Who Pays When the Agent Gets It Wrong? Inside the Agentic Chargeback Gap Nobody Has Priced
Agentic payments are in production. The liability model is still a work in progress.
In Europe, Worldline and ING completed a live end-to-end agentic payment on Mastercard rails in June. On 2 July, Visa announced live agentic-commerce transactions in Europe, including a transaction in Germany that used Strong Customer Authentication (SCA).
Those milestones show that an AI agent can participate in a payment journey with authentication and controls. They do not settle a harder question: who bears the loss when the payment is valid, but the agent’s purchase falls outside the consumer’s mandate?
That is the agentic chargeback gap. Today, merchants may face the immediate cost of a dispute, while issuers, acquirers, payment facilitators and AI providers lack a consistent rule for deciding who ultimately pays.
What the RBA heard about agentic payment disputes
The Reserve Bank of Australia’s summary of submissions, published on 6 October 2026, draws on written submissions from 75 stakeholders.
Many merchants, payment service providers and issuers raised concerns about liability when an agent acts outside its authority. Without reliable agent identification and a record of the agent’s instructions, participants may struggle to establish whether a disputed purchase was within the customer’s mandate. Merchants were particularly concerned that this uncertainty could increase chargebacks.
The RBA also reported a submission referring to an additional 4 per cent charge on purchases completed using an AI agent. That is a signal of the market trying to price an unfamiliar risk before it can properly measure or allocate it.
Stakeholders generally favoured monitoring and industry standards over new prescriptive regulation, noting that agentic commerce remains early and evidence of harm is limited. The RBA plans to announce its regulatory priorities by the end of 2026.
Why existing US rules leave room for dispute
In the United States, Regulation E generally limits a consumer’s liability for an unauthorised electronic funds transfer from a lost or stolen access device to $50 if the consumer reports it within two business days. Later reporting can change the applicable limit. But the law includes an important exception: the protections may not apply to transfers initiated by a person to whom the consumer furnished the access device, unless the consumer has notified the bank that the person is no longer authorised.
The official commentary adds complexity. Where a consumer provides an access device and grants authority, the consumer can remain liable even if the recipient exceeds that authority. “Person” can include an organisation, not just an individual. The Consumer Bankers Association’s January 2026 paper on agentic AI payments asks whether sharing credentials with an AI tool could trigger this exclusion.
Regulation Z and the Truth in Lending Act have a parallel issue for credit cards: the unauthorised-use framework turns on whether someone had actual, implied or apparent authority to use the card. Neither framework was written with software acting on a consumer’s behalf in mind.
Visa and Mastercard zero-liability policies provide protections beyond federal law, but they still depend on how a transaction is classified. They do not, on their own, settle a dispute where the consumer authorised an agent to make purchases but contests whether a particular item, price or merchant was within scope.
Trust evidence is not the same as liability allocation
Payment networks and technology firms are building ways to identify agents and record user intent. Mastercard’s Agent Pay work includes a probability score being tested in the US to help identify agent-initiated transactions, alongside collaborations involving Skyfire’s Know Your Agent work and Cloudflare web signals. Mastercard and Google’s Verifiable Intent is designed to create a cryptographically tamper-resistant record of user authorisation. Visa’s Intelligent Commerce is another approach to controlled agent-led payments.
These tools could help answer important questions: Was an agent involved? What instructions did the user give? Did the agent follow them? But evidence is not a liability rule. Even a complete record may show that the user’s agent made a purchase that technically followed a recorded process yet still fell outside what the consumer reasonably intended.
The 4 per cent pricing problem
Mastercard’s 2026 US benchmark puts the merchant cost of a chargeback at $128 in internal costs and third-party fees, excluding the value of lost goods. On that basis, a 4 per cent fee generates $128 on every $3,200 in agent sales.
That makes the break-even maths easy to see: one chargeback per $3,200 of agent sales consumes the entire fee collected, before accounting for the goods, fulfilment costs or other losses. If disputes happen more often, the merchant loses money even after collecting the fee.
Mastercard and Datos project 324 million chargebacks globally by 2028. Applying the $128 benchmark to that volume implies about $41.5 billion in handling costs. This is an illustrative extrapolation, not an official global cost forecast: it applies a merchant benchmark to a projected worldwide total.
The broader point is that a flat fee cannot tell a merchant whether an agent acted within its mandate. It prices uncertainty, not responsibility.
Merchant access is becoming part of the dispute question
Platforms are making different choices about agent access. Amazon blocked Meta’s Muse shopping agent, citing unauthorised access and its policies. Shopify, by contrast, is moving towards agent-enabled checkout.
