Who Pays for Fraud When an AI Agent Places the Order?

Every fraud tool you run today was built on one assumption: the person paying is right there in the session. Their device, their location, how they type, whether they hesitate. Agentic commerce takes that person out of the session. When an AI agent places an order for a shopper, through an API or a checkout the assistant hosts, your fraud stack is scoring the transaction with its most telling evidence missing.

So who pays when that order turns out to be fraud? As of October 2026, mostly the same party as before: the merchant. The merchant stays merchant of record, a fraud chargeback on an unauthenticated card payment still lands on the merchant, and none of the card network agent programs we reviewed hands that loss to the agent platform. What's changing is the way out. Card networks, Stripe, Google and Shopify are building verifiable agent identity, payment credentials scoped to one purchase, and signed records of what the shopper actually authorized. Merchants who accept those signals and keep them will push fraud risk back to issuers and win disputes. Merchants who don't will keep absorbing losses in a channel they can barely see.

This is the fraud side of the problem we described in AI Direct Checkout Bypasses Your Checkout Customizations: when the buyer never walks through your checkout, your fraud signals don't make the trip either.

Who carries the liability today

Start with what hasn't changed.

• The merchant is still the merchant of record. The Universal Commerce Protocol checkout specification says the business remains merchant of record, and Shopify's agent checkout docs say the same. Refunds, disputes and chargebacks run through your payment provider, as we explained in who handles the money in AI channel checkout.

• Fraud chargebacks follow card-not-present rules. If a stolen card pays for an agent order and the payment wasn't authenticated, the loss sits with the merchant, exactly as it would on your own site.

• Authentication still shifts liability. Stripe's 3D Secure documentation explains that a fraud dispute on a payment successfully authenticated with 3DS typically shifts liability to the card issuer, in some cases with equivalent cryptograms such as Apple Pay and Google Pay, and that the shift is expected but never guaranteed.

The catch is that 3DS was designed around a cardholder who can answer a challenge in a browser or a banking app. An agent isn't the cardholder. That's why the networks are building authentication for agents. Visa's Intelligent Commerce developer guide describes a FIDO passkey that binds a device and a network token after the cardholder authenticates, and says it "offers eligibility for liability shift under the digital authentication framework." Mastercard's Agent Pay framework issues agentic tokens only to registered, verified agents. Worldpay summarizes the result: when an agent authenticates properly and a token is issued correctly, liability generally follows existing authenticated tokenized-transaction rules, with the issuer carrying fraud risk, and no agent-specific liability shift exists yet.

The unsolved part is everything short of outright fraud. A shopper who says "my agent bought the wrong size" or "it spent more than I told it to" isn't claiming a stolen card. That's a dispute about what was authorized, and no network rule settles it cleanly yet. American Express announced Agent Purchase Protection in April 2026: in the future, when a registered agent sends Amex the card member's authenticated purchase intent and then deviates from it, Amex will protect eligible charges, but only after the card member has initiated a return with the merchant where possible. That protects the card member. It doesn't say what the merchant absorbs.

My view: treat every agent order without network authentication as an ordinary card-not-present order with less evidence than usual, because that's exactly what it is. The agent platform isn't going to pay for it.

Diagram: Endertech

How do you detect fraud with no browser session?

Riskified describes fraud data in three buckets: interaction data (location, connection, device, behavior), customer data (email, name, address, phone) and order data (products, quantities, payment types, promo codes). When an agent transacts, the interaction bucket mostly vanishes or turns generic. Signifyd adds the uncomfortable part: the IP on an agent order most likely belongs to the data center hosting the agent, often far from the billing and delivery addresses, and agent abuse tends to look too clean rather than noisy. A fast, first-try checkout with no browsing used to be a warning sign. Now it's also what a perfectly good agent order looks like.

Detection has to move to three new questions:

• Who is the agent? Cryptographic identity on every request, so you can tell a registered shopping agent from a scraper or a card-testing script.

• What was it allowed to do? A payment credential scoped to your store, an amount and a time window, so a hijacked agent can't spend beyond what the shopper granted.

• What did the shopper actually ask for? A signed record of intent you can compare against the order and later show an issuer.

The behavioral layer doesn't disappear. It moves up and later. Riskified's answer is network data, shifting the question from "How is this user interacting with my site or mobile app?" to "Has this customer or bad actor been observed across the intelligence network?" Signifyd argues for watching behavioral drift against the customer's history and connecting cancellations, returns, refunds and chargebacks back to how each order was placed.

