The card, waiting on the assistant.
By Ellis Ward | November 13, 2026
The personal AI assistant on your phone can now buy things without you. It does not need to ask for your credit card number. In several increasingly common configurations, it already has one, or something that works like one. The financial infrastructure built over decades to protect cardholders, the fraud detection systems, the dispute process, the federal liability rules, was not designed with an autonomous software agent in mind.
Payments companies and banks are now scrambling to figure out what to do about that. They are doing it in real time, with real transactions. They are not all reaching the same conclusions.
Personal AI assistants, including Meta's Muse and Instinct, have in recent weeks gained the ability to make purchases on behalf of their users. The underlying idea is straightforward: instead of a person browsing a website, adding items to a cart, and entering payment details, an AI agent does all of it. The cardholder describes what they want, sets some parameters, and the agent handles the rest.
The vision is appealing. The reality is messier.
How Agents Pay for Things
There are roughly three ways an AI agent can complete a purchase on a cardholder's behalf, and not all of them carry equal risk.
The first is using your actual card credentials. The agent gets your card number, expiration date, and CVV, then uses them directly at checkout. Most payment security experts treat this as a bad idea. Handing those details to an agent carries the same fraud risk as handing them to anyone who might store, share, or lose them.
The second approach uses virtual or single-use card numbers. Rather than exposing the real card, the agent generates a temporary number linked to the underlying account. That number completes the transaction and then expires. The real card is never seen by the merchant or the agent itself. Many agents currently operate this way. The main limitation is that a virtual card can still be misused during its active window. Once a purchase goes through, the trail back to the original account still exists.
The third approach uses tokenized credentials, which some in the industry argue is the right long-term solution. Under this model, your real card number is replaced by a substitute credential that is specific to a particular agent and merchant combination. The token can be scoped to a spending limit, a purchase category, or a time window. Neither the agent nor the merchant ever sees your actual card details. If something goes wrong, the token can be revoked without touching the underlying account.
Mastercard has pushed publicly for the tokenized model, calling it preferable to one-time virtual cards. The practical argument: tokens can be managed, audited, and shut off in ways that virtual cards cannot match.
Stripe, the payments infrastructure company used by a large share of online merchants, has moved to embrace agentic commerce directly. It is building payment rails for AI agents using its Link wallet, which counts more than 300 million users. Stripe uses agentic tokens that sit between the agent and the cardholder's account, keeping real card numbers out of the transaction entirely.
A Payments Industry That Cannot Agree
The banks that issue those cards are not aligned on any of this.
Bank of America, Capital One, and Citigroup have each allowed some form of agent-initiated purchases on their accounts. JPMorgan Chase, the largest U.S. card issuer by purchase volume, has not. The bank is actively blocking AI agents from completing purchases through Chase cards.
JPMorgan CEO Jamie Dimon addressed the issue on the bank's October 13, 2026 earnings call. He said the bank would not let external agents into customer accounts. The concern he cited was not a single agent making a bad purchase. It was rogue agents operating at scale: thousands or millions of agents, each making small errors, all running simultaneously. JPMorgan still allows read-only access to account data through Plaid, the financial data aggregator. The line the bank is drawing is at agents that can spend.
The week after Dimon's remarks, the picture shifted more broadly. Between October 13 and October 20, 2026, Charles Schwab, Wells Fargo, and Citigroup each moved to block third-party AI services from logging into customer accounts on their behalf. That is a narrower step than a full ban on agent purchases. It targets the method some agents use to gain account access, not agentic transactions across the board. It reflects the same underlying anxiety: banks are not comfortable with software that logs into customer accounts and spends money without direct human instruction at the moment of purchase.
JPMorgan adds another complication for agents that try to work around its restrictions. The bank classifies virtual cards as commercial cards, which triggers different processing rules. Some purchases attempted through virtual cards are stopped entirely.
Farooq Malik, CEO of Rain, an agentic payments and stablecoin company, described the competitive dynamics plainly. "It's a land grab right now," he said.
