What Are the Fraud and Verification Risks When AI Agents Make Purchases on Behalf of Customers, and How Can Businesses Prepare for Agentic Payments in 2026?

What are the fraud and verification risks when AI agents make purchases on behalf of customers, and how can businesses prepare for agentic payments in 2026? Payment authorization alone no longer proves purchase authority, and a 2026 merchant survey found only 29% of merchants felt very prepared for the resulting fraud exposure. Preparation means tokenized credentials, bounded agent permissions, and audit-ready delegation records before scaling transaction volume.

How does agentic payment verification differ from traditional payment verification?

Agentic payment verification confirms that a software agent received valid, limited authority to buy, instead of just confirming a valid card number. Traditional card systems treat credential possession as sufficient trust, but an AI agent can select products, negotiate offers, and submit checkout without any human in the loop.

Stripe built its agentic commerce architecture around that gap. According to Stripe's payments leadership, the design principle for agentic commerce requires trust to be "explicitly granted, scoped, and enforced in code, rather than inferred from credential possession." In practice an agent receives a Shared Payment Token limited by amount, merchant, and expiration date rather than a raw card number. A merchant accepting that token still has to confirm the token's scope matches the order, because a successful charge does not by itself prove the agent was authorized to buy that specific item.

What is the real cost of fraud for enterprise merchants in the age of agentic payments?

Enterprise merchants typically pay about 4.6 times a fraudulent chargeback's value once fees, labor, replacement goods, and downstream authorization effects are included. On a $1 million chargeback loss, that multiplier translates into roughly $4.6 million in total economic impact across the business, not just the disputed amount itself.

LexisNexis Risk Solutions' 2025 True Cost of Fraud study, the source behind that 4.61x multiplier, lines up with Cybersource's 2026 Global eCommerce Payments & Fraud Report, which puts merchant-estimated fraud costs at about 3% of annual e-commerce revenue. Internal chargeback handling commonly runs $25 to $75 per case in labor alone, with dispute fees of $15 to $100 layered on top, and merchants report spending $100,000 to $500,000 a year on chargeback-management technology. Cybersource also found that one in 15 authorization declines is actually legitimate, meaning overly cautious fraud rules quietly cost about as much in lost sales as fraud itself costs in losses.

What are the key statistics on agentic payment adoption and fraud exposure?

Merchant adoption of agentic payments is outpacing readiness to secure it. In recent industry surveys, 63% of merchants reported actively exploring or implementing agentic-AI payment capabilities, while only 29% said they felt very prepared to manage the resulting fraud and security risk.

The Merchant Risk Council's 2026 Global eCommerce Payments & Fraud Report, based on 1,278 merchant professionals across 37 countries, found merchants expect agentic commerce to reach somewhere between 6% and 30% of transactions within three years, and Bain separately estimates agents could handle 15% to 25% of e-commerce volume by 2030. A quarter of merchants reported friendly fraud increases of at least 25%, which means the adoption curve and the fraud curve are rising together, not one ahead of the other.

How does the liability shift work for agentic payment fraud?

The liability shift moves responsibility toward whichever party failed to verify or enforce the agent's authority at its control point. An agent platform typically owns authentication of the user's delegation, a token provider owns credential scope and risk signaling, and the merchant stays exposed if it ships against anomalous signals without proof of authorization.

Cybersource reports that e-commerce fraud is generally a merchant liability, while card networks' zero-liability protections exist primarily to protect cardholders, not merchants. That distinction matters more under agentic commerce, where a disputed transaction may involve the consumer, the consumer's agent, an agent provider, a protocol operator, the merchant, an issuer, or a processor all at once. A successful authorization is not evidence the agent had permission for that specific purchase, so the merchant that cannot produce a delegation record is the one left holding the loss.

What operational changes do enterprise merchants need to make for agentic payments?

Enterprise merchants need to treat AI shopping agents as principals with bounded authority rather than anonymous traffic. That means setting spend limits, merchant allowlists, product restrictions, time windows, and step-up approval thresholds before any agent is allowed to complete a transaction.

For a mid-size electronics retailer onboarding third-party shopping agents, that looks like: (1) issuing tokenized credentials scoped to specific SKUs and spend caps, (2) separating bot detection from agent verification, since a legitimate shopping agent may look automated but the real question is whether it is authenticated and authorized, (3) capturing the full decision trail, including delegation records, token metadata, risk scores, step-up events, and fulfillment confirmation, and (4) aligning contracts across the stack so authentication duties, evidence retention, and fraud-loss allocation are explicit rather than assumed. Agxntsix builds this kind of control plane as part of its AI Infrastructure practice, and as a member of the Claude Partner Network, Anthropic's partner program for firms deploying Claude in production, it designs the policy layer that enforces those spend limits and approval thresholds on a reasoning model rather than static rules.

