Your next online purchase might not be made by you. It might be made by an AI assistant you told to "reorder the dog food" or "book the cheapest flight to Denver."

That shift, which the payments industry calls agentic commerce, runs into a basic problem: card payments were built on the assumption that a human is pressing the buy button. In September, the two biggest card networks moved to fix that.

What happened

On September 30, Mastercard announced new "trust and intelligence" services for its Agent Pay program. The main feature is a probability score that estimates whether a transaction was started by an AI agent rather than a person, plus signals on whether the activity matches expected behavior or needs a closer look. Capital One is collaborating, with Cloudflare and identity firm Skyfire supplying parts of the plumbing.

The score is rolling out for testing in the U.S. first, so this is not something most cardholders will notice yet. Mastercard says it plans to add more inputs over time, including merchant risk, transaction patterns and the risk attached to the card credential itself.

The company's own example shows why this matters. Ask an AI assistant to plan a trip, and it might book a flight, a hotel and a rental car from three different merchants within a few minutes, all on one approval. To a traditional fraud system, that burst of spending looks a lot like a stolen card being tested. The new signals are meant to tell the bank "this is an agent doing what its owner asked," so legitimate purchases go through and suspicious ones get flagged before they clear.

Two weeks earlier, American Banker reported that Mastercard and Visa had each rolled out agent risk tools. Mastercard's Agent Pay uses "Verifiable Intent," developed with Google, to tie an agent's actions to what the customer actually asked for. Visa is pushing a Trusted Agent Protocol through its Intelligent Commerce platform.

Visa, Mastercard and Ant International are also working on a shared "know-your-agent" framework, so an AI agent verified on one network can be recognized on another.

Know your agent, not just your customer

Banks already run "know your customer" (KYC) checks to confirm who is opening an account. Know-your-agent applies the same idea to software: Which agent is this? Who authorized it? What is it allowed to buy, and how much can it spend?

Without those answers, a fraud team can't tell a legitimate assistant buying groceries from a bot draining a stolen card. Disputes get messy, too. If an agent buys the wrong thing, was that fraud, a misunderstanding, or exactly what you told it to do?

Skyfire, which sells know-your-agent technology, frames the goal simply: every agent that pays on someone's behalf should be identifiable, accountable and auditable, its CEO Amir Sarhangi said in Mastercard's announcement. Javelin Strategy & Research fraud analyst Suzanne Sando added that fraud systems will need to confirm not just who is paying, but whether the agent is trusted, properly authorized and staying within what the consumer intended.

Consumers aren't sold yet

Visa research cited by American Banker found that only 23% of U.S. consumers trust generative AI to handle payments for them. Mastercard's own projection is modest: about 1 in 10 consumers routinely using AI agents for shopping and payments by 2030.

"Agentic commerce will only scale at the speed of trust," Mastercard executive Sherri Haymond told the publication.

Why it matters

For banks and card networks, this is partly defensive. If AI assistants become the new storefront, the networks want to stay the trusted layer underneath, earning their keep on fraud screening and identity checks instead of being bypassed.

For everyone else, the stakes are practical. Before you let any AI tool spend on your behalf, check three things: whether it lets you set hard spending limits, whether it asks you to confirm before it buys, and how your card issuer handles disputes over purchases an agent made. Payment experts quoted by American Banker pointed to clear records of what the customer intended, plus spending limits, as the key safeguards.

What to watch

Two things: whether the know-your-agent framework becomes a real shared standard across networks, and whether regulators weigh in on who is liable when an agent gets it wrong.

Sources: Mastercard announcement (Sept. 30) · American Banker (Sept. 17)

Beyond the Bank is for informational purposes only and is not financial, legal, or investment advice.

Get Beyond the Bank in your inbox every Monday. A free, plain-English briefing on AI, banking alternatives and the new rails under your money. Read the latest issue or subscribe free.