User Consent in Agentic Payments: Who's Liable When AI Agents Buy?

An agent-authorized purchase is a card payment an AI agent completes inside limits the cardholder set in advance. Typical limits are a spend cap, a product category or a standing reorder. A chargeback follows when the cardholder, the issuer and the merchant disagree on whether those limits covered the order.

This guide covers the consent side of agentic commerce chargebacks:

• What counts as an authorized agent purchase.
• Which dispute reason code each agent mistake lands in.
• Which records prove consent, including Visa's CE3.0 changes from October 24, 2026.

For who ultimately pays, see our guide to AI agent chargeback liability. For the evidence checklist and response templates, use the evidence playbook for agentic commerce chargebacks.

{{cta}}

Agent traffic and chargeback volume are both climbing, and the first place they meet is your dispute queue.

Sources: Visa and The Harris Poll (survey of 2,065 US adults, May 26-28, 2026), Mastercard Agent Pay announcement (September 30, 2026), Mastercard, What is the true cost of a chargeback for businesses? (updated June 8, 2026, research by Datos Insights) (volume and cost).

What Is Consent-Driven Commerce in Agentic Payments?

Consent-driven commerce is a model where an AI agent can only pay inside limits the cardholder approved, and each payment carries proof of that approval. The proof travels with the transaction, so the issuer and the merchant can check it later.

User consent in agentic payments has three layers:

• Authentication. The cardholder proves who they are when they set up the agent. Mastercard's first live Agent Pay transactions in Europe used passkeys, and networks issue tokens tied to the agent instead of the raw card number. It is the same idea as 3D Secure 2.0 at a normal checkout.
• Delegation. The cardholder sets the agent's scope: spend cap, categories, merchants and expiry.
• Intent. A signed record links the instruction to the final cart and the payment.

The standards are starting to converge. In May 2026, Google's Agent Payments Protocol (AP2) and Mastercard's Verifiable Intent were contributed to the FIDO Alliance for joint work. AP2 defines how consent and delegation are communicated. Verifiable Intent defines how that consent is stored and checked as evidence.

Consumer trust is still thin. Only 23% of US consumers trust generative AI to handle payments for them, per the Visa survey above. A customer who is unsure about agent purchases is more likely to dispute one they do not remember.

Qu'est-ce que le commerce agentique et quel est son impact sur votre boutique ?

Agentic commerce is shopping where AI systems act instead of only answering. They research products, choose one and complete the purchase for a consumer, often with stored payment credentials.

For you, the order now arrives from an agent instead of a person. The signals you used to prove a human bought it, such as device, session and navigation path, now describe the agent.

Chargeflow's Business Development Executive Frank Frantz covered the shift after Money20/20 in agentic commerce and its impact on fraud and chargebacks. His view: the biggest changes in eCommerce are not happening on storefronts. They are happening in the automation layers underneath them.

Infrastructure providers such as PayOS already build the delegated permissions, stored credentials and purchasing authority that let agents transact. For the wider shift, see how AI in payment processing is changing how businesses grow.

Comment les agents IA effectuent-ils des achats pour le compte des clients ?

An agent receives purchasing authority through one of three mechanisms:

• Stored credentials connected to the customer's account, the same model as card-on-file payments.
• Delegated permissions the user grants explicitly, such as a budget or a product category.
• API-level access to checkout flows.

The agent then acts on preferences, shopping history and live data, often while the customer is away. The customer may first learn of the purchase from a card statement. To them, the charge can look unauthorized. To you, the order was legitimate.

Chargeback systems were built to judge a human's intent at checkout, and that intent is now recorded somewhere else, if it is recorded at all.

What Counts as an Authorized Agent Purchase?

Card disputes turn on whether the cardholder authorized the transaction. Delegating to an agent in general does not settle that for each order. Three separate questions decide the outcome:

1. Was the agent authorized? Did the cardholder delegate to this agent, and with what scope: spend cap, categories, merchants, expiry?
2. Was the agent real? Can the network, issuer or merchant verify the agent's identity and that it acts for this cardholder?
3. Was this order inside the mandate? Do the item, price, quantity, merchant and shipping address match what the cardholder approved?

A yes on the first two with an unknown on the third is the gap newer standards are built to close. That is why they record the instruction and the cart, not only the agent's identity.

The table lists the main consent records that networks and protocol owners have published, with dates. Several are still rolling out, so check each owner's page for current availability.

None of these records is guaranteed to reach you. Ask your processor or payment service provider whether agent identity or mandate data travels with the authorization. Keep your own copy of the cart, price and shipping address the agent submitted.

Pourquoi les achats d'agents IA provoquent-ils des « rétrofacturation » ?

Ben Herut, Chargeflow's Fraud and Chargeback Strategist and MRC mentor, has documented four patterns in dispute queues. He covers them in depth in preventing fraud and chargebacks in agentic commerce.

