Who pays when an AI agent disobeys? We do, apparently

In February 2025, Geoffrey Fowler, the technology columnist at The Washington Post, asked OpenAI’s Operator agent to find the cheapest dozen eggs he could have delivered. He gave it his address and wandered off. A few minutes later, his credit card app told him he had just bought something on Instacart. The agent had passed over $5.99 eggs on another site and settled on a dozen at $13.19, plus a tip, a priority fee, a delivery charge, service fees and a 25 cent bag fee, for a total of $31.43. OpenAI told Fowler that Operator had made a mistake and fallen short of its safeguards, which are supposed to require a confirmation before any purchase.

The story is funny, I suppose, because the stakes are so small. But it holds, in miniature, a question of accountability. Not over credits or tokens, but real money. When software spends your money in a way you never intended, who is liable? Fowler gave the agent his card and address, but no explicit permission to make a purchase. And I am not sure any bank, card network or regulator in Europe could answer that question with conviction.

It would be easy to dismiss this as a glitch. But in 2026, agentic payments moved beyond demos. In March, Santander and Mastercard announced a live AI-agent payment within a regulated European banking framework.

Mastercard later said all European issuers were enabled for Agent Pay at network level, while Visa reported agents buying from merchants such as lastminute.com and Frasers, using cards from more than thirty European banks, including Barclays, HSBC UK, Revolut and Klarna. American Express introduced a developer kit and purchase protections for cardholders using registered agents.

And in China, Alipay said its AI Pay product had passed a hundred million users and processed 120 million transactions in a single week in February.

Meet the people who mop up

Fortunately for us, the people cleaning up after agents have already been doing so for human shoppers. One of them is Monica Eaton, who founded Chargebacks911 in 2011 and runs it as chief executive. Based in Clearwater, Florida, with offices in Europe and Asia, the company describes itself as Europe’s first chargeback remediation specialist. It works the unglamorous back end of card payments. When a customer asks a bank to reverse a charge, Chargebacks911 investigates the dispute and challenges those it considers invalid on the merchant’s behalf. The company says its platform supports more than two million merchants and has recovered more than $1bn for clients. Its sister brand, Fi911, sells dispute software to banks. Industry Contents did not independently verify these figures.

In a 2018 announcement, Chargebacks911 said it helped an unnamed major online retailer raise its chargeback win rate to 72% within 60 days and recover about $400,000. More recently, its 2026 field report, based on a survey of more than 250 merchants, mostly in North America, found that respondents recovered money in only about 10.7% of disputed cases after second rounds were counted. Merchants estimated that friendly fraud accounted for 43.8% of their chargeback losses; among enterprise respondents, 83.4% said it was rising.

Eaton has warned since February about customers disputing purchases made by AI agents. At the end of October, Chargebacks911 launched purchase indemnification for qualifying agent-related chargebacks, designed to work alongside merchants’ existing fraud systems and checkouts.

The evidence may be where these disputes are won or lost. The agent provider may hold the execution logs needed to connect a customer’s instructions to a purchase. Asked what would independently establish that an agent had exceeded those instructions, Eaton told Industry Contents: “The starting point is what the customer actually authorized. If someone tells an AI agent to spend no more than $100 and it spends $150, you need a reliable record of both the instruction and the purchase. The merchant’s checkout record and the bank’s authorization record can confirm transaction details, but they won’t necessarily show what the customer told the agent to do. That’s why the agent’s instructions must be independently verifiable, rather than relying solely on the provider’s account.”

On whether merchants and banks should trust logs controlled by the AI provider itself, Eaton was sceptical. “They shouldn’t have to trust those logs blindly. If the company whose technology is being questioned also controls the only evidence, that’s an obvious conflict of interest. AI providers should keep records that can be independently verified and the industry needs consistent standards for what evidence is retained and shared in a dispute. Consumers deserve a fair resolution and merchants deserve a fair chance to challenge a claim. Neither should depend on the provider grading its own homework.”