Diagram: Endertech

How today's fraud tools work

Most merchants run some mix of these. Here's what each relies on and what it says publicly about agent orders.

• Shopify fraud analysis. Indicators such as AVS and CVV results, whether the customer's location matches the payment method, unusual device or network activity, and multiple cards tried, plus a recommendation from machine learning trained on transactions across Shopify stores. Shopify Payments can block some high-risk checkout attempts before an order exists, and some orders get no recommendation at all, including POS, B2B, gift-card-only and subscription renewal orders. The help page doesn't yet describe how agent-channel orders are scored.

• Shopify Protect. Free coverage for fraudulent and unrecognized chargebacks on eligible orders paid with Shop Pay through a US Shopify Payments account, including Shop Pay used as accelerated checkout on platforms such as Facebook, Instagram and Google. Orders must contain only shipped physical items, be fulfilled with valid tracking within 7 days and be in transit within 10. Pickup orders, digital products and Shop Pay Installments are excluded, and changing the shipping address after checkout voids coverage.

• Signifyd. Scores orders against its commerce network and backs approved orders with a chargeback guarantee. In our integrations, part of its signal came from a script on the storefront, which a buyer who never visits your storefront never loads.

• Riskified. In August 2025 it launched AI Agent Approve, an MCP server agents can call for a fraud decision, an AI Agent Intelligence view of orders that originate from shopping agents, and an AI Agent Policy Builder for agent-driven policy abuse.

• NoFraud, now Wyllo. NoFraud rebranded as Wyllo in March 2026 after acquiring Yofi, extending checkout fraud screening into returns, refunds and support. That direction fits agent abuse, which often shows up after the sale.

• Stripe Radar. Scores payments on Stripe. For agent purchases paid with Shared Payment Tokens, Stripe says the tokens are powered by Radar and relay signals such as the likelihood of a fraudulent dispute, card testing, a stolen card or an issuer decline. Merchants on other processors can request access to Radar's Payment Evaluation API.

• 3D Secure. Shifts fraud liability to the issuer when authentication succeeds, with the agent limits described above.

The pattern: every one of these was built to judge a session or an order. None was built to judge a delegation. That's the change coming next.

How fraud tools have to change

1. Agent identity you can verify

Web Bot Auth uses HTTP Message Signatures (RFC 9421): the agent signs each request with a private key and publishes the matching public key, so a merchant or CDN can verify who is calling instead of trusting a user agent string or an IP address. Visa's Trusted Agent Protocol, released in October 2025 with Cloudflare, builds on that standard and signals whether the agent intends to browse or to buy. According to Cloudflare, Visa's protocol and Mastercard's Agent Pay both use Web Bot Auth, with nonces and timestamps that block replayed requests. Mastercard says merchants can verify its registered agents at the CDN layer without deploying new code.

Shopify is already enforcing the idea. Its May 7, 2026 changelog applies the strictest rate limits to bots and agents that don't sign their requests. For its UCP agent tools, only token-authenticated agents whose token is granted permission to complete purchases can call complete_checkout, and every such call must carry a Shopify-Buyer-IP header with the IP address of the buyer the agent is acting for. That's a platform deliberately putting a buyer signal back into a flow that has no browser.

2. Payment credentials scoped to one purchase

Handing an agent a raw card number is the riskiest version of agentic commerce. The programs replace it with credentials that carry limits:

• Stripe's Shared Payment Tokens are scoped to one seller, capped at an amount the agent sets to the checkout total, expire, can be revoked, and can only be resolved once. Stripe says it may use agentic tokens from Mastercard Agent Pay, Visa Intelligent Commerce and the Amex ACE kit on the seller's behalf.

• The Agentic Commerce Protocol, created by Stripe, OpenAI and Meta, defines a delegated payment request that requires an allowance (maximum amount, currency, checkout session, merchant and expiry) and at least one risk signal, today a card-testing score with an action of authorized, manual review or blocked.

• Mastercard's agentic tokens go only to registered agents and can carry purchase intent data such as cart contents, transaction limits and validity windows, which Mastercard says gives merchants an audit trail for disputes.

• Visa Intelligent Commerce Connect, announced April 8, 2026 and in pilot, offers tokenization, spend controls and authentication through one integration, and accepts agent payments made through Trusted Agent Protocol, ACP, UCP and the Machine Payments Protocol.

