The next major shift in digital commerce may not be another payment method or wallet, but a change in who actually makes the purchase. Shopping agents are beginning to move beyond recommending products and comparing prices towards acting on behalf of consumers, potentially selecting merchants, choosing payment methods and completing transactions with limited human involvement. For banks, that creates a fundamentally different risk environment. Payment security has largely been built around establishing whether a customer genuinely authorised a transaction, but when software is given permission to spend on that customer’s behalf, the boundaries of consent, authentication and liability become far less straightforward.
Those concerns are becoming more immediate as agentic commerce moves closer to mainstream use. Major banks have warned that AI-powered shopping agents could introduce new scam, fraud and data-privacy risks, particularly if autonomous systems are allowed to access payment credentials or make purchasing decisions without clearly established industry standards. The concern is not necessarily about preventing AI agents from participating in commerce, but about ensuring that the financial infrastructure surrounding them develops quickly enough to manage the risks.
The appeal of shopping agents is easy to understand. A consumer could ask an agent to find the best laptop within a particular budget, book a suitable flight and hotel, reorder household products or search multiple retailers for the lowest price. Instead of merely returning recommendations, increasingly capable agents could potentially compare offers, select a seller, choose a payment method and complete the transaction.
That changes something fundamental for banks. Much of today’s digital-payment security assumes that a human customer is ultimately behind the transaction. Banks use device intelligence, behavioural analytics, biometrics, transaction history, location signals and other indicators to establish whether a payment is consistent with the customer’s normal behaviour and whether additional authentication may be necessary.
An authorised AI agent complicates that model because unusual behaviour may no longer indicate fraud. An agent could legitimately make purchases in seconds, transact at unusual hours, interact with multiple merchants simultaneously or behave in ways that look nothing like the customer it represents. The bank may therefore need to determine not simply whether the customer initiated the transaction, but whether an authorised agent initiated it within the boundaries established by the customer.
This introduces a much more complicated definition of consent.
Consider a consumer asking an AI agent to find and purchase a television for less than $1,000. That instruction may sound clear, but it leaves numerous decisions to the agent. Can it buy from any merchant? Can it purchase a refurbished product? Can it exceed the budget slightly if delivery is included? Can it add an extended warranty? Can it choose a merchant offering a lower price in exchange for using a payment method with fewer consumer protections?
The customer may have authorised a purchase without explicitly authorising every decision required to complete it.
For banks and payment providers, this could create demand for a new generation of programmable permissions. Rather than providing an AI agent with unrestricted access to a traditional card or bank account, customers could eventually grant tightly defined authority specifying how much can be spent, which merchants or merchant categories are permitted, how long the permission remains valid and which payment methods the agent can use.
The building blocks for such a model already exist. Tokenisation, virtual cards, transaction limits and merchant-level payment controls are widely used across the financial industry. Agentic commerce could bring these technologies together in a different way, creating payment credentials designed specifically for machines acting on behalf of humans.
A customer planning a holiday, for example, could potentially authorise an agent to spend up to a defined amount on flights and accommodation during a particular period, while preventing it from using those credentials for unrelated purchases. A household shopping agent could receive permission to reorder approved products from selected merchants but require additional human approval when the value exceeds a specified threshold.
This would effectively turn payment authority into something programmable rather than binary.
The development also presents a challenge for fraud detection. Banks have invested heavily in identifying patterns that distinguish normal customer behaviour from suspicious activity, but agentic commerce could create an entirely new category of legitimate automated behaviour at the same time criminals are using increasingly sophisticated automation themselves.
The important distinction may therefore shift from determining whether a transaction was performed by software to determining whether the software itself can be trusted.
That could eventually require some form of verifiable agent identity. Banks and payment networks may need to know which AI agent is requesting a transaction, which provider operates it, which customer authorised it, what permissions were granted and whether those permissions remain valid. Transactions initiated by recognised agents operating within clearly defined mandates could be treated differently from unidentified automated systems attempting to access payment infrastructure.
