A banker's guide to agents holding payment credentials
Card networks spent forty years building rules around a reasonably stable fact: a person initiates a transaction. Agentic commerce changes the initiator without changing the rulebook underneath it, and the gap is where the disputes will land.
Who bears the loss when an AI agent's card transaction is disputed?
Nobody knows yet, and the rules are being written faster than the evidence. Dispute frameworks classify transactions by how they were initiated, and agent initiation maps onto none of the existing categories. The scope the cardholder actually granted is recorded by nobody.
- Existing dispute rules classify transactions by how they were initiated. Agent-initiated transactions do not map cleanly onto those categories.
- Authentication frameworks were designed around a cardholder present at a device. An agent transacting on the cardholder's behalf satisfies the mechanism without the assurance.
- The evidence that resolves an agent dispute — what the human authorised, in what scope — is not currently captured by anyone in the chain.
Part of Agent tool-call gating
The three reopened questions
| Question | Settled answer for human transactions | Status for agent transactions |
|---|---|---|
| Who authorised it? | The cardholder, present or on file | The cardholder authorised the agent, at some earlier time, in some scope |
| Who bears an unauthorised loss? | Allocated by initiation type and authentication status | Unclear — depends on whether agent action counts as cardholder action |
| What evidence resolves it? | Authentication data, device signals, transaction history | No standard artefact exists |
The third row is the practical problem. Liability allocation rules can be written; they are being written. They will allocate loss based on evidence that nobody is currently generating.
Why strong authentication does not settle it
Authentication frameworks confirm that the cardholder authenticated. In an agent flow the cardholder did authenticate — when they set the agent up, days or weeks earlier.
So the check passes and tells you nothing about this transaction. The mechanism is intact; the assurance it was meant to carry has been separated from the moment it mattered.
This is the same scope-versus-instance problem that appears everywhere in agent authorisation, arriving in a payments vocabulary.
The dispute that has no good resolution
A cardholder contests a transaction their agent initiated. Three positions are available and none of them is satisfying.
- The cardholder authorised it — by deploying the agent. This makes every agent transaction final regardless of whether the cardholder would have wanted it, and destroys consumer confidence in the channel.
- The cardholder did not authorise it — the agent did. This makes agent transactions uniformly disputable, which merchants will respond to by declining them.
- It depends on scope — the cardholder authorised transactions of this kind within these bounds. This is correct and requires a record of the scope, which does not exist.
Position three is where the industry will end up. The question is how many years of positions one and two happen first.
What a scope record has to contain
delegation {
principal: cardholder, authenticated with user verification
agent: [agent identity]
scope: card_purchase
merchants: [category or explicit list]
per_txn_max: 250.00 USD
aggregate_max: 2000.00 USD / calendar month
not_after: 2026-03-31
revocable: yes, effective immediately
}
signed by the cardholder's authenticator
→ each agent transaction references this delegation
→ issuer or merchant can verify the transaction falls inside itGiven that, the dispute becomes arithmetic. Inside the scope: authorised, and the cardholder's recourse is against the agent provider rather than the merchant. Outside it: unauthorised, and the loss sits with whoever accepted a transaction that did not verify.
What each party should be doing now
| Party | Action |
|---|---|
| Issuers | Decide how agent-initiated transactions are flagged and what evidence you will require in a dispute — before the volume arrives |
| Acquirers and merchants | Establish whether you can distinguish agent-initiated transactions at all; most currently cannot |
| Agent providers | Capture and retain the cardholder's scope grant in a form a third party can verify without calling you |
| Corporates deploying agents | Bound spend at the credential, not in the agent's instructions, and keep the grant |
The commercial argument for doing it early
Not compliance. Acceptance.
A merchant facing a transaction class with elevated dispute risk and no evidentiary defence will decline it or price it punitively. An agent channel that arrives with a verifiable scope record attached gets accepted; one that arrives as an unidentifiable card-not-present transaction gets treated as fraud risk.
The party that solves evidence first makes their agent channel the one merchants accept. That is worth more than avoiding a chargeback.
A caution on numbers
Projections of agentic commerce volume vary by an order of magnitude depending on what counts as an agent transaction — whether a saved-card recurring charge or a shopping assistant's recommendation is included. Treat any single figure with suspicion. The structural argument does not depend on the volume being large, only on the disputes being unresolvable.
What each party should do now
| Party | Action |
|---|---|
| Issuers | Decide how agent-initiated transactions are flagged and what evidence a dispute requires |
| Acquirers and merchants | Establish whether you can distinguish agent-initiated transactions — most cannot |
| Agent providers | Capture the cardholder's scope grant so a third party can verify it without calling you |
| Corporates | Bound spend at the credential rather than in the agent's instructions |
Objections and honest limits
“Strong customer authentication covers it.” It confirms the cardholder authenticated at setup, weeks before the purchase. The mechanism passes and carries no assurance about this transaction.
“The market is too small to matter yet.” Estimates vary by an order of magnitude depending on what counts as an agent transaction. The dispute problem exists at any volume, and the infrastructure decisions are being made now.
Preparing for agent disputes
- Flag agent-initiated transactions. Most acquirers cannot distinguish them today.
- Require a verifiable scope grant. Signed by the cardholder, checkable by issuer and merchant.
- Define what evidence resolves a dispute. Before the volume arrives.
- Treat acceptance as the goal. Evidence is what makes merchants take the channel.
Terms used here
- Initiation type
- How a transaction was started, which is how dispute rules classify and allocate loss.
- Scope grant
- A signed delegation stating what an agent may spend, where, and until when.
- Acceptance
- Whether merchants will take the transaction — the real constraint, and it follows evidence.
Frequently asked questions
Do existing card rules cover agent transactions? They classify transactions by initiation type, and agent initiation does not map cleanly onto the existing categories. Network rules are being updated; the evidence needed to apply them is not being generated.
Does strong customer authentication help? It confirms the cardholder authenticated at setup, which is weeks before the transaction. The mechanism passes and carries no assurance about the specific purchase.
Who should hold the scope record? It should be verifiable by any party in the chain without calling the agent provider. A signed delegation the cardholder can revoke and the issuer can check is the shape that works.
How large is this market? Estimates vary by an order of magnitude depending on what counts as an agent transaction. The dispute problem exists at any volume.
Why does solving evidence first matter commercially? Merchants will accept an agent channel carrying verifiable delegation and price an unattributable one as fraud risk.
Where this fits in Manav
Manav issues the cardholder's scope grant as a signed, revocable delegation with ceilings and expiry, verifiable offline by the issuer, the merchant or a court.
Sources and further reading
- Visa — security and trust perspectives on agentic commerce
- Regulatory technical standards on strong customer authentication and exemptions.
- CISA — known exploited vulnerabilities and incident reporting
- Industry commentary on agent-initiated payment liability.