3. A signed record of what the shopper authorized

This is what will decide the "my agent got it wrong" disputes. Google's Agent Payments Protocol (AP2), announced in September 2025, uses signed mandates: a Checkout Mandate tied to the specific checkout the merchant signed, and a Payment Mandate for the payment instrument. Each comes in an open form (the shopper's constraints for an autonomous purchase) and a closed form (one finalized checkout). In April 2026 Google donated AP2 to the FIDO Alliance and released v0.2 with "Human Not Present" payments. Mastercard's Verifiable Intent, co-developed with Google and open-sourced in March 2026, records who authorized the agent, what they asked for, and what the agent and merchant did, and Google says it is also being donated to FIDO.

Standards bodies are following. EMVCo's Agentic Payments Task Force released a draft framework in September 2026 built around shared "Intent Services" and said it may consider Know Your Agent capabilities and agentic transaction indicators, with possible enhancements to EMV 3DS and payment tokenization. American Express is moving the same way: as of April 14, 2026, the Account Enablement, Intent Intelligence and Payment Credentials specifications in its ACE developer kit were available, with Agent Registration and Cart Context still in development.

4. A way to hand the buyer back

Not every agent purchase should finish without the shopper. The UCP checkout specification lets a merchant answer with requires_buyer_review for cases like high-value order approval and send the buyer to its own checkout through a continue_url. Shopify's Checkout Kit, embeds the merchant's real checkout, with its branding, checkout UI extensions and Functions, inside an agent or app. When the buyer finishes in your checkout, your normal fraud signals come back. That's the step-up path you want for your riskiest orders.

What changed in 2026

If you last looked at this in 2025, these are the changes that matter for fraud:

• March: OpenAI stepped back from Instant Checkout and lets merchants use their own checkout from ChatGPT. Mastercard open-sourced Verifiable Intent. NoFraud became Wyllo.

• April: Visa launched Intelligent Commerce Connect in pilot. American Express launched its ACE kit and announced Agent Purchase Protection. Google donated AP2 to the FIDO Alliance and released v0.2.

• May: Shopify began applying its strictest rate limits to unsigned bots and agents.

• September: EMVCo released its draft agentic payments framework for industry comment.

What our own fraud work taught us

These are anonymized examples from fraud and order-risk work we've built for retail clients between 2023 and 2026. None of them involved agent-placed orders, but each one maps directly onto the problem.

• Gate downstream systems on the fraud decision, not on the order. For a multi-location furniture retailer, we planned the fraud-vendor rollout so payment is captured only after the vendor approves the order, and our middleware ties the ERP to that decision: a rejection places the order on credit hold, and if no decision arrives within 15 minutes the order is inserted on a credit hold instead of released. Agent orders need the same gate, because they arrive faster and with less evidence.

• Every new payment path needs an explicit rule. On that same project, some PayPal orders were landing on credit hold at ERP insert, and we changed the rule so the fraud approval check no longer applied to that payment method. Agent tokens are a new payment path. Decide on purpose how your stack treats them.

• Rules tuned to "normal" misfire when the channel changes. For a performance auto parts retailer's custom commerce platform, we built rule-based fraud flags in 2023: billing and shipping mismatches, missing AVS, high order totals, international orders. A year later, wholesale and drop-ship orders, which legitimately ship somewhere other than the billing address, were being held, and we changed the rule. Agent orders will trip the same kind of rules with data-center IPs and instant checkouts.

• Coverage depends on the payment setup you choose for agent channels. A retailer we work with is deciding right now how to enable in-agent checkout, and fraud coverage is part of that decision: Shopify Protect only applies to Shop Pay orders on a US Shopify Payments account, so the payment configuration decides whether that coverage exists at all.

What to do now

1. Know which agent paths finish in your checkout. Orders handed back to your checkout keep your fraud signals; direct checkouts inside assistants don't. Start with what AI direct checkout bypasses.

2. Tag and score agent orders separately. Use the sales channel on the order, for example in a Shopify Flow workflow, so data-center IPs and instant checkouts don't trigger blanket holds and agent orders don't get waved through either. To see how much revenue those orders bring in, compare Shopify's agentic reports with GA4.

3. Gate capture, fulfillment and ERP sync on the fraud decision, with a timeout path to a hold. This is where a solid Shopify back-office integration pays for itself.

4. Keep the evidence. Store what the channel gives you: agent identity, credential type, amount limits, mandate or intent references. In a "my agent got it wrong" dispute, that record is your case.

5. Ask your fraud vendor three questions. Do you identify agent-originated orders? Does your guarantee cover them? Which agent identity and intent signals do you use today?

6. Watch after the sale. Rapid cancellations, returns right after delivery and refund requests framed as confusion are where agent abuse shows up.

7. Use step-up where the protocol allows it. Send high-value or first-time agent orders back to the buyer for review instead of approving them blind.