1. Purchases customers cannot recall. An agent reorders based on past behavior, and the customer never consciously approved that order. Confusion, not fraud, produces the dispute.
2. Delegated mistakes. Agents optimize for efficiency, not human context. They may pick a different product, an unfamiliar merchant or the wrong quantity. Instead of contacting support, the customer goes to the bank to fix what they see as an error.
3. Fraudsters mimicking agent patterns. Automated traffic blends in. Spoofed agent patterns look structured and low-risk to legacy systems until the dispute is filed.
4. Legacy tools misreading agent behavior. Device fingerprinting, behavioral analytics and velocity rules were built around human buying. When the buyer is an agent running on servers or cloud environments, those signals lose their meaning.

The Money20/20 takeaway: "Agentic commerce brings efficiency but also a new layer of fraud and confusion that legacy systems can't interpret." For how AI-assisted shopping changes dispute drivers and volumes more broadly, see AI shopping chargebacks.

Which Dispute Reason Code Does Each Agent Scenario Land In?

The published Visa and Mastercard code lists show no agent-specific reason code. An agent dispute files under whichever existing code matches the cardholder's claim. The claim, not the fact that an agent was involved, decides the evidence you need. The codes below are the standard ones listed in Visa chargeback reason codes and Mastercard chargeback reason codes.

The first and fourth scenarios are the agent version of friendly fraud. The customer is not trying to cheat. They simply do not connect the charge to an instruction they gave. The last scenario often starts with account takeover fraud, where a criminal gains control of the account that holds the delegation.

Three scenarios need extra care:

• Wrong quantity. The cardholder may dispute only the extra units, which makes it one of the partial chargebacks that cover part of a payment.
• Revoked delegation. Orders that keep billing after the cardholder revoked access follow the same logic as other recurring billing chargebacks.
• Business buyers. Procurement agents that buy on corporate cards add the buyer-authority questions covered in B2B card chargebacks.

What Changes for Agent Orders Under Visa CE3.0 From October 24, 2026?

Visa's Compelling Evidence 3.0 applies only to code 10.4. As the Checkout.com guide to Compelling Evidence 3.0 explains, it needs two earlier undisputed transactions between 120 and 365 days old. They must share at least two data elements with the disputed order, and one must be the IP address or the device ID.

Agent orders often carry the agent platform's IP address or device instead of the cardholder's. That made CE3.0 hard to use for agent disputes. Visa's April 2026 rules expand the remedy for disputes processed on or after October 24, 2026. The headline change: earlier transactions from more than one merchant can now qualify.

Visa's summary of changes confirms the effective date, the multi-merchant support and the updated pre-arbitration section. The token and agentic login ID details come from published summaries of the rule text, so confirm them with your acquirer.

If an issuer rejects your first response, the case can move to pre-arbitration. On the Mastercard side, Mastercard First-Party Trust uses a similar history-matching approach. Both reward the same habit: store the identifiers that link today's order to the customer's past ones.

Qui est responsable des « rétrofacturation s » dans le commerce intermédiaire ?

Liability follows consent. The cardholder, the agent platform and the merchant are all exposed in theory. But no network rule assigns agent errors to the platform, and the merchant is the party answering the dispute. So merchants carry the burden today.

A merchant holding an intent record that matches the cart is in the position of any authorized card-not-present sale. A merchant with only device and session data is not.

Three points sit outside the dispute itself:

• An AI agent is software and not a party to a card dispute.
• The agent platform's exposure comes from its contracts and from network requirements for agentic payment providers, not from a reason code.
• The merchant of record, the business shown as the seller on the card transaction, stays responsible for the dispute even when an agent assembled the cart.

Because an agent order is still a card-not-present sale, the standard rules for card-not-present fraud are the baseline.

How Much Agent-Led Dispute Risk Can You Tolerate?

No card network gives agent orders a separate allowance. Agent disputes count toward the same monitoring programs as every other sale. The real question is how much headroom you have before a program flags you.

Use these steps to set your own tolerance:

1. Tag agent orders. Use whatever your processor passes through. Mastercard's agent transaction score, in US testing since September 2026, is one future signal.
2. Track them separately. Calculate your chargeback ratio for agent orders and for everything else.
3. Keep a buffer. Set an internal ceiling below the program lines, because one bad month of agent errors can push the blended ratio over.
4. Act early. If agent orders dispute more often than the rest, add the consent records below before volume grows.

Check the Visa VAMP fact sheet and your acquirer's notice for exclusions and regional rules. For processor implementation and the separate Mastercard reporting periods, see Stripe's monitoring-program guidance.

The full program rules are in VAMP and Mastercard chargeback monitoring programs. For consumer-protection rules, such as Regulation Z for credit cards, Regulation E for debit cards and the EU framework, see agentic commerce regulation.

{{cta}}

Comment les commerçants peuvent-ils PRÉVENTION mettre en place le commerce agentique rétrofacturation?

