All parties have veto power; why has agency payment fallen into a deadlock?

Written by: Vignesh Sreedhar, Meta Software Engineer

Compiled by: AididiaoJP, Foresight News

Consumer-grade AI agents are on the rise, and this article only discusses the traditional card payment system in B2C scenarios.

### Where the Problem Lies

AI agents are browsing the web, filling out forms, and increasingly placing orders directly. Agents are supposed to act strictly according to consumer authorization, but they may still output errors or unexpected results, making operations that do not reflect the true intentions of consumers. Anyone who has built, used, or interacted with agents knows that this situation can occur at any time.

Suppose I ask an AI agent to book a hotel: two nights, total price not exceeding $600, free cancellation the day before check-in, and within walking distance of a venue. The agent finds the right hotel for $580 and then makes the payment. The problem is that it booked a non-refundable room type. The card is valid, the merchant is real, and the amount is within budget—yet this is still a mistaken purchase. This situation can occur whether a person is in the loop (real-time confirmation) or not (autonomous execution).

This leads to the fundamental issue: payment can be successful yet still contradict user intent. There are two scenarios behind this.

First, the intent is not accurately and completely understood. A natural language request must be transformed into clear conditions that the user can confirm and other parties can verify. This transformation process may miss or misinterpret key conditions, such as whether a refund is possible, the delivery date, or whether exchanges are allowed. Currently, there is no standard format for intent—though every card organization claims to have one—so if the request becomes vague or ambiguous, mistakes can happen.

Second, the agent's actions deviate from the already clarified intent. Even if the request is clear, the agent may hallucinate, use outdated information, lose context in multi-step operations, misread checkout options, be manipulated by malicious prompts, or make errors or encounter bugs during checkout.

Given these risks, let's examine how they affect each key participant in a transaction.

Consumers: Lack of Trust. Consumers need to be assured that the agent is buying what they want, can protect payment information, and has a clear remedy path if something goes wrong. A survey by NMI of 1,000 American adults found that 69% do not trust AI to handle payments securely, 70% want to review or veto AI decisions before placing orders, and only 10% are willing to fully entrust purchases to AI. Currently, most agent purchases come from a small group of tech pioneers (likely including venture capitalists), while ordinary users remain hesitant to entrust payments to agents.

Merchants, PSPs, and Acquirers: Fraud and Chargeback Risks. Merchants are in a worse position. They must distinguish between legitimate shopping agents and malicious bots, and defend themselves when orders are disputed as "unauthorized" or "against customer instructions." Their PSPs (especially risk control service providers like Forter, Riskified, Signifyd, Sift, Accertify, and Sardine) and acquirers must assess this risk and handle disputes, yet they cannot see user intent at all. All risk control service providers currently rely on signals provided by merchants, which merchants can only obtain when users shop on their own websites.

Issuing Banks: Approving Payments Without Context. Issuing banks decide whether to authorize a payment and assess disputes, but like merchants, they cannot see what the user actually authorized. Given this, how can issuing banks dare to underwrite credit risk? They cannot confidently distinguish between fraudsters, agent errors, and valid delegated purchases.

Card Organizations: Lack of Responsibility and Intent in Transactions. Card organizations are rule-makers: they need a consistent set of rules to identify delegated authorizations, allocate losses, and assign liability. Without evidence being transmitted between parties, each party can only see part of the transaction, making it difficult to clarify responsibility.

Agent Companies: Need to Monetize. Agent companies urgently need a sustainable way to monetize transactions, but merely facilitating purchases does not establish who should pay and why. A common proposal is to take a commission from merchants (either a percentage or through affiliate programs), but neither route has been successful. Instant Checkout failed for this reason: launched by OpenAI in September 2025, it had shrunk back to product discovery and merchant-owned checkout by March 2026. Affiliate programs also struggle to scale—agents must build relationships one by one and join merchant programs individually, each with its own terms, tracking, and settlement methods, and even then can only cover a small portion of agent activities. Moreover, why would merchants pay affiliate fees while bearing disproportionate risks?