This work crosses payments, checkout, fraud tooling and back-office systems, and teams that own only one piece rarely see how the pieces fail together. That's where an experienced ecommerce development partner earns its keep.

How we know

This post is based on public documentation and announcements from Visa, Mastercard, American Express, EMVCo, the AP2 project and Google, Stripe, the ACP and UCP specifications, Shopify's Help Center and developer docs, Cloudflare, Signifyd, Riskified, Wyllo and Worldpay, all read on November 2, 2026, and on Endertech's fraud and order-risk work for retail clients from 2023 to 2026: fraud-vendor integrations, payment capture and ERP credit holds, and rule-based fraud scoring on a custom commerce platform.

Limits

This isn't legal advice. Network rules, your card agreements and your contracts decide liability for any specific order. Most agent payment programs are in pilot or early preview and their liability terms are still being written, so recheck before you rely on any of this. The client work we drew on predates agent-placed orders, so the dispute guidance here comes from the documented programs, not from case outcomes. This post covers card payments in the US; bank transfers, other wallets and European Strong Customer Authentication raise separate questions.

Last reviewed: November 2, 2026.

Sources

• 3D Secure authentication, Stripe Documentation (accessed November 2, 2026).

• Intelligent Commerce Developer Guide, Visa Acceptance Platform (accessed November 2, 2026).

• Visa Introduces Trusted Agent Protocol, Visa, October 14, 2025 (accessed November 2, 2026).

• Visa opens the door to AI-driven shopping for businesses worldwide (Intelligent Commerce Connect), Visa, April 8, 2026 (accessed November 2, 2026).

• Agentic token framework: Driving trusted AI transactions, Mastercard (accessed November 2, 2026).

• How Verifiable Intent builds trust in agentic AI commerce, Mastercard, March 5, 2026 (accessed November 2, 2026).

• Agentic Commerce Experiences (ACE) and Amex Agent Purchase Protection, American Express (accessed November 2, 2026).

• How EMVCo is Working to Enable Secure, Interoperable and Scalable Card-Based Agentic Payments, EMVCo, September 1, 2026 (accessed November 2, 2026).

• Agent Payments Protocol (AP2) documentation, AP2 project (accessed November 2, 2026).

• Google donates Agent Payments Protocol to FIDO Alliance, Google, April 28, 2026 (accessed November 2, 2026).

• Agentic Commerce Protocol, Stripe Documentation (accessed November 2, 2026).

• Delegate payment, Agentic Commerce Protocol (accessed November 2, 2026).

• Shared payment tokens, Stripe Documentation (accessed November 2, 2026).

• Introducing our agentic commerce solutions, Stripe (accessed November 2, 2026).

• Radar risk signals for any payment processor, Stripe Documentation (accessed November 2, 2026).

• Checkout Capability, Universal Commerce Protocol (accessed November 2, 2026).

• Carts and checkout for agents, Shopify.dev (accessed November 2, 2026).

• Auth and rate limiting, Shopify.dev (accessed November 2, 2026).

• Bots and agents should identify themselves via Web Bot Auth, Shopify developer changelog, May 7, 2026 (accessed November 2, 2026).

• Checkout Kit, Shopify.dev (accessed November 2, 2026).

• Reviewing orders with fraud analysis, Shopify Help Center (accessed November 2, 2026).

• Protecting an order with Shopify Protect, Shopify Help Center (accessed November 2, 2026).

• Securing agentic commerce: helping AI Agents transact with Visa and Mastercard, Cloudflare (accessed November 2, 2026).

• What is Agentic Commerce Fraud? Risk, Tactics and Prevention, Signifyd, February 17, 2026 (accessed November 2, 2026).

• Agentic commerce means detecting fraud with less data, Riskified, January 15, 2026 (accessed November 2, 2026).

• Riskified launches multiple solutions to accelerate the safe adoption of AI shopping agents, Riskified, August 13, 2025 (accessed November 2, 2026).

• NoFraud Rebrands as Wyllo, Wyllo, March 2026 (accessed November 2, 2026).

• Agentic commerce liability is still being written, Worldpay (accessed November 2, 2026).

• Powering Product Discovery in ChatGPT, OpenAI, March 24, 2026 (accessed November 2, 2026).

Before you let agents buy

Agent orders are worth taking, on terms you've set. If you want to know how your fraud tools, checkout and back-office systems will treat them, talk with Endertech about an agent-readiness review of your order risk. For the checkout side of the same problem, see AI Direct Checkout Bypasses Your Checkout Customizations.