Payment networks and technology companies are already exploring mechanisms intended to support agent-led commerce, but interoperability will be critical. Consumers are unlikely to want separate financial permissions for every AI assistant, merchant and payment provider they use. Banks will similarly want consistent standards that allow them to recognise authorised agents without having to integrate individually with every AI platform entering the market.
Privacy presents another challenge because useful shopping agents become more effective when they understand the consumer. Purchase history, preferred brands, location, previous searches, household requirements and financial circumstances could all improve an agent’s ability to make decisions.
Yet the same information could create an unusually detailed picture of an individual’s economic behaviour.
Financial institutions have spent years developing frameworks governing how banking data can be accessed and shared through mechanisms such as open banking. Agentic commerce could introduce another participant into that ecosystem, with AI platforms potentially requesting access to information from consumers, merchants and financial institutions simultaneously.
The principle of data minimisation could therefore become particularly important. An agent purchasing groceries may need a delivery address, spending limit and product preferences, but it does not necessarily need unrestricted visibility into a customer’s account balances, transaction history or broader financial life. Banks may increasingly have to consider not only whether third-party access has been authorised, but whether the information being requested is proportionate to the task being performed.
Perhaps the most difficult question arises when an AI agent gets something wrong.
If an agent purchases from a fraudulent merchant, misunderstands an instruction, buys the wrong product or selects a payment method that reduces the customer’s ability to recover funds, determining responsibility could become complicated. The consumer may argue that the transaction was not what they intended, while the bank could point to the fact that the consumer authorised the agent to make purchases.
The AI provider, merchant, bank and payment network could all potentially sit somewhere within that chain of responsibility.
Existing consumer-protection frameworks were largely developed around transactions initiated directly by people. Agentic commerce introduces the possibility of transactions that are technically authorised but where the eventual outcome falls outside what the customer reasonably believed they had approved.
That distinction could become one of the defining regulatory questions surrounding autonomous payments.
The issue extends well beyond shopping. Commerce may simply be where consumers first become comfortable allowing autonomous systems to spend money on their behalf. Once that behaviour becomes established, similar models could emerge for paying bills, managing subscriptions, switching service providers, moving savings or carrying out other routine financial decisions.
The stakes increase considerably as the authority granted to the agent expands.
An AI system recommending a cheaper electricity provider presents limited financial risk. An agent authorised to cancel an existing contract, establish a new one and initiate payments is operating at a very different level. An agent recommending an investment is different again from one authorised to move money and execute the investment itself.
For banks, the broader transition is therefore from AI that provides information to AI that possesses financial authority.
That could make identity, permission and accountability some of the most important components of the emerging agentic economy. Banks may eventually need infrastructure capable of recognising three separate elements within a transaction: the customer, the agent acting for the customer and the exact authority granted to that agent.
The arrival of AI shopping agents does not necessarily mean today’s payment-security model becomes obsolete. It does, however, suggest that it will need another layer. Banks have spent decades learning how to determine whether the person attempting to spend money is really their customer. The next challenge may be determining whether the machine attempting to spend that customer’s money has genuinely been given permission to do so.
What it means
- Authorised payments may need a broader definition. Banks could increasingly need to establish not only whether a customer approved a transaction, but whether an AI agent acted within the specific authority that customer granted.
- Payment permissions could become programmable. Spending limits, approved merchants, transaction categories, payment methods and expiration periods could form part of the credentials consumers provide to autonomous agents.
- Fraud detection will have to understand legitimate automation. Behaviour that looks abnormal under today’s models may be perfectly normal when an authorised AI agent is conducting transactions.
- Agent identity could become part of payment security. Financial institutions may eventually need reliable ways to identify the agent, its provider, the customer it represents and the permissions attached to each transaction.
- Data access will require tighter boundaries. Shopping agents may benefit from financial information, but banks and regulators will have to determine how much information an agent genuinely needs to complete a particular task.
- Liability remains a major unresolved issue. Clearer rules will be needed to determine responsibility when an authorised agent makes an unintended purchase, interacts with a fraudulent merchant or exceeds what the customer believed they had approved.
- Shopping may only be the beginning. The controls developed for agentic commerce could eventually influence how autonomous systems are permitted to pay bills, manage subscriptions, move money and perform other financial activities.