That difference matters after a purchase goes wrong. If an agent can discover and buy from a merchant, but the consumer’s trusted refund route sits inside a platform’s own process, control of the interface can influence where the dispute is resolved. Smaller merchants (with fewer resources for support, evidence and payment operations) may be particularly exposed.
Agentic commerce remains nascent. Stripe reported that agentic purchases through its Link wallet rose 38-fold in the month to late September, but from a small base. Meanwhile, a survey of 1,011 US consumers was reported as finding just 27 per cent comfortable with fully AI-led shopping. Early growth, in other words, is not the same as broad consumer confidence.
Readiness checklist for payments leaders
Issuers, acquirers, Payfacs, ISOs and merchants should prepare before dispute volumes establish the market’s default assumptions:
Capture authorisation evidence: retain the user’s mandate, agent identity, transaction details and any later approval.
Set clear mandate parameters: define spend limits, merchant or category restrictions, expiry and when the agent must ask again.
Separate dispute types: distinguish unauthorised access, an agent exceeding scope, merchant fulfilment failures and ordinary buyer’s remorse.
Make refunds easy to find: provide a clear merchant refund path and make the process visible at checkout and in post-purchase communications.
Name the AI provider in contracts: agree who supplies evidence, handles complaints and bears losses when an agent’s action causes harm.
Review high-risk exposure: dispute clusters can drive monitoring, rolling reserves and termination. For high-risk merchants, a settled liability model may matter more than a marginal improvement in settlement speed.
In Australia, timing adds commercial pressure. The card surcharge ban took effect on 1 October 2026. The next cost-of-acceptance disclosure milestones are 30 October 2026 for initial fee disclosures, 30 January 2027 for interchange pass-through disclosures and 1 April 2027 for more detailed merchant statements. If payment costs become easier for machines to compare, dispute and refund terms could become part of how agents route transactions, not just a back-office metric.
Five content opportunities for payments leaders
Opportunity | Why it matters | Who it affects | Strategic significance | Search potential | Viral potential | Business relevance |
Agent outside its mandate | The core liability gap has no settled allocation rule | Issuers, merchants, AI providers | 5/5 | 5/5 | 4/5 | 5/5 |
The 4% agent fee | A flat fee may not cover real dispute frequency or goods loss | Merchants, Payfacs, acquirers | 4/5 | 5/5 | 5/5 | 5/5 |
Intent evidence standards | Better records help investigate, but do not decide who pays | Networks, issuers, agent platforms | 5/5 | 4/5 | 4/5 | 5/5 |
Platforms control agent access | Merchant discovery and trusted refund routes may diverge | Small merchants, marketplaces, platforms | 4/5 | 4/5 | 5/5 | 4/5 |
Agent-aware acceptance economics | Machine-readable costs could make refunds and disputes competitive inputs | Australian merchants, PSPs, agents | 4/5 | 4/5 | 3/5 | 5/5 |
What to watch next
Three signals will show whether the gap is closing: the first agent-originated chargeback precedent; whether the RBA assigns liability or evidence standards in its end-of-year priorities; and whether agent dispute rates turn out higher or lower than human-order rates. Merchants should also watch whether the reported 4 per cent agentic fee holds as commerce scales.
The next phase of agentic payments will depend on more than secure rails. It will depend on clear mandates, reliable evidence, accessible refunds and contracts that name who carries the risk when the agent gets it wrong.
For more on agentic AI and payments and AI agents in the payments ecosystem, explore our related analysis.
Get in touch with the RivaTech team today and let's turn your high-risk hurdles into high-growth opportunities. Visit www.rivatechconsulting.com or contact us directly at info@rivatechconsulting.com.
Sources
Frequently asked questions
Who pays when an AI agent makes a purchase outside the consumer’s instructions?
There is no universal rule that automatically makes the AI provider liable. The outcome may depend on the payment rail, dispute rules, evidence of the consumer’s mandate, contracts and the reason for the dispute. Merchants may face the initial chargeback cost.
Do Visa and Mastercard zero-liability policies resolve agent mandate disputes?
Not necessarily. Those policies address transactions classified as unauthorised. They do not by themselves determine whether a purchase made by an authorised agent was within the consumer’s mandate.
What does a 4 per cent agent fee cover?
Using Mastercard’s $128 chargeback-cost benchmark, a 4 per cent fee raises $128 on $3,200 in sales. That is a break-even comparison for one chargeback’s handling cost; it excludes lost goods and other costs.
What should a merchant record for an agent-led transaction?
Record the agent’s identity, the consumer’s mandate and limits, purchase details, any required consumer approval, fulfilment evidence, and the available refund route. Preserve the information in a way that can be retrieved during a dispute.
Comments