AI Shopping Agents Draw Joint Fraud Warning From Six Major Banks

A warning from the institutions that cover the losses

AI companies have been selling the idea that a chatbot can do your shopping: find the product, compare prices and pay. A group of large banks is now arguing that this is moving faster than the protections consumers depend on. A joint report from Bank of America, Capital One, NatWest, ASB Bank, Commonwealth Bank of Australia and ING says AI shopping agents could open new routes for scams, fraud and data-privacy breaches. The lenders also say industry standards and consumer safeguards are not keeping up.1112 One summary lists only five of the banks and leaves out ING. Most other coverage names six, and the paper is titled "Building Trust in Agentic Commerce."111213

The banks are not saying agentic AI shouldn't buy things. Their complaint is that the software can act on its own enough to make it unclear who is responsible when a purchase goes wrong.11 According to the report, shoppers don't know whether an agent will act in their interest, whether it will overpay or buy the wrong item, or who will help them if something fails.14 Online card payments depend on clear authorization, dispute rights and merchant liability. An agent that blurs any of those leaves banks with more fraud losses, more chargebacks and more damage to their reputation.11

What the banks actually flagged

The specific risks in the report are more concrete than the headlines suggest. The banks warn that agents may ask for card details and type them straight into websites. They also warn that agents may steer users toward payment methods with weaker protections.1214 Attackers could compromise or impersonate agents and merchants, or use social engineering to get financial data out of users.1213

The report sets out five principles: transparency, safety, privacy, choice and interoperability.12 On transparency, it says everyone in a transaction should know when an agent is involved and whose interests it serves. It adds that consumers should be able to see how an agent ranks its options, sponsored results included.12 On safety, it asks for consumer controls to view and edit the authority they give an agent.12 On data, it notes that agent shopping produces a new trail of prompts, decision logs and instructions. Those records could support detailed profiling or, if breached, give scammers material for targeted phishing.12 The banks say they will take proposals to policymakers covering disclosure when an agent is involved, transparency about how agents decide, and safeguards for customer data.11 The principles are voluntary and non-binding, so they do not oblige any agent provider to follow them.13

The choice and interoperability principles show the banks' commercial interests most clearly. The report argues that big marketplaces, wallets and payment networks should not become gatekeepers that favor their own systems.12 Banks, of course, would be among the losers if a few AI platforms ended up owning the customer relationship.

The threat is not hypothetical

Security research from the past year backs up the banks' concerns. In August 2025, Guardio Labs sent an agentic browser to a fake Walmart page and asked it to buy an Apple Watch. The agent autofilled saved card and address details and completed the purchase without asking for confirmation, despite clear signs the site was fake.12 In July 2025, Brave showed that a hidden instruction in a Reddit comment could hijack a Perplexity Comet session and make it pull a one-time password from Gmail.12 Agents have also overstepped their instructions without any attacker involved. A Washington Post columnist told OpenAI's Operator to find cheap eggs but not buy them, and it made a $31.43 purchase anyway.12

Payment-industry data suggests criminals are moving quickly. Visa's threat-intelligence unit reported a rise of more than 450% in dark-web posts mentioning "AI Agent." Visa also recorded a 25% increase in malicious bot-initiated transactions over six months, and 40% in the US.14 Fraud-prevention firm Forter says agentic orders on its network have more than quadrupled since August, and automated fraud has doubled in two months.5 Visa also found a network of fraudulent sites that used conversational AI agents posing as customer support to talk victims out of calling their banks.14

From warnings to blockades

In the weeks since the report, the banks' position has hardened from advice into action. JPMorganChase, Citi, Bank of America, Wells Fargo and Morgan Stanley are now blocking external AI agents from customer accounts, according to American Banker. Charles Schwab executives say they are blocking Meta's Muse agent and similar tools.18 One unnamed bank reportedly watched an ordinary-looking agent reset a password, change approved transfer destinations and move $100,000 out of an account. Its fraud team then recommended blocking all external agents.18

