Could card networks make shopping-bot operators — not merchants — eat the cost when an AI agent's purchase turns out to be fraud?

This explores whether card networks could move fraud and dispute risk from merchants onto the companies that operate AI shopping agents. The corpus doesn't describe a network that has done this yet. It does describe the problem in detail, and it shows what such a shift would need. Today merchants carry the risk. Across every proposed protocol, the merchant stays the Merchant of Record, and agents remove the behavioral signals fraud systems have relied on, like typing rhythm and mouse movement. Merchants end up with more risk and fewer tools to manage it Does agentic commerce shift fraud liability onto merchants?. Federal Reserve Governor Waller names the same three blockers: proving an agent's authority, deciding who pays when something goes wrong, and spotting agent-specific fraud What blocks autonomous agents from handling purchases at scale?.

The main lesson from the corpus is that liability can only move to a party that can be identified and that leaves evidence. Card networks have long put chargeback liability on whichever party can prove what happened, which is why fraud rules shifted when chip cards arrived. Agent commerce is building that kind of proof. Google's AP2 chains signed Intent and Cart Mandates into a tamper-proof record of what the user authorized How can signed mandates prevent payment fraud by agents?. McKinsey proposes signed mandates as the replacement for the human signals that fraud engines used to read Does agent-initiated commerce break existing payment infrastructure?. Once a signed record exists, a network can ask whose signature is on the disputed transaction. If the agent went beyond its mandate, the operator is the natural party to hold responsible.

Identity is the other requirement, and the card networks are already working on it. Boboev places Visa's Trusted Agent Protocol and Mastercard's Web Bot Auth at the identity rung of a protocol 'ladder', below the layers for apps, governance, and product discovery. Each rung absorbs a different level of fraud risk Do agentic commerce protocols compete or complement each other?. Network-run identity rails are the obvious hook for a future liability rule: agents that verify through them could get one risk treatment, and unverified agents another. Allglenn shows why this has to face merchants. A vault that stores the user's card protects the consumer but tells the retailer nothing about who is knocking Can credential vaulting alone solve merchant-facing agent identification?. Without a standard, retailers fall back on blunt terms-of-service blocks, as Amazon did with Meta's Muse What identity standards do shopping agents actually need?.

The IMF's layered model shows where the line could fall. It keeps the agent's probabilistic decision-making separate from deterministic authorization and settlement Should AI agents make payment decisions independently?. Under that model, a bad agent decision is a Layer 1 failure, which belongs to the operator, while settlement keeps the reliability merchants depend on. Taylor's prediction that agents will use virtual cards first matters for the same reason. Virtual cards already carry per-agent spending limits and controls inside the card system, so the network can see where a transaction came from Will agents adopt cards before stablecoins for payments?.

The less obvious point is that liability usually follows whoever wants to own the transaction. Online travel agencies are using AI agents to strengthen their position. They keep Merchant of Record status, and the liability that comes with it, because that is where the economic control sits Are AI agents actually removing online travel agencies from bookings?. Operators funded by merchant referral fees, as Azhar describes for Muse, have mixed loyalties Can an AI agent serve both merchant and user interests fairly?. That makes it unclear whether they would want liability or try hard to avoid it. So a network rule assigning risk to operators would also decide which agent business models can survive.