Visa Already Decided Who Eats the Loss When Your AI Agent Buys the Wrong Thing

Visa's agentic commerce framework — the enrollment and processing rules that sit alongside Visa Intelligent Commerce and the Trusted Agent Protocol it launched with Cloudflare in October 2025 — governs how an agentic payment provider gets onboarded, what it has to disclose about the agent's identity, and how the transaction gets authorized and cleared. What I couldn't find, and what the Law360 and Lexology-syndicated coverage both note without citing a specific rule number, is any new dispute category built for the specific case of "the agent did what it was told, and what it was told to do was a mistake."

So it falls back to the existing bucket: card-not-present, same as any web checkout. If you don't recognize a charge, the two live dispute paths are Visa dispute condition 10.4 (officially "Other Fraud – Card-Absent Environment") and, on the Mastercard side, reason code 4837 ("No Cardholder Authorization"). Both exist to answer one question — did the cardholder authorize this? — and both close the moment the payment processor can show a validly authenticated transaction went through. A signed agent token clears that bar without much trouble. The agent wasn't a fraudster. It had valid credentials and used them exactly as configured. That's not what either dispute code was built to catch.

This is where I'd push back on how most coverage frames it, including, honestly, an earlier draft of this piece. People reach for Regulation E — the federal rule that defines what counts as an "unauthorized" electronic transfer — as the backstop. And the actual text is worth reading closely, because it cuts against you more precisely than the summary version suggests. Under 12 CFR § 1005.2(m)(1), a transfer isn't "unauthorized" if it was initiated by someone you furnished the access device to, unless you'd already told your bank that person's authority was revoked. Hand your card token to an agent, and — in Reg E's own language — you furnished it.

Here's the catch nobody's flagging clearly enough: Reg E covers electronic fund transfers — debit rails, bank-linked payments, ACH. Most agent checkout flows right now are running on stored credit card tokens, which fall under Regulation Z and the Fair Credit Billing Act instead, not Reg E. Reg Z's unauthorized-use definition is worded differently and caps consumer liability at $50 regardless. So the Reg E citation that's been circulating in agentic-commerce commentary is doing work on debit-linked agent payments that it may not actually be doing on the credit rail most agents are using today. I'm not a lawyer, and I'd want a payments attorney to confirm how courts are actually treating "furnished the access device" when the furnishing was to a piece of software instead of a person — that's genuinely unresolved as far as I can find, not settled either way. But the framework difference is real, and I haven't seen it stated plainly anywhere else covering this.

Two systems now exist specifically to fix the evidence problem in a dispute like this: Google's Agent Payments Protocol (AP2), which launched September 16, 2025 with more than sixty payment and technology partners, and Mastercard's Verifiable Intent, announced March 5, 2026 as a joint effort with Google, built on FIDO Alliance and W3C standards. Worth noting, because it's the kind of detail that gets flattened in secondary coverage: AP2 didn't launch with the two-mandate structure it has today. At launch it used three signed credentials — an Intent Mandate, a Cart Mandate, and a Payment Mandate. The current spec, published on the protocol's own site, has consolidated the first two into a single Checkout Mandate with open and closed states, paired with a Payment Mandate. Protocols move fast enough in 2026 that citing "the AP2 mandate structure" without a date is already slightly wrong by the time it's published.

First, a dispute code isn't the only kind of recourse, and treating it as the only one is where a chunk of the coverage on this topic — including earlier drafts of this piece — overstates the gap. Many premium cards carry purchase-protection or extended-warranty benefits that sit entirely outside Reg E, Reg Z, and the network fraud-dispute codes; ordinary merchant return policies still apply regardless of who clicked buy; and state-level unfair-and-deceptive-practices statutes exist independently of federal EFTA/TILA machinery. None of these are guaranteed to cover an agent's bad judgment call. But "there's no chargeback for this" and "there's no recourse for this" are two different claims, and it's easy to let them blur together.

Second — and this is the harder gap — the dispute-code question may be the wrong legal frame to start from. When you tell an agent "buy me a leather briefcase under $200," you haven't authorized a stranger to use your card; you've delegated a task to something acting as your agent in the ordinary legal sense of that word. Principal-agent liability is centuries-old contract and tort doctrine, and it's never had to answer what happens when the agent is software that can't be sued, fired, or held personally liable. That's a genuinely open question, tested in essentially no courts as of this writing, and it sits entirely outside the card-network rulebook this piece has spent the whole time inside.