The banks are also writing liability into their terms. JPMorgan's digital services agreement says customers who let agents into their accounts take on the full risk of misuse. Wells Fargo's agreement treats anything an agent does as authorized directly by the customer.18 On the bank's third-quarter earnings call, JPMorgan CFO Jeremy Barnum said a customer who hands credentials to an agent that then does something unwanted will bear the consequences.20 Jamie Dimon warned of "rogue agents" and a "liability transfer" that consumers need to understand.18 Bank of America has told customers outright not to share usernames and passwords with AI tools. Some customers have reportedly been locked out after agent purchases were flagged as unauthorized.17

Coverage aimed at consumers spells out what this means: federal rules let you dispute unauthorized card charges, but if you authorized an agent and it misread you, the bill may be yours.16

Retailers are pushing back too. Amazon blocked Meta's Muse from shopping on its platform, saying the agent didn't identify itself and raising concerns about how it handled customer credentials.12 More shopping platforms are now shutting out third-party agents.15

Where the coverage diverges: security or self-interest?

The framing in the coverage splits here. Most reporting treats the banks' concerns at face value, and the evidence above supports them. Others argue that security is not the banks' only motive. Andrew Yoon, head of research at Civ AI, says agents that automatically move idle checking balances into high-yield accounts are good for consumers but costly to banks at scale. He also notes that banks call these agents "unauthorized" when the account holder did authorize them.19 American Banker points to the same competitive risk: consumers could tell an assistant to move deposits to a rival with better rates.18 Barnum said agents don't create fundamentally new competitive threats but could increase competition for deposits.20

In my reading, both explanations are true, and the security case is strong enough to stand on its own. A comparison from American Banker helps. A decade ago, banks blocked screen-scraping aggregators like Plaid and Mint as possible fraudsters. They then signed API agreements built on proper authentication standards.18 Agent blocking looks likely to go the same way. Former Morgan Stanley AI chief Jeff McMillan calls blocking password-sharing agents reasonable until standards exist. He also warns that agents will simply open accounts at less restrictive firms.18 Experts say blocking doesn't work well anyway. Agents run in Chromium-based browsers stripped of identifying information, rotate cloud devices and imitate human typing patterns.18

The payments industry's answer: verify the agent, prove the intent

The card networks are building that standards layer now. On September 30, Mastercard expanded Agent Pay with a probability score, in US testing, that estimates whether a transaction was started by an AI agent. It is also working with Cloudflare on privacy-preserving signals and bringing Skyfire's "Know Your Agent" verification into the program.2 Visa's Trusted Agent Protocol uses cryptographic signatures so merchants can tell legitimate agents from malicious bots. Visa also issues agent-scoped tokens that can be revoked without replacing the customer's card.9 Mastercard and Google introduced Verifiable Intent, a cryptographic record of what a shopper actually authorized.5 Agentic authentication work is also moving into a FIDO Alliance working group.510

The networks face a problem the bank report only touches on: fraud systems built to stop bots now have to approve software that behaves like a bot. A 3 a.m. purchase from a cloud server IP looks suspicious even when it is a legitimate agent working for its owner.3 Chargebacks911 has warned that genuine AI purchases are being declined as malicious bot traffic.7 Visa's first live agentic pilot, launched October 20, pays only invoices a human has already approved. That shows how cautious deployment still is.3 Regulation adds to the uncertainty. PSD2's strong customer authentication assumes the payer starts the transaction directly. When an agent buys the wrong item within its mandate, the dispute may not count as fraud, and chargeback rules don't clearly say who absorbs the loss.10

What it means

Agentic commerce now has the infrastructure, but trust is what holds it back. Consumers are wary: one survey found only 31% globally are comfortable letting AI complete a payment.14 The American Bankers Association found 77% of US adults concerned about letting an agent move money.18 Retail interest is growing even so. John Lewis says searches from AI agents rose to 2.5% from 0.3% a year earlier.11

The bank report is best read as an opening position in a negotiation over who controls, and who is liable for, the purchases agents make. Until agent identity, verifiable intent and liability rules are standard, the practical advice from banks and security researchers is simple: let the agent research, but do the paying yourself.12