You tell your agent: "Book me a refundable flight to Lisbon next Friday, under $400." It books a $380 fare. Non-refundable. Your plans change, you can't cancel, and you call your bank: "I didn't authorize that."
Who loses the $380?
It sounds like a simple question. It turns out nobody in the chain has a clear answer, so I went looking at what the checkout terms, the card rules and the new mandate standards actually say.
1. The checkouts point at the merchant
| Checkout | What the terms say |
|---|---|
| OpenAI (ACP) | "OpenAI is not the merchant of record." For merchants: "Your platform is responsible for handling refunds and chargebacks." (OpenAI) |
| Google (UCP / AP2) | "Retailers remain the seller of record." AP2 offers a "non-repudiable audit trail", but no dispute terms. (Google) |
| Stripe (Agentic Commerce Suite) | The seller handles "disputes, refunds, and reversals." (Stripe) |
| PayPal (Agent Ready) | Seller Protection covers "unauthorized transactions and items not received." Not "the agent misunderstood me." (PayPal) |
| Amazon (Buy for Me) | "The Merchant is the seller"; the merchant's return terms apply. |
| Microsoft (Copilot Checkout) | "You stay the merchant of record." (Microsoft) |
The platforms built the agent, the payment token and the checkout flow. None of them took the loss when the agent gets it wrong.
One clause stood out. Stripe's agent-services terms are the only contract I came across that names the actual failure mode: the agent platform is responsible, toward Stripe, for unauthorized transactions caused by "bugs, hallucinations or misinterpretations" (Stripe §8.3). So someone has written down that agents misinterpret. The merchant still handles the dispute.
2. The rule-makers haven't decided either
Visa's new agent rules (April 2026) make the agent keep a record of what you asked for. They don't say what happens when the agent ignores it (Visa Rules §4.1.24). The industry's draft standard, from EMVCo, explicitly leaves the question open. US law, read by the lawyers, lands on the merchant: "in practice, the merchant bears the loss" (Goodwin).
Even the Fed is asking. In September, Governor Waller put it plainly: "Who is on the hook if an agent makes the wrong purchase?" (Federal Reserve) He didn't answer.
3. Not all agent mistakes are the same
Most discussions treat "the agent got it wrong" as one problem. It's at least three, and today all three end up in the same place.
- The agent exceeded what the user allowed. The user signed "up to $400"; the agent spent $480. This is the easy case: there's a clear line and the agent crossed it.
- The agent obeyed the letter and missed the meaning. The fare was under $400, the right city, the right date. But it was non-refundable, or the wrong size, or the wrong edition. Inside every limit the user set, and still not what they wanted.
- Nobody can prove what the user asked. No signed instruction exists, so it's the user's word against a platform log.
Card networks have no reason code for any of these. They all arrive as "not authorized" or "not as described", and the issuer decides. Worldpay's head of agentic commerce, describing a dispute without a signed mandate: "a coin flip, and issuers tend to side with the cardholder" (Worldpay).
Case 1 should be the agent platform's problem. Case 3 is solved by recording consent properly. Case 2 is the hard one. It's not fraud, it's not a broken rule, and it's where most real disputes will come from.
4. The evidence already exists, and counts for nothing
Here's the part that surprised me most.
The industry has quietly converged on a way to record exactly what the user authorized. Google's AP2 v0.2 (April 2026) and Mastercard's Verifiable Intent (realigned to AP2's schemas the same month) now use the same design: a mandate signed with the user's key, listing constraints, cryptographically linked to the final cart and payment (AP2 spec; Verifiable Intent). Both were donated to the FIDO Alliance. Technically, this is excellent.
Two problems.
No dispute rule recognizes it. As of October 2026, no Visa or Mastercard rule treats a signed mandate as compelling evidence. The rules that do shift liability for card-not-present fraud (Visa Compelling Evidence 3.0, Mastercard First-Party Trust) are based on purchase history, matching device and IP addresses. For agent traffic, the device and IP belong to the agent's servers, not the buyer, so those matches often fail (Chargeflow). The best evidence ever created for a purchase has no formal standing in the system that decides who pays.
The mandate can't express what users actually say. The constraint types in AP2 v0.2 and Verifiable Intent are: allowed merchants, specific product SKUs and quantities, payees, amount ranges, budgets, recurrence, execution dates and payment references (VI constraints). There is no product category ("running shoes") and no refundability: the requires_refundability field existed in AP2's v0.1 SDK and is gone from v0.2. So the instruction from the top of this post, "a refundable flight under $400," can't be fully signed in today's standard. Either the user pre-approves exact SKUs (which defeats the point of an agent), or the signed mandate is looser than what they said, which is exactly where case 2 lives.
5. Everyone stops one step short
Putting it together:
- Protocols create the evidence (signed mandates, agent identity) but leave disputes to the merchant.
- Networks require that the instruction be kept, but don't say what it's worth in a dispute.
- PSPs assign disputes to the merchant, and in Stripe's case assign agent misinterpretation to the agent platform, but don't cover it.
- Fraud-guarantee vendors (Signifyd, Riskified, Forter) have all launched agent-traffic products, but their guarantees cover fraud. Signifyd itself expects agent abuse to surface as "disputes framed as confusion rather than fraud" (Signifyd). Confusion isn't covered.
- The only guarantees announced cover the buyer, not the merchant: American Express's Agent Purchase Protection (announced April 2026, still not available in October) and Ant International's AgentSafePay (live since September, terms unpublished).
What I haven't found yet is anyone who checks agent orders against the user's mandate as a neutral party and pays the merchant when a checked order goes wrong. If it exists, I'd love to know.
6. Why it matters now
Agent purchasing is still small; Amex said in April there had "probably been as many press releases as transactions." But the absence of an answer is already shaping the market:
- Banks are blocking. JPMorgan said on its Q3 call that it will block AI agents from client accounts; Bank of America is limiting access while it determines "who is liable for AI-authorised payments"; Citi bars third-party agents (The Paypers). Six banks called liability for agent purchases "unclear and inefficient."
- Merchants are blocking. Amazon's robots.txt disallows every major shopping agent. Only 23% of merchants can even tell agent traffic from human traffic (Visa Acceptance).
- Acquirers name it as the top barrier. 56% of acquirers say redesigning liability frameworks is the #1 obstacle to agentic commerce (Visa Acceptance/PYMNTS, 150 acquirers).
A note on the stat you've probably seen, "93% of merchants say the AI provider should cover the loss": it's real, but it comes from a PYMNTS survey of 60 merchants, which PYMNTS itself calls "directional." And "three-quarters of consumers won't let an agent pay autonomously" is Forrester's, not PYMNTS'. The better-powered data (the acquirer number above) points the same way.
What would fix it
Card fraud had the same shape fifteen years ago: merchants carried a risk they couldn't price, so they declined good orders. The fix wasn't a new rule. It was companies like Signifyd that checked each order and put money behind the decision: approve it, and if it turns out to be fraud, we pay.
Agent purchases need the same thing for a different question. Not "is this buyer real?" but "did the agent do what this user authorized?" The pieces exist: signed mandates, agent identity, PSP dispute data. What's missing is a neutral party that checks the order against the mandate, and stands behind the answer.
I'm working on that. If you build agents that buy things, issue cards to them, or are the one eating these disputes today, I'd like to hear where this is wrong.
Sources are linked inline and reflect public documents as of October 2026. This space moves fast, so if I got something wrong, tell me in the comments.