How do tokenization and agent identity controls reduce risk?

Tokenization reduces risk by replacing a raw card number with a scoped credential limited to defined merchants, amounts, and expiration dates. 72% of merchants already use at least one form of payment tokenization, and pairing a token with verified agent identity closes a gap conventional card controls never addressed.

Visa's research on enumeration attacks, where automated scripts guess card numbers and expiration dates, found roughly $1.1 billion in follow-on fraud tied to that technique over a one-year period, a risk that scoped, single-use tokens largely close off because a guessed number carries no usable spend authority. Separate research from Unit 42, Palo Alto Networks' threat intelligence team, has examined how retail fraud actors exploit agentic AI shopping flows, underscoring why identity verification for the agent itself, not just the credential it holds, has to sit alongside tokenization rather than replace it.

How do Visa and Mastercard's new programs affect agentic payment monitoring?

Visa and Mastercard launched agent-ready payment infrastructure in 2025 to standardize agentic transaction monitoring. Visa's Intelligent Commerce and Mastercard's Agent Pay add tokenized credentials and programmable permissions, and Visa's Acquirer Monitoring Program cuts its excessive fraud-and-dispute threshold to 1.5% in North America, Europe, and Asia-Pacific from April 2026.

That threshold was previously set at 2.2%, so merchants with marginal fraud-and-dispute ratios have less room before triggering monitoring or remediation under the Visa Acquirer Monitoring Program, known as VAMP. Because VAMP consolidates fraud and dispute monitoring into a single framework, a merchant's agentic-channel fraud now gets measured in the same combined ratio as its traditional checkout fraud. A spike in agent-initiated disputes can push an otherwise healthy merchant portfolio over the line, which is why separating recommendation from execution on high-value or unusual agent orders matters operationally, not just as a fraud-prevention nicety.

What metrics should merchants use to measure agentic payment success and risk?

Merchants should track fraud exposure and conversion impact side by side, not fraud metrics alone. Core metrics include chargeback rate, fraud dollars, false-decline rate, approval rate, agent-attributed revenue, manual-review volume, and customer-support contacts tied to agent-initiated orders.

Cybersource reports that false-positive rates commonly run 2% to 10% of e-commerce orders, with one in five merchants reporting rates above 10%, which is lost revenue hiding inside a fraud-prevention number that looks fine on its own. Merchants using Cybersource's managed fraud services saw a 1.29% higher acceptance rate on average and 2.3% higher automation, with cited internal data pointing to $132 million in cost savings. Payment professionals reported spending about 34% of their time on payment operations, fraud, and chargebacks, against an estimated 21% target level, a gap that widens further once agentic volume adds new review categories.

Klarna's AI and merchant terms: what the fine print reveals about operational stakes

Klarna's merchant terms show how agentic-era liability gets enforced in contract language rather than theory. Klarna's general terms let it demand repayment for claims it deems fraudulent, disputed, unlawful, or inadequately documented, and allow it to instruct a merchant to halt shipping once suspicious circumstances are flagged after capture.

Klarna operates at meaningful scale for this to matter: roughly 3.4 million transactions a day across 118 million active consumers, according to reporting on Klarna's 2025 payment ecosystem. Klarna's disclosed AI use cases span real-time fraud detection, AML and sanctions screening, personalization, and transaction underwriting, and its terms place marketplace merchants on the hook for sub-merchants' fulfillment obligations too. A merchant selling through a marketplace model inherits that exposure even when the sub-merchant, not the platform, failed to screen the order.

What failure modes should merchants test before deploying agentic payments?

Merchants should test failure modes in a staging environment before any agent touches live payment volume. The highest-value tests cover prompt injection, credential theft, duplicate orders, price manipulation, catalog errors, replay attacks, and vendor outages, each of which can trigger a financial loss that conventional card fraud rules were never built to catch.

A practical rollout sequence: start agentic payments on low-value, repeatable purchase categories, measure loss rate, approval rate, and incident volume against defined thresholds, and expand tier by tier only after those numbers hold. Agxntsix's embedded consulting practice runs this kind of pre-production failure testing alongside contract review, since fraud-loss allocation, evidence retention, and incident-response obligations need to be settled on paper before an agent is allowed to spend a business's money unsupervised.

Sources

• Klarna AI in Payments: Underwriting, Fraud, Agents, Partners
• The True Cost of a Chargeback | Juspay Hyperswitch
• AI and fintech: A perfect match | Robeco Global
• Chargeback Economics 2025: VAMP, ECM & the New Reality for Payment Processors
• Klarna AI Strategy: CEO Statements, AI Products, OpenAI Partnership
• Chargebacks: The Case for Coordination - Mastercard
• AI and fintech: A perfect match | Robeco Africa
• AI and fintech: A perfect match | Robeco Japan