An order comes in through your website at 2 a.m. for a pair of $1,400 diamond studs. Name, shipping address and email all check out, and the card goes through. Six weeks later the chargeback lands, coded as fraud. When you call, the customer says she never bought them. Her AI assistant did.
That call is going to get more common. On October 26, Digital Transactions reported that Chargebacks911, a dispute-management company, had launched a product that covers merchants against qualifying chargebacks on purchases made by AI agents. In its announcement, the company warned of “emerging chargeback risks” when AI agents shop. Take that with some salt, since the company sells dispute services.
Visa already says who is responsible
Visa got there first. Its rulebook now has a full section for AI agents that buy on a cardholder’s behalf, and one line in it answers the question. Under Visa’s rules (section 4.1.24.10), a cardholder “is responsible for any actions taken by an Agentic Payment Provider as part of an Agentic Transaction as if the Cardholder initiated the Transaction.”
An Agentic Payment Provider is Visa’s term for an AI shopping agent. The rules require it to register with Visa through a program called Visa Intelligent Commerce. Before one can buy anything, it has to get the cardholder’s consent and an acknowledgement that the cardholder is responsible for what it does. When it buys, it has to pass you the cardholder’s name, billing address and email, plus the shipping address if the order ships.
The rule is on your side. The dispute still comes to you, and you win it with what you saved.
A rule on paper doesn’t stop a customer from hitting “dispute” in her banking app. What it does is make your records count.
Visa’s evidence rules changed on October 24
Visa’s Compelling Evidence 3.0 lets you defeat a card-absent fraud dispute by showing history with that cardholder: two earlier transactions on the same card that weren’t reported as fraud, processed more than 120 days before the dispute and within 365 days of it, with at least two matching details, one of them the IP address or device. We covered how that works for customers who dispute their own purchases.
On Saturday, Visa widened it. Under the same rulebook, for disputes processed from that date, the two earlier transactions can come from other merchants, not just yours. The login ID that counts as matching evidence now includes the customer’s login with a registered AI agent, as well as the one on your own site.
Who this hits, and who it doesn’t
Visa’s rules bar a registered AI agent from buying in a card-present setting. A sale at your counter, with the card in your terminal, is still a sale at your counter.
What’s exposed is everything that happens without the card in your hand — your online store, your booking page, deposits taken online. If you run a hotel, one rule is worth knowing. Before a registered agent books a guaranteed reservation, Visa requires it to get the guest’s consent or acknowledgement of the date by which they must cancel. So when an agent like that made the booking, “I didn’t agree to that policy” is a weaker claim, as long as your policy was there for the agent to read.
What to keep, starting this week
- 01Save the order details for card-not-present sales. That means IP address, device information, the customer’s login on your site, and the full shipping address, kept with the order. If your website or payment page doesn’t store them, ask whoever runs it to turn that on.
- 02Make sure your evidence actually gets sent. Compelling Evidence 3.0 only helps if your processor submits it when a dispute comes in. Ask yours whether it does this automatically, and whether it has applied the October 24 changes.
- 03Put your cancellation and refund policy on the page where people pay. An agent can only accept a policy it can see.
- 04Get proof of delivery on anything that ships. A signature on a $1,400 package settles a lot of arguments, and it’s the same paper that wins disputes on orders no AI ever touched.
Before you buy coverage
Agent-purchase coverage is new, and the Chargebacks911 product covers “qualifying” chargebacks. Ask what qualifies, what it costs, and whether it replaces the dispute handling you already pay for. If those answers aren’t in writing, you haven’t bought anything yet.
Start with last month’s online orders
Pull five orders from your website and check what you saved with each one. If you can’t find an IP address, a login or a delivery confirmation, you couldn’t win a dispute on that order today — whether a person placed it or an AI did. Fix that first.
Joe Radest
1 Step Technologies — Peachtree City, GA. 25+ years in the payment industry, over $50M in volume a month.