When AI shops for you, who owns the mistake?
Payment companies are deciding what an AI agent is allowed to spend. Those same controls may end up deciding who pays when it buys the wrong thing.
What happened
This month, Visa, Mastercard and Stripe each showed how AI agents will pay for things on behalf of businesses. All three led with aspects of control: budgets, approval steps, and verified agents. Mastercard put it plainly: "Payments aren't the hard part. Authority is." Banks are saying the same from their side. Bank of America's CEO said a human should approve money leaving an account, and that the bank is working out who is liable when an agent authorizes a payment.
How I read it
Those controls exist to keep agents aligned. They also create a record that you said yes, and that record matters more than it looks.
US law caps what you owe for an unauthorized credit card charge at $50. The catch is that word, "unauthorized", it means someone used your card without your permission. An agent you set up, funded and approved has your permission by design. So when it buys the wrong thing within your limits, the purchase looks authorized, and the protection most people rely on may not apply.
Even disputing the charge as an order that wasn't "delivered as described" isn't the same protection, because the agent got exactly what it ordered. It just wasn't what you meant.
So far only American Express has promised to cover "AI agent error", and only for registered agents that carry proof of what you intended. Everyone else is building the approval button first and leaving the question of who pays for later.
That question was settled once before. In 1970, Congress decided that when someone uses your card without permission, you owe at most $50 and the bank covers the rest. Agents reopen that question, and right now the companies designing these products are answering it before regulators have.
These mistakes won't stop with the shopper. They'll come back as returns and chargebacks, and online merchants usually absorb those. As someone who manages a brand, I think that's where the cost of an agent's misunderstanding will land first.
What we don't know yet
No regulator or court has said how these rules apply to an agent's mistake. Card networks could extend their own zero-liability promises to agents.
What would change this reading
A Consumer Financial Protection Bureau (CFPB) statement or a Visa or Mastercard rule that treats an agent's mistake within your limits as something you can dispute.
Disclosure: I run growth for a skincare brand that sells through AI shopping agents. Merchants usually carry disputed charges, so I have a stake in how this lands.
Sources
- 15 U.S.C. § 1643, liability of the cardholderCornell LII · primary
- 12 CFR 1026.12, Regulation Z, unauthorized useCornell LII · primary
- 12 CFR 1026.13, billing errorsCornell LII · primary
- Mastercard Agent Pay for Machines in actionMastercard · · primary
- Visa, BILL and Billtrust pilot for trusted AI agent paymentsVisa · · primary
- Treasury for agentsStripe · · primary
- US banks limit AI agents' access to customer accountsRetail Banker International (citing CNBC) · · reporting
- American Express debuts ACE developer kit and protection for registered agent purchasesBusiness Wire · · primary