Your agent just bought ten washing machines instead of one. Or it read "find me a cheap desk" as permission to purchase a 3,000 dollar antique. Or it visited a compromised product page that injected instructions and redirected your budget to a fraudulent merchant. Who pays? The honest answer is that nobody has fully settled it. But the shape of the problem is now clear, and so are the moves that decide your exposure while the rules catch up.
Chargebacks assume a human
The entire dispute system rests on one premise: a human cardholder made the purchasing decision. Call your bank to dispute a charge and the questions follow that script. Did you authorize it? Was the card stolen? Did the merchant fail to deliver?
Agents break the script. You authorized the agent. The agent authorized the transaction. The merchant shipped exactly what was ordered. Yet you ended up with something you never intended to buy, and under current network rules that purchase would likely be treated as authorized, because you delegated authority to the agent. Misinterpreted intent is not fraud under today's definitions.
The networks know about the gap. Mastercard's Agent Pay issues agentic tokens for AI-initiated transactions and Visa's Trusted Agent Protocol verifies agent identity at checkout, but both programs focus on authenticating legitimate agents, not on resolving disputes when a legitimate agent buys the wrong thing. That question remains largely unaddressed.
Is agent error fraud?
Traditional fraud involves unauthorized access or intentional deception: a stolen card number, goods never delivered. An agent with valid credentials and genuine authorization that simply gets it wrong fits neither definition. If it bought the antique because it read "cheap" as "good value for quality," the agent did not lie and the merchant delivered as ordered. Under current frameworks that looks like user error, not fraud.
Why the agent failed changes the calculus. If it hallucinated, misread your request, or fabricated a justification, responsibility likely flows to you as the deploying user. But prompt injection is different: security researchers have documented how a compromised page can embed hidden instructions that hijack agent behavior. A bad actor deliberately manipulated your agent, which looks like traditional fraud. Courts have not yet decided whether it counts as fraud against the cardholder, negligence by the agent developer, or a new category entirely.
Some legal scholars suggest treating agents like employees acting within a scope of authority: purchases inside the parameters you set are yours, purchases beyond them may be disputable. Which makes the implementation details load-bearing. Did you set spending limits? Merchant restrictions? How precisely you defined the agent's scope could determine your liability in ways the chargeback rules never contemplated.
You authorized the agent.
The agent authorized the transaction. Someone still pays.
The 2026 liability landscape
Where things actually stand this year: no US federal law specifically addresses AI agent purchase liability, and card networks have not published comprehensive dispute rules for agent transactions. In the EU, the Digital Omnibus pushed the AI Act's high-risk obligations back from August 2026 to December 2027, and payment-specific liability remains unsettled. The most concrete movement came from an issuer: in April 2026, American Express attached purchase protection to registered-agent transactions, which it describes as an industry first. Expect that to become table stakes, and expect it to favor setups that can prove what the agent was authorized to do.
An insurance layer is forming in parallel. AIUC, a startup that raised 15 million dollars in seed funding to build insurance infrastructure for AI agents, projects the market could reach 500 billion dollars by 2030; its framework combines NIST's AI risk guidelines, EU AI Act requirements, and MITRE's ATLAS threat model to price agent risk. Most teams deploying agents today carry no specific coverage for agent-initiated losses.
Identity and intent records are becoming the evidence that matters. An agent verified through a protocol like Skyfire's Know Your Agent has a traceable chain of accountability: which agent, whose authority, what history. And systems that require a declared intent before releasing payment credentials create a pre-transaction record, so when the actual charge diverges from the declaration, the discrepancy itself is evidence.
Refunds first, disputes last
Because the dispute path is ambiguous, the operational answer is to avoid it. Your agent will buy the wrong thing eventually, not because it is malicious but because it is software, so the goal is a clean loop when it does: detect the mismatch, attempt a refund or return, escalate if needed, and preserve evidence throughout.
Detection triggers are mechanical: wrong merchant, wrong amount, wrong item category, or a duplicate charge from a retry loop. Before contacting the merchant, assemble the record: the intent and its purpose, the transaction, the receipt, and the timeline from intent to charge. Then pursue merchant resolution first; a cancellation requested within minutes of the charge is the single best window, and agents can open tickets and initiate returns where merchants support it. Escalate to a human for high amounts, merchants with no clear support channel, or any indicator of compromise.
Only when merchant resolution fails should you dispute, and at that point the evidence log is your entire case: intent declared X, transaction executed Y, mismatch verified, refund attempted and refused. That chain is what turns an ambiguous delegated-authority argument into a documented discrepancy.
Reducing exposure by design
Every layer of prevention is cheaper than the loop, and the loop is cheaper than a dispute. Isolated funding per agent or workflow caps the blast radius at a scoped balance instead of your credit line. Merchant allowlists bound where money can go, velocity caps stop retry loops from compounding, and conservative limits keep any single failure small. Documented governance, the policies, monitoring, and incident response you can show, is what demonstrating reasonable precautions looks like when rules crystallize.
This is the architecture Signets ships: intent-gated scoped credentials, limits enforced before money moves on every rail, and an evidence record linking each transaction to the authorization behind it, with recovery pursued on reversible rails and prevention up front on rails that never reverse. The liability frameworks have not caught up yet, but your exposure is decided by the controls you run in the meantime. Tell us what you are building and we will get you sandbox access.
FAQ
Who is liable when an AI agent makes a wrong purchase?
It is unsettled. Because you delegated authority to the agent, current frameworks would likely treat its purchases as authorized, leaving the loss with you; prompt injection cases look more like fraud but lack precedent. American Express began covering registered-agent errors in April 2026, which it calls an industry first, and no US federal law yet addresses the question.
Can you charge back an AI agent's purchase?
Sometimes, but dispute frameworks assume a human made the decision, so issuers may treat agent-initiated purchases as authorized unless there is clear fraud. Your strongest dispute asset is an evidence chain showing the declared intent, the divergent transaction, and a failed merchant refund attempt.
Does prompt injection change who is liable?
It can. If a malicious page manipulated the agent into a purchase, the scenario resembles traditional fraud rather than user error, but courts have not established whether it counts as fraud against the cardholder, developer negligence, or a new category. Verified agent identity and intent logs make the manipulation demonstrable.
How should refunds and returns work for AI agent purchases?
Prefer refunds over disputes. Detect mismatches automatically (wrong merchant, amount, category, or duplicates), attach the intent record and receipt, request cancellation with the merchant as fast as possible, escalate edge cases to a human, and dispute only as a last resort with the full evidence log.
