Who Pays when the Agent Gets it Wrong?

Imagine asking your AI assistant to “replace the kids’ school shoes, size 3, before Monday.”

It finds a great deal, checks out in seconds, and sends you a cheerful confirmation. On Saturday the box arrives: adult size 3, marked final sale. $140, non-returnable.

So who pays?

• The merchant says: you ordered size 3, we shipped size 3.

• Your card issuer says: you gave the agent permission to use your card.

• The agent platform points to its terms of service: you’re responsible for what it buys.

Everyone is technically right, and you’re out $140. Multiply that by millions of agent purchases this holiday season and you have the least glamorous, most important problem in agentic commerce: nobody has clearly agreed who stands behind a purchase that no human actually made.

Five Ways an Agent Purchase goes Wrong

“The agent made a mistake” covers very different failures, and each points to a different party:

1. Misunderstood intent. Wrong size, wrong quantity, wrong date. The instruction was clear enough to a human and ambiguous to a machine.

2. Bad data. The listing said “in stock, ships tomorrow” or got the dimensions wrong. The agent faithfully bought what the merchant describe.

3. Overreach. The agent went beyond its authority: spent more than allowed, added extras, or bought something nobody asked for.

4. Hijacking. Hidden instructions in a web page or product review (prompt injection) steer the agent into a purchase or a data leak.

5. Impostors. A malicious bot pretends to be a legitimate agent, using stolen credentials. These are not the same problems, and they shouldn’t have the same answer. But today, the money doesn’t follow the fault.

Where the Loss Lands Today

Merchants: Holding the bag by default

In most live setups, the merchant remains the merchant of record. OpenAI’s own payment spec for agent checkout says refunds, chargebacks, and compliance stay with the merchant and its payment provider.

Worse, the evidence merchants normally use to fight a dispute (IP address, device fingerprint, browsing path) that either doesn’t exist or points to a cloud server. When a customer says, “I didn’t mean to buy that,” the merchant often has nothing to show what the human actually approved.

Consumers: You agreed to carry the risk

Read the fine print. Meta’s Muse, the fastest-growing shopping agent this fall, has terms of service that reportedly say users who let it handle payments “bear all risk of financial loss” from its actions. Users are responsible for setting their own transaction limits and category restrictions. The terms warn that some transactions “may be irreversible by their nature,” and Meta’s total liability, including for “executing unintended transactions,” is reportedly capped at $250 or what you paid Meta in the past year, whichever is greater.

Muse isn’t unusual here. It’s just the most visible example of a pattern: the agent platform makes the decision and the user signs the risk.

Card dispute rights still exist, but they were written for a world where “authorized” meant you clicked buy. If you gave an agent your card, was every purchase it made “authorized”? In the US, it’s genuinely unsettled whether granting an agent access satisfies the authorization rules behind electronic payment disputes (Regulation E). If it does, many “the agent got it wrong” claims could fail.

Agent Platforms: Making the call, carrying the least risk

That’s the uncomfortable summary. The party that actually makes the decision carries the least financial exposure. The merchant absorbs chargebacks. The consumer absorbs losses their terms assign to them. The platform caps its liability and moves on.

That works while volumes are small. It won’t survive a holiday season at scale.

The Plumbing being Built to Assign Blame

The good news: most of the important work is happening in infrastructure, not courtrooms. And the key ingredient is evidence of intent.

• Signed mandates. Google’s AP2 protocol records cryptographically signed “mandates”: proof of what the user asked for and the exact cart they approved. That turns “the agent said/the customer said” into a verifiable record.

• Scoped payment tokens. OpenAI and Stripe’s ACP issue single-use tokens tied to one merchant, one amount, and one-time window. Muse pays with single-use Stripe Link cards. The blast radius of a mistake shrinks.

• Agent identity. Visa’s Trusted Agent Protocol and Mastercard’s Agent Pay let merchants identify a registered, accountable agent from an anonymous bot. Identity is the first step to responsibility.

• Human approval for irreversible actions. Muse requires a push-notification approval before irreversible steps. That approval is both a safety check and an evidence.

• Someone finally offering to pay. On April 14, 2026, American Express announced Agent Purchase Protection, covering eligible erroneous purchases made by registered agents. It’s the first network to put money behind agent mistakes, and it won’t be the last.

