Shopper’s Paradise or Nightmare?: The Implications of AI Shopping Agents and Agentic Payments

By now, most people are accustomed to – or at least have some familiarity with – static artificial intelligence (AI) agents such as ChatGPT and Copilot, which have seen widespread use for tasks like answering search engine questions or summarizing a meeting. However, a new AI tool is emerging that presents unique risks and challenges for the marketplace and for merchants and payment processors in particular. Specifically, emerging agentic AI tools have moved beyond just generating information. Instead, they function like personal assistants, using generated information to reason and make decisions for the consumer, from booking hotel rooms to purchasing shampoo. These agents present important issues to be on the lookout for in the coming months.

AI agents are mostly still under development, but a few have already reached the market. They typically operate by having the consumer provide their payment card information and place pre-set parameters on what they want purchased. However, mistakes are bound to happen: already, there are reports of AI agents going over budget after not taking shipping costs into account or ordering the wrong color when no preferences were set. So, what happens when a consumer disputes these purchases? Are there any protections, or are consumers allowing the AI to fully authorize purchases as an extension of themselves?

In general, consumer card-based payments are governed respectively by the Truth in Lending Act (TILA) for credit cards and the Electronic Fund Transfer Act (EFTA) for debit cards. Each of TILA and EFTA rely on real time authorization from a customer for transactions. However, each act also contemplates pre-authorized transactions, both recurring and non-recurring, as well as transactions undertaken by persons authorized to transact on a consumer’s account. The end result for agentic payments is a mass of unanswered questions around whether such payments – particularly those that may, unbeknownst to a merchant, go beyond the parameters set by the user – are properly authorized, pre-authorized, or unauthorized.

It remains to be seen how regulators and industry will address these problems. Will updates to EFTA and TILA (each of which is decades old at this point) be necessary? By contrast, will, as seems to be the case with so many emerging payments solutions, regulators first try to “work with what they have” and apply the existing regulatory framework to these agentic payments? On the industry side, will new technologies allow merchants to identify whether remote transactions are initiated by a person or an AI agent and, if so, will merchants be reluctant to accept the risks of agentic payments?

Eli A. Rosenberg
Ava K. Mumgaard, Summer Associate