Deep Dive: The hidden liability of agentic commerce

Source: Sam Boboev; Fintech Wrap Up (Medium) · 2026-03-29

For the fintech founders, CEOs, and payments strategists reading this, the promise of a frictionless $1 trillion market is enticing. But I am here to tell you that the current payment infrastructure is fundamentally broken for this new reality. The industry is currently ignoring a massive hidden liability. When an AI agent buys the wrong product or acts without explicit consent, the merchant is the one left holding the bill. Traditional fraud detection is dead in this environment. If your risk model still relies on monitoring typing cadence or mouse movements, you are already obsolete. We are moving into a “fifth participant” model where the AI agent acts as a new layer of intermediation between the cardholder and the merchant. This fifth actor breaks the historical four-party model of liability and pushes risk downstream to you.

The existing payment architectures are built on the assumption of human presence. This is a foundational flaw in the age of automation. Traditional systems rely on behavioral biometrics and device fingerprinting to establish trust. In an agentic world, these signals disappear entirely. There is no typing cadence to measure when a script is making the call. There is no mouse movement when a server-side agent is interacting with an API. This creates a total loss of the traditional fraud signal.

I see this as a “shifting trust perimeter.” Payments no longer originate on your storefront, where you control the environment. They originate in external LLMs, personal assistants, and procurement bots. This decentralization of the checkout experience means you can no longer rely on your own telemetry to verify the buyer. You are now forced to trust a software agent you did not build and cannot inspect. This creates several structural failures that I will break down in this report.

The disappearance of these signals will lead to a spike in “friendly fraud” and “hallucination disputes.” If an agent orders the wrong item because of a misinterpretation of user intent, the merchant is likely to be held liable for the return and the chargeback. Liability follows the Merchant of Record. In every protocol currently being proposed, from OpenAI to Google, the merchant remains the MoR. You are taking on all the risk of autonomous execution with none of the historical protections.

The industry is currently in a “protocol war” to define how agents and merchants communicate. I have analyzed the major standards emerging in 2025 and 2026. Each protocol addresses a different layer of the stack, from the application layer to the settlement layer. I think it is a mistake to view these as competing products. They are building a “capability ladder” that determines how much risk a merchant is prepared to absorb.

OpenAI and Stripe co-developed ACP as an open standard (Apache 2.0) to make checkouts “agent-ready”. ACP is the application layer for conversational commerce. It is optimized for speed and convenience within chat interfaces like ChatGPT.

The core technical primitive of ACP is the Shared Payment Token (SPT). Instead of exposing raw card data to the agent, the system generates a scoped, ephemeral token bound to a specific merchant and a specific amount. This protects the consumer’s credentials but does little to protect the merchant from intent disputes. In a typical ACP flow, the agent manages the checkout interface, while the merchant manages the data model and fulfillment.

ACP is ideal for high-intent, human-in-the-loop purchases where a user is actively chatting with an assistant. However, it lacks the robust governance needed for fully autonomous, background purchases. This is where Google’s AP2 comes in.

Google led a coalition of 60 partners to build AP2, focusing on the authorization and traceability layer. I consider AP2 to be the governance layer for agentic commerce. It introduces “mandates,” which are cryptographically signed digital contracts that define the agent’s boundaries.

These mandates serve as verifiable proof of user instructions. If an agent tries to spend $500 when the user only authorized $300, the AP2 layer rejects the transaction before it ever reaches the processor. This provides the audit trail merchants need to defend against chargebacks.

AP2 is rail-agnostic. It can carry instructions for cards, bank transfers, or crypto assets through its x402 extension. For the institutional reader, AP2 represents the most serious attempt to create a standard for compliance and multi-party governance in autonomous commerce.

I think UCP’s most significant contribution is the standardization of discovery and post-purchase flows. It defines JSON-RPC 2.0 schemas for adding items to carts, calculating logistics, and managing returns. This allows a merchant to “build once” and distribute their catalog to any UCP-compatible agent.

The biggest operational challenge for merchants is the “identity gap.” If you cannot differentiate between a legitimate AI agent and a malicious scraper, you have to block all automated traffic to protect your infrastructure. This is a revenue killer in an agentic world. We are seeing two distinct approaches to solving this through the major card networks.

Visa’s TAP provides a cryptographic standard for agents to prove their identity and authorization directly to the merchant. The trust model here is robust because it is built on three distinct signatures:

TAP allows agents to pass “context” without requiring a full login. This is the solution to the “cold start” problem in e-commerce. An agent can prove it is acting for a known user and provide their shipping preferences and loyalty ID, allowing for a personalized guest checkout.

Mastercard’s framework is designed for mass-market scalability. It leverages the “Web Bot Auth” standard (IETF RFC 9421) at the CDN layer. This is a “no-code” approach for merchants.