Agentic Commerce Risks and Readiness

The real risks of agentic commerce fall into a handful of categories: confirming that an agent is genuinely authorized to act for a customer, fraud and unauthorized purchases, the still-unsettled question of liability when an agent-made purchase goes wrong, privacy and data, and the strategic risk of being disintermediated from your own customer. None of these is a reason to stay out. Each is a reason to enter deliberately, with the right safeguards and a clear view of who carries the risk. This guide maps the risks, shows how the emerging standards address each, and ends with a readiness checklist. It is the companion to what agentic commerce means for your business, which covers the strategic decision; this page covers what to watch out for.

The risk landscape in one paragraph

When the buyer is software, two things change. The trust that a payment system normally places in a present, authenticating human has to be reconstructed for an agent, and the accountability that normally has a clear owner becomes contested. Most of the technical work in agentic commerce is really about rebuilding that trust, and most of the open questions are really about who is accountable when something fails. Hold those two themes in mind and the specific risks below are easier to reason about.

Agent authenticity and impersonation

The first question a merchant faces is whether the agent at the door is a legitimate agent acting for a real customer, or a bot pretending to be one. This is the agent-authenticity problem, and several efforts target it directly. Visa’s Trusted Agent Protocol is an open framework introduced to help merchants distinguish legitimate AI agents from malicious bots. The card networks’ programs, Visa Intelligent Commerce and Mastercard Agent Pay, require agents to be registered and verified before they can transact, rather than letting any piece of software present a card. The risk to manage is treating an unverified agent as trusted; the mitigation is to rely on these verification layers rather than rolling your own.

Authorization and unauthorized purchases

Even a legitimate agent raises a harder question: did the user approve this specific purchase, or just delegate a general goal? This is what AP2 exists to answer. It uses cryptographically signed mandates, expressed as verifiable credentials, that record what the user authorized and can be presented as proof of consent, with a distinction between a purchase a human is actively approving and one an agent completes later within pre-set limits. On the payment side, the Shared Payment Token design limits the blast radius of any single authorization: a token is scoped to one merchant and one cart total and cannot be reused for a different amount or seller. The risk is an agent spending beyond what the user actually intended; the mitigations are scoped mandates, scoped tokens, and clear spending limits set at the point of delegation.

Liability, chargebacks, and disputes

This is the least settled part of agentic commerce, and the one a leader should watch most closely. There is not yet a finalized, cross-network rulebook for how disputes on agent-initiated transactions are handled, which means the answer to “who pays when it goes wrong” is still being worked out. Trade and legal commentary widely expects much of the risk to land on merchants, on the logic that the card networks, issuers, and AI providers are each positioned to avoid absorbing it. The composition of disputes is also expected to shift, with fewer classic fraud claims and more “I did not authorize that” and “not as described” claims, for example when an agent misreads a user’s intent and buys the wrong item.

Two things are concrete. American Express has made the most explicit consumer-protection commitment so far, an Agent Purchase Protection pledge tied to purchases made by registered agents, which stands out precisely because a settled industry-wide standard does not exist. And regulators have begun to take an interest in how existing dispute and chargeback regimes apply to agent-initiated purchases, though the detailed rules are still forming and should be tracked rather than assumed. The practical defense, regardless of how the rules settle, is evidence: capture the user’s authorization and a clear audit trail at the moment of delegation, continuously, rather than trying to reconstruct consent after a dispute. AP2’s design explicitly aims at a non-repudiable audit trail for this reason.

Privacy and data

Agent transactions create new data flows. An agent may share a user’s intent, constraints, and context with merchants and networks, and the question of what is shared, with whose consent, and who retains it is unsettled. For a business, this is both a compliance obligation and a strategic asset: the customer data and consent you hold, and handle responsibly, is part of what keeps the relationship yours rather than the agent platform’s. Treat agent-channel data with the same care as any other customer data, and be deliberate about what you expose to an agent surface.

Channel disintermediation

The largest strategic risk is not fraud but position. If an agent surface becomes the place customers shop, it can sit between you and the buyer, own the discovery moment, and commoditize your catalog against competitors who are one comparison away. This is not a reason to be absent, being absent only means being represented badly or not at all, but it is a reason to compete on the things an agent cannot strip away: owning your first-party relationships and data, and keeping your product information richer and more accurate than rivals so that when an agent compares options, you are surfaced and described well.

Operational and accuracy risks

A quieter risk is simply being wrong in a way agents cannot tolerate. Agents read machine-readable data and transact against it programmatically. If the price or availability an agent reads does not match your live store, an agent-initiated checkout can fail outright, or complete at terms you did not intend. And if an agent misinterprets a user’s request and orders the wrong item, the merchant is often the one left with the return and the dispute. The mitigation is unglamorous and high-value: keep your product data complete, structured, and accurate to the cent against what is live, and make your checkout API-driven so agents see real, current terms.

A readiness checklist

Use this as a starting point, not a finish line. A printable, downloadable version is on the resources page.

Governance: assign a clear owner for agentic commerce, and brief leadership on the two contested points, the unsettled liability picture and which checkout standard you will support. Data: audit your product feed for completeness, structure, and exact agreement with your live site, and fix mismatches. Payments and verification: rely on the networks’ agent-verification and scoped-token mechanisms rather than building your own trust layer, and read the terms of any program you join, including its consumer-protection and liability provisions. Evidence and monitoring: log agent authorization and behavior continuously across the transaction so you can defend a dispute with a record, not a reconstruction. Privacy: handle agent-channel data to the same standard as the rest of your customer data, and decide deliberately what you expose. Strategy: protect your first-party relationships and keep your product information better than competitors’, so an agent surface complements your channel rather than replacing it.

The bottom line

Agentic commerce is safe to enter, but not safe to enter carelessly. The authenticity and authorization problems are being solved by the standards, and you can lean on them. The liability picture is genuinely unsettled, so read the terms and keep your evidence. And the strategic risk, losing the customer relationship, is the one most within your own control. For the decision of whether and how to act, see what agentic commerce means for your business; for how the money and trust mechanics work, see how AI agents pay.

FAQ

Who is liable when an AI agent makes a purchase that goes wrong? There is not yet a finalized, cross-network rulebook for agent-initiated disputes, so this is the least settled part of agentic commerce. Much of the risk is widely expected to fall on merchants, since the networks, issuers, and AI providers are not volunteering to absorb it. American Express has made the most concrete consumer-protection pledge so far. The practical defense is to capture authorization and an audit trail at the point of delegation, not after a dispute.

How do I know an agent is genuinely authorized? AP2 uses signed mandates, expressed as verifiable credentials, to prove a specific user approved a specific purchase. Visa’s Trusted Agent Protocol helps merchants tell legitimate agents from bots, and the networks’ programs require agents to be registered and verified before they can transact.

What is the biggest strategic risk? Channel disintermediation: an agent surface owning the customer and the discovery moment. The defenses are owning your first-party data and relationships and keeping your product information richer and more accurate than competitors’.

What is the single most useful thing to do now? Build an evidence and audit trail for agent transactions, and keep your product data accurate against your live site. Continuous logging is your strongest position in a dispute, and accurate data prevents the mismatches that can break an agent checkout.