Fraud, Returns, and the Reliability Gap
The problems showing up in early agentic transactions fall into three buckets: fraud, returns, and reliability. None of them have clean solutions yet.
On fraud: agents are buying from fake stores. A human shopper who lands on a fraudulent website usually notices something is wrong. A strange URL, bad product photography, a checkout flow that feels off. An agent often cannot make those judgments. It sees a site that accepts a payment and returns a purchase confirmation. It moves on. The cardholder discovers the problem later, when the item never arrives or when they check their statement.
Returns are running higher for agentic purchases than for purchases made directly by consumers. When a person shops, they know what they want and have typically seen the product. When an agent shops on their behalf, it is matching a natural-language description to whatever inventory it can find. The match is often imperfect. Items come back.
The reliability data, such as it is, comes from testing rather than broad commercial deployment. A roundup published by Red Robot examined how AI agents perform when tasked with real purchasing scenarios. According to that account, agents fail 43 percent of test scenarios. The more uncomfortable finding is what happens during those failures: most failing agents still complete a purchase. The agent does not stop when something goes wrong. It finishes the transaction anyway.
That gap, between what the agent was supposed to do and what it actually did, is where the liability questions get genuinely hard. The cardholder's money moved. The cardholder may not have wanted that outcome. The question of who is responsible sits unresolved across several parties.
Who Is Responsible When the Agent Gets It Wrong
Credit card dispute rules were built around a simple assumption: a human decided to make the purchase. If that human says they did not authorize a charge, the bank investigates. If the charge turns out to be fraudulent, the cardholder's liability is typically capped or eliminated under federal consumer protection rules.
Agentic purchases break that assumption at both ends.
The cardholder authorized the agent. The agent then authorized the specific purchase. Whether the cardholder's authorization of the agent covers everything the agent does downstream is not settled law. Neither is what happens when the agent buys from a fraudulent merchant, purchases the wrong product, or completes a transaction the cardholder would have rejected if they had seen it in advance.
If an agent buys something from a fake store, the question of who absorbs the loss runs through several parties. The cardholder gave the agent permission to act. The card issuer processed the transaction. The payments company built the infrastructure the agent ran on. The company that created the agent made the product. Each of those parties has a plausible argument that the responsibility lies elsewhere. None of them has a clear legal obligation under rules written before any of this existed.
The existing consumer protection framework applies to unauthorized transactions. An agentic purchase, in most configurations, is authorized. The cardholder said yes to the agent. That the agent then did something the cardholder did not intend may not trigger the same protections that apply when a fraudster uses a stolen card number. That distinction matters, and it has not been tested in court.
Regulators Are Starting to Ask Questions
The Treasury Department has started asking banks questions about their frameworks for AI and payments. That represents early-stage regulatory attention. No agency has issued guidance specific to agentic transactions. No legislation is pending. The questions are still being framed.
That leaves the industry operating without a rulebook.
Banks that permit agent access set their own terms. Banks that block it are making a business judgment, not responding to a legal requirement. Payments companies building agentic infrastructure operate in a rules vacuum. The cardholder sits at the center of all of this with the least information and the fewest formal protections.
The absence of a regulatory baseline means that the terms under which agents can act, and the limits on what they can do, are being set by the companies with the most financial interest in seeing agentic commerce grow. That arrangement may not last. For now, it is the arrangement in place.
Small Volume, Big Questions
Bot transaction volume is still small. Everyone involved in this space says so. Executives at major financial institutions expect it to grow materially, but none have put specific numbers on the timeline or the scale.
The architecture is already in place. Stripe has built rails. Banks have drawn lines. Some agents are running. Some purchases are completing. Fraud has appeared. Returns are elevated. The Treasury Department is asking questions.
The fundamental issue, what a cardholder's authorization of an agent actually covers, and who is responsible when things go wrong, remains unresolved. The cardholder said yes to the agent. What the agent does with that permission is being worked out in real time, by courts that have not yet heard these cases, by regulators that have not yet written the rules, and by an industry that is building the system while operating it at the same time.