“AI agents are already being used across various platforms, including voice assistants like Amazon’s Alexa, which surprises a lot of people. Identifying and resolving disputes involving these technologies can be complicated because they often require a much broader set of evidence than a typical payment dispute,” Eaton said. On the evidence used to assess those disputes, she added, “[W]e combine our benchmark analytics with additional transaction data and, where available, cardholder feedback obtained through deeper integrations with financial institutions. This helps us assess what the customer authorized, what actually happened and whether the transaction matched their instructions.”

In fact, Citi has made a similar argument. This week, at the Skift Commerce Summit in New York, Abhinav Anand, who runs a consumer cards business at Citi, said liability for agent errors should fall on the company that builds the agent, not on hotels, airlines or card issuers. Citi is also restricting outside agents. According to Skift, he also cited a Visa study of more than 75 agents in which 43% made mistakes, and about half of those went ahead and completed the purchase.

Four ways an agent purchase can go wrong

The agent followed the customer’s instructions, but the customer dislikes the purchase	Whether the merchant’s ordinary returns policy applies
The agent exceeded a spending limit	Whether it exceeded the authority the customer gave it
The agent paid without a required confirmation	Whether the payment was authorised
The customer disputes a purchase the agent made correctly	Whether the claim is valid or a case of friendly fraud

Europe has enough payment disputes already

In Europe, the dispute system that would have to absorb these mistakes is already strained. Payment fraud across the European Economic Area reached €4.2bn in 2024, up from €3.5bn a year earlier, according to the EBA and ECB. In the UK, criminals took £1.28bn in 2025 across a record 4.06 million cases, according to UK Finance.

Chargebacks are harder to count: no European regulator publishes a comprehensive figure, so estimates come from the card networks. Mastercard, working with Datos Insights, expects 29.2 million chargebacks in Europe a year by 2029, 22% more than in 2026, and estimates that roughly 45% of chargebacks worldwide involve fraud in some form.

Visa’s merchant-monitoring threshold fell to a combined fraud-and-dispute ratio of 1.5% in April, for merchants with at least 1,500 cases in a month. For merchants, fraud, buyer’s remorse and agent errors can all count against them.

The question that needs answering is whether permission to shop extends to a particular payment. An agent that exceeds its instructions fits awkwardly into existing dispute categories. As far as I can tell, neither Visa nor Mastercard publishes a dispute reason code designed for this situation. For purchases through its registered agentic payment providers, Visa’s rules say the cardholder is responsible as though they initiated the transaction. Whether that settles a dispute over instructions the agent exceeded is another question.

Target’s terms for its shopping agent take a similar position. Revolut’s published dispute process makes the evidence problem more concrete: the bank assesses whether there is enough evidence to pursue a chargeback; a declined dispute, or sufficient evidence from the merchant, means no refund through that process. These are general chargeback rules, not a specific policy on AI-agent mistakes. Amex protects cardholders against certain agent mistakes, but not the merchants who sold the goods.

And in October, several large American banks, including JPMorgan, Bank of America and Citi, restricted outside agents from accessing customer accounts, which is another answer, I suppose. Eaton thinks the banks have the right worry and the wrong fix. “Banks are right to ask what happens when an AI shopping tool makes a purchase that goes wrong, but blocking these tools isn’t the answer. Before AI shopping becomes routine, people need to know who’s responsible and where to turn when something goes wrong,” she said.

For Eaton, a purchase made within the customer’s instructions remains the customer’s responsibility. “If you give an AI tool permission to shop for you and it follows your instructions, that’s a purchase you authorized. Say you ask it to buy running shoes for under $100 and it does exactly that. You might decide you prefer a different pair, but you should still be able to use the store’s usual return process,” she said. Outside those instructions, the burden shifts. “When an AI tool exceeds the instructions it was given, the company behind it should take responsibility for its mistake. Consumers shouldn’t be left chasing answers and merchants shouldn’t automatically cover the cost of technology they don’t control.”

Regulators are not looking the other way. In April, the International Monetary Fund published a note separating payment intent, authorisation and settlement, while acknowledging that an agent’s legal status and liability remain unresolved.

HM Treasury opened a consultation in July on whether existing rules for consent, authentication and unauthorised transactions still fit. Bank of England deputy governor Sarah Breeden said in June that its frameworks were not designed for autonomous agents, while the ECB has invited private firms to explore agent payments as part of its digital euro work. Singapore and Hong Kong are also developing safeguards for agentic finance, while India’s payments operator is reportedly exploring small AI-initiated UPI payments.

