Artificial intelligence is changing how consumers discover products, compare prices, and interact with digital merchants. The next frontier is more consequential: software agents that can perform parts of a purchase journey, and in authorized settings, initiate payment-related actions on behalf of people or businesses. This transition is called agentic commerce. It promises convenience, but it also changes how the industry must think about identity, permissions, transaction integrity, and fraud prevention.
In September 2026, Anthropic introduced blueprints for retailers building shopping and merchant agents on Claude. These blueprints support activities such as product discovery, personalized suggestions, and shopping-cart assistance; Anthropic explicitly said the released blueprints do not complete purchases. In October, a separate Visa, BILL, and Billtrust pilot demonstrated an approved B2B invoice payment being executed by a trusted agent. Together, these developments show why payment security must evolve alongside agentic experiences.
Read the Reuters coverage and Visa’s pilot announcement.
What are agentic commerce and agentic payments?
Agentic commerce refers to the use of AI agents that can pursue shopping or commercial goals across multiple steps—for example, comparing products, checking inventory, making recommendations, or preparing a basket. Agentic payments is the narrower concept of an agent participating in an authorized payment workflow, potentially initiating or submitting a payment within defined limits and controls.
The distinction matters. An AI shopping assistant that recommends a product is not automatically authorized to spend money. A payment-capable agent requires clear delegation, verified identity, limits on what it can do, and a dependable record of who approved the transaction. Organizations should treat authorization as a separate control, not as an implication of having used an AI assistant.
Why Anthropic’s retail agent blueprints matter
Anthropic’s September 2 announcement offers retailers blueprints for shopper-facing and merchant-facing agents. Shopper agents can help customers navigate choices and place items in a cart, while merchant agents can assist with operational decisions such as inventory and promotions. This is an important step toward conversational commerce, even though the blueprints, as announced, stop short of completing purchases.
For risk teams, the immediate implication is not that every AI chat will autonomously charge a card. It is that the boundary between browsing, decision support, and transaction initiation may become less visible to customers. Fraud controls therefore need to be connected across the journey: from account access and product selection to checkout and post-transaction monitoring.
Visa’s October 2026 pilot: From recommendations to approved payments
On October 20, 2026, Visa, BILL, and Billtrust announced a live pilot in which a registered and authenticated AI agent can execute previously approved buyer invoice payments through supplier portals. The system uses tokenized credentials, controls tied to the buyer’s approved instructions, and visibility into payment authorization and completion. Crucially, the agent is not independently deciding which invoices to pay: it executes payments that buyers have already approved.
This narrower, controlled example is useful for assessing real adoption. Rather than replacing payment governance, the architecture attempts to preserve it while reducing manual steps. Banks, PSPs, merchants, and enterprise finance teams should study which controls remain human-defined and which execution steps are delegated to software. Source: Visa press release.
The fraud risks introduced by AI-initiated transactions
1. Agent identity and impersonation
A payment platform needs to distinguish a legitimately registered software agent from an attacker imitating one. A plausible agent label or familiar user account is not sufficient evidence of authenticity. Strong authentication, credentials bound to the relevant context, and verification of delegated authority are foundational.
2. Authorization drift and excessive permissions
A user may authorize an agent to compare prices but not to buy. A business may authorize payment of one approved invoice but not a different invoice, supplier, or amount. Systems should enforce purpose, scope, amount, expiration, and revocation rather than interpreting an open-ended instruction as unlimited authority.
3. Manipulated instructions and untrusted content
Agents often read external content, including product descriptions, messages, and websites. Malicious or misleading text can attempt to redirect an agent’s actions. Organizations should separate untrusted content from privileged instructions, confirm sensitive operations against verified transaction data, and require additional approval when material details change.
4. Account takeover and synthetic activity
Criminals may attempt to use compromised consumer or merchant accounts to register agents, obtain permissions, or exploit trusted checkout flows. Traditional indicators—device changes, unusual IP patterns, unfamiliar beneficiaries, velocity anomalies, or account-behavior shifts—remain useful, but they need interpretation in the context of legitimate automation.
5. Refund, chargeback, and merchant abuse
Automated shopping can increase the scale of disputed orders, promotion abuse, repeated refunds, and coordinated merchant fraud if guardrails are weak. Payment providers should connect purchase intent, account relationships, fulfillment events, and disputes without assuming all high-volume agent activity is malicious.
Why traditional fraud rules alone are not enough
Static thresholds still provide valuable safeguards, but a rigid rule that flags every rapid sequence of transactions could generate false positives when legitimate software agents operate at machine speed. Conversely, an attacker may mimic an approved agent’s cadence to evade simplistic controls. Effective detection requires the combination of policy rules, contextual features, behavioral patterns, and linked-entity analysis.
For instance, an agent paying the same verified supplier under a pre-approved mandate represents a different risk scenario from a newly registered agent attempting payments to multiple unfamiliar beneficiaries. The amount alone may be identical. Risk assessment must incorporate origin, authority, relationships, historical behavior, and the purpose of the transaction.
Five security controls that should underpin agentic payments
- Verify both the principal and the agent. Establish who owns the underlying account, which agent is acting, and how its identity is authenticated.
- Bind each action to explicit consent. Record the approved payment purpose, payee, amount limits, validity period, and revocation state.
- Use limited, protected credentials. Favor tokenization and narrowly scoped access rather than shared passwords or broadly reusable secrets.
