teams protect logins, cookies, and admin sessions when reviewing orders or disputes outside the office.

Chargeflow Prevent scans each order after checkout and before fulfillment. It scores the order with post-purchase signals and intelligence from a network of 20,000+ merchants, then cancels, verifies or approves the order before anything ships, with a false-positive rate under 0.1%. Pricing is $0.10 per scanned transaction, and the first 1,000 scans are free. It does not replace the agent-verification signals above. It adds the order-level and network-level view they cannot provide.

Each stage of the order lifecycle needs its own control:

My goal is not to promote a specific solution, but to emphasize that merchants now need preventive layers that reflect how commerce is changing. Agent-driven transactions require a different type of visibility.

Frequently Asked Questions

What is agentic commerce fraud?

Agentic commerce fraud is any fraud, dispute or wrongful decline that occurs when an AI agent, not the cardholder, completes the checkout. It covers malicious or spoofed agents, and also legitimate orders that the customer later disputes because they did not expect or remember what the agent bought.

Why is agentic commerce important for fraud prevention?

Fraud tools built on device, behavior and velocity signals assume a human buyer, and agent orders break those signals. Legitimate agent orders also produce disputes from forgotten approvals and delegated mistakes that legacy tools cannot tell apart from fraud. Federal Reserve Governor Christopher Waller said in September 2026 that fraud models and rules will need to be recalibrated for agent payment patterns.

How do you prevent fraud in agentic commerce?

Verify the agent through signed requests, network-tokenized credentials and a recorded mandate. Score each order against the mandate and the customer’s history after checkout, confirm with the customer before fulfillment when the order deviates, and keep the agent ID and consent record as dispute evidence.

How do agentic payment solutions prevent fraud?

Card networks issue tokenized credentials to registered agents, attach limits such as spending caps and approval workflows, and let agents sign requests so merchants can verify them. These measures confirm who the agent is and what it was authorized to do. They do not remove disputes from forgotten or mistaken purchases, which is why post-checkout screening and evidence capture still matter.

How is agentic commerce fraud detected?

Detection shifts from device and behavior signals to agent identity, mandate match and history. Compare each order with the mandate limits and the customer’s past orders, track whether an agent has produced clean orders on your store, and use network-level dispute history. Run velocity rules per agent and per credential instead of per hour of human activity.

What should you look for in an agentic commerce fraud prevention solution?

Look for support for agent identity signals from the card networks, scoring that does not rely on device or mouse behavior, a decision before fulfillment, a low false-positive rate, and a path to evidence submission for disputes that still occur. Chargeflow Prevent scans orders after checkout and before fulfillment with a false-positive rate under 0.1%.

Who pays when a legitimate agent purchase is disputed?

Under existing card-not-present rules the merchant generally carries the chargeback unless a liability shift applies, and network rules for agent-specific cases are still being defined. The split between merchant, agent platform, issuer and customer is covered in the AI agent chargeback liability guide.