Who pays when an AI shopping agent's order is disputed?

Card networks have not published a rule on who bears the loss when an AI shopping agent places an order that is later disputed. Until one does, assume the merchant of record owns it, and keep the account login, delivery address and integration tag with every agent order.

What have the card networks said about agent disputes?

None has published anything that moves the loss off the merchant. On 30 September 2026 Mastercard announced new Agent Pay trust and intelligence services, including a probability score for whether an agent initiated a transaction. The release, on Mastercard's investor news page, says nothing about disputes, chargebacks or who bears the loss.

That silence is the most useful fact here. A merchant selling to shoppers whose software buys on their behalf cannot point to a published network rule that shifts a disputed agent order away from the merchant. The safe assumption for 2026 is that the merchant of record owns it.

The evidence for that view is mostly an absence. One industry review, from the chargeback vendor Chargeflow, reports no published dispute-liability allocation for Visa's or Mastercard's agent programs or for Google's agent payment protocol. On its reading, agent disputes follow ordinary card-not-present rules, and the merchant remains merchant of record.

Stripe's agentic commerce documentation describes agent wallets, Shared Payment Tokens (scoped credentials), a catalog feed and several protocols. Its overview page states no dispute-liability rule. Those are one vendor's review and one processor's overview, and a rule could be published tomorrow, so check your processor's agent pages for changes.

What evidence does Visa already accept for agent orders?

Visa has started to name agent activity in its fraud rules. Reason code 10.4 is Visa's fraud code, used when the cardholder says the purchase was not theirs. The Visa Core Rules, edition of 18 April 2026, already treat login IDs used with an Agentic Payment Provider as customer account evidence in a 10.4 dispute (Table 11-28).

In practice, if an agent buys through an account the customer created, and the agent's provider logs in as that customer, the login counts as the customer's own account activity. Account login is the element Visa's text now names for agent orders, so it is the one worth recording with care.

The same edition expands Compelling Evidence 3.0 for 10.4 and lets transactions at other merchants count as evidence, effective 24 October 2026. A customer who has bought from several merchants through an agent may leave a better trail than one who has bought from a single merchant.

What happens when the agent gets the order wrong?

No network or processor has published how a dispute over an agent's mistake is handled. Agent mistakes are a second source of disputes. If an agent orders the wrong size or a duplicate, the cardholder may dispute it as not as described or as unauthorised.

Nothing published says how issuers, the customers' banks, will treat those claims. Your own order, delivery and account records are the only evidence you can count on, so keep them complete.

What should you record on an agent order?

Record enough to trace any dispute back to the integration that produced it. A merchant that knows which orders arrived through an agent integration, and which login and delivery address were attached, will have something to show if a customer later says the purchase was never theirs.

Treat agent-initiated orders as a tagged segment in your order data. Keep the account login and delivery address with every such order. Do not build policies on a liability shift that nobody has published, and do not assume one is coming in time for the holiday peak.

An agent-placed order disputed as unauthorised lands in the existing fraud rules, so the Visa 10.4 reason code page is the place to read first. Until a network publishes a rule, an agent order is a card-not-present order with a more complicated paper trail.

Takeaway: what to do this week

1. Tag agent orders. Mark every order that arrives through an agent integration, so a later dispute can be traced to its source.
2. Store the login and delivery address. Keep both with each agent order, since Visa now names agent logins as account evidence for 10.4.
3. Read the 10.4 rules before the holiday peak. An agent order disputed as unauthorised is handled there, including the Compelling Evidence 3.0 changes.
4. Plan without a liability shift. Assume the merchant of record owns disputed agent orders until a network publishes otherwise.

Sources: Visa Core Rules (18 April 2026), Table 11-28; Visa Core Rules (18 April 2026), Summary of Changes; Mastercard investor news, "Mastercard Advances Agentic Commerce With New Trust and Intelligence Services" (30 September 2026); Stripe Docs, "Agentic commerce"; Chargeflow, "AI agent chargeback liability" (2026). All checked 24 October 2026.