- Score transactions with contextual risk signals. Combine transaction monitoring, device and account intelligence, velocity checks, and relationship analysis.
- Preserve traceability and human escalation. Log agent identity, delegated authority, relevant changes, and final outcomes; pause or step up high-risk activity.
How AI fraud detection and transaction monitoring must evolve
Financial institutions and payment companies need controls that work in real time without creating unnecessary friction for legitimate automation. AI-powered transaction monitoring can help analyze activities across channels, surface anomalies, and prioritize suspicious events. Graph intelligence can reveal relationships among accounts, devices, beneficiaries, and transactions that isolated rule checks could miss.
A mature model can combine deterministic permissions with adaptive fraud signals. Permission checks answer “Is this action allowed?” while risk models answer “Is this apparently permitted action suspicious?” These are complementary questions. A sophisticated fraud score should never override a missing authorization, and authorization should not automatically guarantee that a transaction is safe.
Risk teams should also track outcomes: confirmed fraud, chargebacks, customer disputes, operational exceptions, and false-positive rates. Agent-related transactions should be distinguishable in analytics so that institutions can evaluate their effectiveness as volumes grow, without treating an AI-originated action as inherently high-risk.
AI-native risk orchestration: A connected approach
The practical challenge is that risk signals are often scattered across payment gateways, customer records, authentication systems, fraud tools, and compliance workflows. An AI-native risk orchestration approach aims to connect these signals so that organizations can apply consistent policy and context across the customer journey.
Formica AI brings together risk management capabilities such as transaction monitoring, scam prevention and fraud detection, and AML & KYC workflows. Its platform also describes AI Agents that support investigation and analysis with human oversight. These capabilities are relevant building blocks for modern risk operations; they should not be interpreted as a claim that Formica currently authenticates third-party shopping agents or certifies agentic payment schemes. Explore Formica AI’s platform.
Regulatory and governance considerations
Agentic payment design intersects with existing obligations around customer authentication, privacy, fraud prevention, outsourcing and operational resilience. The exact requirements depend on jurisdiction, business model, payment instrument, and whether the organization acts as a bank, merchant, PSP, or technology provider. No single emerging “agentic commerce” label establishes universal regulatory compliance.
A useful governance framework addresses accountability: who authorized an agent, which entity is responsible for a failed or disputed transaction, which records support an investigation, and how customers can revoke consent. Organizations should map these questions to the rules applicable in their markets and involve legal and compliance teams before production deployment.
An implementation checklist for payment providers and merchants
- Inventory the journeys where AI agents can view, prepare, submit, or approve transactions.
- Identify the human or legal entity delegating permissions and set strict scope boundaries.
- Require authentication of agents and bind credentials to the intended workflow.
- Create approval and step-up paths for changes in amount, merchant, beneficiary, or device context.
- Feed agent identity and authorization context into fraud monitoring where technically supported.
- Track exceptions, suspicious activity, disputes, and customer complaints separately for agent-originated flows.
- Test prompt injection, compromised-account scenarios, stale authorization, and agent impersonation.
- Review the privacy, recordkeeping, and payment regulations relevant to each market.
The future of agentic commerce depends on trust
Agentic commerce is evolving from conversational discovery toward increasingly capable, controlled transaction execution. Anthropic’s retail blueprints show how agents can improve the shopping experience; Visa’s live B2B pilot shows how trusted agents may carry out payments that people have already authorized. Between these stages lies the central challenge: making delegation secure, reviewable, and resistant to abuse.
For financial institutions, fintechs, and merchants, the opportunity is not simply to automate more transactions. It is to build reliable controls for the new participants and behaviors those transactions introduce. Combining explicit authorization, agent authentication, real-time fraud detection, and connected risk monitoring is a sensible starting point.
Explore how Formica AI approaches AI-driven fraud prevention and real-time transaction monitoring to strengthen risk operations as digital commerce evolves.
Frequently asked questions
What are agentic payments?
Agentic payments are payment workflows in which an AI agent performs an authorized action on behalf of a person or business. They require verified authority, scoped permissions, payment security, and traceable execution.
How is agentic commerce different from an AI shopping chatbot?
Agentic commerce describes AI agents carrying out multi-step commercial tasks. A chatbot may only answer questions or recommend products; an agent may also compare choices, build a cart, or act within an approved workflow.
Can Anthropic’s retail blueprints complete purchases?
According to the September 2026 announcement, Anthropic’s shopper and merchant blueprints do not themselves complete purchases on behalf of customers or merchants.
What is the main fraud risk in AI shopping agents?
A central risk is unauthorized or manipulated action: an impostor agent, compromised user, excessive delegation, or malicious external instruction could cause actions outside the intended permissions.
Why does transaction monitoring matter for agentic payments?
Transaction monitoring evaluates contextual signals and anomalies around payment activity, helping risk teams distinguish expected automation from potentially suspicious patterns.
Are AI agents allowed to make payments without human approval?
That depends on the workflow, authority granted, contract terms, and applicable law. Visa’s October 2026 B2B pilot concerns execution of payments already approved by buyers, not autonomous approval of invoices.
How can merchants prepare for agentic commerce security?
Merchants can define agent access rules, authenticate trusted agents, enforce spending limits, maintain detailed logs, monitor unusual activity, and create customer-controlled revocation and dispute paths.