Pre-purchase fraud controls assume a person is present at every step. Treat consent as data you collect, not something you infer. Start by capturing it at three points:

Together these three records answer the three consent questions above. Then close the remaining gaps:

• Make agent orders recognizable. Many agentic disputes are confusion, not fraud. A clear billing descriptor and a confirmation message that names the agent keep the charge from reading as unknown. Sharing order details with the issuer through Verifi Order Insight lets the cardholder see the purchase before filing.
• Audit your fraud stack for non-human patterns. If your tools rely on device, biometric or navigation signals, they may flag legitimate agent orders or miss fraudulent ones. Review your ecommerce fraud prevention setup with that in mind. Teams building their own agents also invest in AI agent development solutions that log what the agent decided and why.
• Screen orders after checkout, before fulfillment. Agent traffic is hard to judge at checkout, so check the order afterward. Does it fit the customer's history? Has the pattern appeared at other merchants? Does identity data agree? Chargeflow Prevent scans orders after checkout and before fulfillment and scores them with network data, so you know whether to ship.
• Add a pre-chargeback step. Chargeback alerts flag charges the customer does not recognize, so you can refund before a dispute opens.
• Set a refund line for agent errors. When an agent buys the wrong variant inside its mandate, an early refund or return often costs less than a dispute. It also keeps the order out of your ratio. The trade-offs are laid out in chargeback vs refund.
• Match evidence to the claim. Use consent records for authorization claims and cart and delivery records for product claims. It is the same approach you use to win an unauthorized transaction chargeback. Chargeflow Automation collects the evidence and submits the response for you.

Consent Records Decide Who Wins Agent Disputes

Networks are adding agent identity, intent records and wider CE3.0 rules, but none of them moves an agent dispute off your desk yet. The merchant who can show the delegation, the approved cart and the order as placed wins. The merchant who relies on device and session data usually does not.

FAQ sur Agentic Commerce : « rétrofacturation »

How do merchants manage consent, liability, and chargebacks in agentic commerce?

Merchants manage consent in agentic commerce by recording three things for every agent order: the delegation, the approved cart and the agent's identity. Liability follows that record, because the merchant answers agent disputes under the existing reason codes. Chargebacks are then fought with the record that matches the claim, or refunded early when the agent clearly made a mistake.

Qui est responsable lorsqu'un agent IA effectue un achat non autorisé ?

No agent-specific network rule assigns it yet. The cardholder, the agent platform and the merchant are all exposed in theory. In practice the merchant answers the dispute and carries the burden unless it can prove consent covered the order. The agent itself is not a party to the dispute. A hijacked agent or stolen credential is ordinary third-party fraud.

Who is liable for AI shopping agent fraud?

For AI shopping agent fraud on a card-not-present sale, the merchant usually absorbs the loss, the same as other online fraud. Liability moves to the issuer only when the transaction was authenticated in a way that shifts fraud liability, such as 3D Secure. The agent platform's exposure comes from its contracts, not from network chargeback rules.

What counts as consent for an AI agent purchase?

Consent for an AI agent purchase has three parts. The cardholder delegated to the agent, the agent's identity can be verified, and the specific order falls inside the limits or the cart the cardholder approved. Delegation alone rarely settles a dispute over a single order.

Which chargeback reason code applies to an AI agent purchase?

An AI agent purchase uses the same codes as any card-not-present sale. An unrecognized or unauthorized order files as Visa 10.4 or Mastercard 4837 or 4863. A wrong item files as Visa 13.3 or Mastercard 4853. A continued standing order files as Visa 13.2 or Mastercard 4841, and a missing delivery as Visa 13.1 or Mastercard 4855.

Les commerçants peuvent-ils générer de l'rétrofacturation s grâce aux achats effectués par des agents IA ?

Yes, merchants can win chargebacks from AI agent purchases when the evidence matches the claim. Device fingerprints and navigation history describe the agent, so the strongest evidence is the delegation record, the approved cart or recorded instruction, and proof of delivery. From October 24, 2026, Visa's expanded CE3.0 rules also make prior purchase history easier to use.

Who is the merchant of record when an AI agent completes a purchase?

The merchant of record is the business that appears as the seller on the card transaction and settles with its acquirer, normally the merchant selling the goods. An agent platform becomes the merchant of record only if it takes the payment itself and settles to the merchant afterward.

How should merchants update dispute and chargeback processes for agent-led transactions?

Merchants should update dispute and chargeback processes for agent-led transactions in four ways. Add a consent record to every agent order. Tag agent-placed orders so you can track their dispute rate separately. Route authorization claims and product claims to different evidence templates. Set a refund threshold for clear agent errors. Tagging depends on what your processor passes through.

What chargeback rate increase should merchants tolerate from agent-led transactions?

No card network sets a separate allowance, so agent-led transactions get no extra room. Their disputes count toward the same thresholds, such as Visa's 1.5% VAMP Excessive level and Mastercard's ECM level of 1.5% and 100 chargebacks. Track agent orders separately and keep the blended rate well below those lines.

Chargeflow helps merchants prevent and recover chargebacks across Shopify, Stripe, WooCommerce and more. See how Chargeflow Prevent screens orders after checkout and before fulfillment.