The risk has a price tag

Chargebacks911 is not alone. Riskified and Signifyd, which already guarantee merchants against fraud chargebacks on approved orders, have added tools to identify agent-placed purchases. Riskified warned investors that shifting liability could also reduce demand for its guarantees. Identity company Socure has introduced a product linking agents to verified users. Mastercard and Google have developed Verifiable Intent, a cryptographic record of what a customer approved. Amex protects the cardholder; Chargebacks911 is selling protection to the merchant.

For European businesses, the timing is awkward. The EU’s proposed Payment Services Regulation, provisionally agreed in November 2025 but not yet in force, would preserve the principle that a customer’s bank generally bears losses from unauthorised payments unless the customer acted fraudulently or with gross negligence. It would also introduce rules on impersonation fraud and online platforms, without specifically resolving AI-agent liability.

The UK’s Competition and Markets Authority said in March that businesses remain responsible for agents they deploy, even when someone else built them. And because Europe requires strong customer authentication, Visa’s live agent transactions here were approved using passkeys, which establish who authorised access but not necessarily what the agent was told to buy. European merchants may be among the first to discover how these disputes are decided, and pay for the lesson.

Eaton argues that fraud protections should stay in place either way. “Consumers must also remain protected against fraud and unauthorized purchases. Clear records of what someone approved and what the AI tool actually bought can help establish what happened and who should put it right.” In summary, Eaton argued, “Companies building tools that spend consumers’ money must stand behind them when they get it wrong.”

I don’t think the answer is to keep agents away from our money. The banks trying that will, I suspect, relent the moment their customers start drifting to competitors who let the agents in. Nor do I expect the card networks to publish a neat rule any time soon. What seems more likely is a slow, unglamorous fight over records, over who keeps the log of what a customer asked for, who can read it and whether anyone outside the AI company can check it.

Eaton’s view about the provider grading its own homework seems to me the right way to frame it. The problem is not simply that agents will make mistakes, but that the evidence needed to prove those mistakes may sit with the same companies responsible for them. That is the gap. Even with protections for unauthorised payments, it remains unclear how a dispute will be settled when an agent had permission to shop but exceeded its instructions.

If the payment is ultimately treated as authorised, a chargeback is denied and no other remedy is available, the customer could be left paying for something they never intended to buy. That is not a settled rule of liability. It is the practical risk while the industry decides who must keep the evidence and who must stand behind an agent’s mistakes.

Fowler’s eggs cost $31.43. The next mistake may be considerably more expensive. Until the banks, card networks and AI providers can establish what an agent was actually authorised to do, we are back where we started. Who pays when an AI agent disobeys? We do, apparently.

For businesses giving agents purchasing authority, the practical starting point is to define spending limits, required approvals and what happens after an error. Industry Contents has a privacy and approval checklist covering audit records and transaction controls, alongside an agent permissions and safety guide for setting boundaries before deployment.

Questions about AI agent payments

Who pays if an AI agent exceeds a spending limit?

There is no single answer for every payment. The consumer’s rights, the merchant’s obligations, the card network’s dispute rules and any agreement with the agent provider may point to different parties. Eaton argues that the company behind the agent should take responsibility when it exceeds instructions.

Is an AI agent’s mistaken purchase an unauthorised transaction?

Not automatically. An agent may have permission to shop but exceed a particular limit or skip a required confirmation. Whether the resulting payment counts as unauthorised depends on the facts and the applicable payment rules.

What evidence could show an agent exceeded its instructions?

The customer’s chat history may show the instructions. Merchant checkout records and bank authorisation records can show what was bought and paid. Agent execution logs may help connect them. A dispute may turn on whether those records are complete, authentic and independently verifiable.

What does Chargebacks911’s agent purchase indemnification do?

The company says its service identifies purchases involving AI agents and protects merchants against qualifying chargebacks, alongside their existing checkout and fraud systems. That protection does not, by itself, settle which party was legally responsible for an agent’s mistake.

Spotted an error? Email editorial@industrycontents.com.