• Industry principles. In September, six banks (including Bank of America, Capital One, ING, and NatWest) published joint Agentic Commerce Principles on transparency, safety, privacy, choice, and interoperability.

Regulators are moving more slowly, but the direction is clear. In March 2026, UK’s Competition and Markets Authority told businesses that consumer law applies the same way whether a customer deals with a human or an AI agent, and that the business stays responsible even when a third party built the agent. In the US, there’s no agent-specific rule yet, and there are growing calls updates.

Meanwhile, platform fights are doing the work that rules haven’t: Amazon’s lawsuit against Perplexity in late 2025 and its block on Muse in September are, underneath the headlines, arguments about who is accountable for an agent acting inside someone else’s store.

Where Liability should Land

Here’s a simple principle I’d argue for: Liability should follow control. Whoever was best placed to prevent the failure should carry it.

• Misunderstood intent → the agent platform, unless the human approved the exact item and price. If you confirmed “adult size 3,” that’s on you. If the agent never showed you, it’s on the agent.

• Bad data → the merchant. If your listing was wrong, the agent buying it doesn’t change who’s at fault.

• Overreach → the agent platform. Acting beyond its mandate is the platform’s failure by definition.

• Hijacking → mostly the agent platform. It controls whether the agent combines untrusted content, sensitive data and the ability to act (Meta’s own “Rule of Two”). Merchants could share some responsibility for policing their own user-generated content.

• Impostors → issuers and networks, as with fraud today, with merchants protected when they verified agent identity.

None of this works without the evidence layer above. Signed intent is what lets you tell these cases apart.

A Playbook for each Side

Merchants

• Log agent identity, mandates, and tokens with every order. That’s your new chargeback evidence.

• Prefer verified agents (Visa TAP, Mastercard Agent Pay, Web Bot Auth) over anonymous ones.

• Make “final sale,” sizing and compatibility machine readable, so agents can’t miss them.

• Send the human a clear confirmation and offer a short cancellation window for agent orders. A $5 cancellation beats a $140 chargeback.

Agent Platforms

• Show the exact cart and price before any irreversible or high-value purchase.

• Ship sensible default spending limits instead of leaving them to users.

• Turn a refund guarantee into a feature. The first major consumer agent that says “if we get it wrong, we’ll make it right” will win a lot of trust.

Consumers

• Set spending limits and category restrictions on day one.

• Use cards with agent purchase protection or single-use virtual cards. Avoid giving agents direct access to your debit account while dispute rules are unclear.

• Read the confirmations. Your approval is evidence, for you or against you.

Banks and Networks

• Create agent-specific dispute reason codes and evidence standards.

• Give cardholders a dashboard of which agents can spend, and how much.

What to Watch Next

• Holiday 2026 dispute data: The first real stress test of agent purchases at scale.

• The first big class action over agent errors. Terms of service that shift all risk to users will be tested.

• Network rule changes: Watch for Visa and Mastercard updating dispute rules for agent transactions, and more issuers matching Amex.

• Regulation E and the CFPB: Whether “authorized” gets redefined for agents.

• Platform terms: Whether Muse and its rivals start competing on protection instead of disclaimers.

The Bottom Line

Trust in commerce has always rested on a simple promise: if something goes wrong, someone will make it right. Card networks built that promise for humans over decades. Agentic commerce has quietly removed the human and kept the old promise without updating who keeps it.

Today, the party making the decision carries the least risk. That’s backwards, and it won’t last. The protocols for proving intent are arriving. The first guarantees are appearing. Regulators are starting to say “same rules apply.”

The agent that wins this market won’t just be the smartest one. It’ll be the one willing to say: if I get it wrong, I’ll pay for it.

This article is general commentary, not legal advice. Sources and further reading: Chargeflow, Justt, Fintech Wrap Up, Moneywise (on Muse’s terms), Fenwick, Center for Data Innovation, UK CMA guidance, American Express, Google AP2 and Visa/Mastercard protocol documentation.

Author: Mohamed Haseel, Chief Architect and Head of Technology Practices

This blog is part 3 of the series on agentic commerce, first published on Medium.com.