Who is liable if an AI agent makes a wrong purchase?
It is not settled. As of late 2026, Visa and Mastercard have no dispute reason code specific to agent purchases, so claims arrive as fraud or as a chargeback. The protocols answer with evidence: an intent mandate, a cart mandate and the agent’s identity. Merchants and platforms that keep them can defend the transaction.
In detail
It is not settled. As of late 2026, Visa and Mastercard have no dispute reason code specific to agent purchases, so claims arrive as fraud or as a chargeback. The protocols answer with evidence: an intent mandate, a cart mandate and the agent’s identity. Merchants and platforms that keep them can defend the transaction.
No settled rule yet
No rule settles this yet. The mandate frameworks are designed to answer the question with evidence: a signed intent proves what the user asked, a cart mandate proves what was shown, the token proves which agent paid. But as of October 2026, Visa and Mastercard publish no dispute reason code specific to agent purchases. A “my agent bought this without my consent” claim will arrive as fraud or as a cardholder dispute, and the merchant will defend it with the mandate, if it kept one.
The evidence that decides
The user gives the agent a task and limits, recorded as a signed intent with price ceiling, timing and merchant scope. With the human present, the user approves the cart, producing a cart mandate; with the human absent, the pre-signed intent authorizes the cart if it meets the conditions. The mandate, the token and the authorization should be stored together for the dispute that may come, and dispute teams need the mandate and the agent identity on the transaction record.
More detail in our #PayDecoding episode on Agentic commerce.