Negative Flywheel Effect. These gaps reinforce each other: if authorization and responsibility are unclear, merchants will block transactions, issuing banks will tighten checks, approval rates will drop, and checkout will be interrupted. The experience worsens, making users even less willing to entrust purchases to agents. Consumer trust is also fragile: a YouGov survey for ACI of 2,080 British adults found that 60% would stop using AI shopping agents after one mistake.

The key point is: even if models advance to the point where agents fully understand and follow user intent, the problem still exists. An agent, no matter how perfect, executes intentions that others cannot see, and the risks of fraud, chargebacks, and disputes in the entire ecosystem remain unchanged: merchants still cannot distinguish between legitimate agents and malicious actors, issuing banks still cannot verify what users actually authorized, and users' claims cannot be proven or disproven.

### Do Existing Solutions Work?

I won't cover each company individually, but I will explain the broader agent payment solutions that have gained some attention.

Auto-filling Original Card Numbers

A surprisingly common practice is to store users' real card information in a vault and then use a browser agent to fill it into the merchant's payment form. Major personal agents like Instinct and Hark Labs do this. Instinct has started supporting Stripe Link, but the vault still exists.

Instinct's payment operations run in a cloud virtual desktop, making it inconvenient for on-site demonstrations. So I tested Hark's vault instead—it directly filled my original card number and CVV into the payment form without masking. Even more absurdly, these agents claim to have such high daily active users and valuations, yet few point out this obvious security vulnerability.

Elon Musk has also tweeted that you can send a photo of your credit card to Grok Bot, throw it into the chat box, and let it shop online. But xAI's own terms clearly state: "Grok Bot may retain customer data, files, browser sessions, credentials, memories, and routines in a persistent cloud environment... deleting the Bot may not delete shared files, sessions, credentials, or routines."

Are these companies PCI compliant? Auto-filling card numbers does not inherently violate PCI, but storing and exposing payment credentials brings heavy security and compliance obligations. PCI DSS prohibits service providers from retaining CVV for future purchases, including through service provider-managed vaults and browser auto-fill. I do not see any PCI compliance certifications in the terms of several companies, so these practices exist in a gray area.

Agentcard (a YC S26 company providing card vaults for agents) has an interesting solution. Technically PCI compliant, similar to 1Password: users encrypt and store their original card information, which Agentcard itself cannot access. It requires agent browser integration (Kernel, Browserbase), and transactions are approved using Face ID. The real credit card information received by the merchant is genuine. Agentcard deserves praise for finding an innovative and PCI-compliant way for agents to pay using original card information. Even if agent browsers become the norm and users accept this kind of 1Password-like solution, I believe it remains a reliable transitional solution until agent tokens are truly scaled. They also support automatic approvals, allowing users to set automatic approval thresholds when saving cards (e.g., automatically approve amounts below $50). Agentcard currently supports 30 PSPs, including Stripe, Shopify, Worldpay, and others.

Agent Tokens

There have long been ways to pay without sharing real card information: tokenization. Here, "token" does not refer to encrypted tokens on the blockchain, but rather a string of payment credentials that replace real card numbers. The device-bound credentials of Apple Pay are a product of tokenization, and merchants also use card organization tokens to improve authorization rates and reduce fraud. Tokens replace underlying card information and can be limited to devices, merchants, or use cases. Agent tokens represent existing cards of consumers and come with services like agent identity, authentication instructions, and payment controls. Visa, Mastercard, and American Express have each launched their own agent token solutions in the past year.

Visa Intelligent Commerce (VIC) is the first agent token solution. According to the process disclosed by Visa, users first verify their card, set a passkey, and then authenticate the instructions for the agent to make a purchase. When the agent requests a checkout credential (i.e., agent token), Visa sets card organization controls based on the original instructions. When the payment reaches the authorization stage, VisaNet verifies the instructions. The instructions include higher-level authorization conditions such as maximum amount, credential validity period, and merchant domain name. However, each major agent platform has a passkey exemption—later I will explain why this is critical for issuing banks.

Mastercard Agent Pay works similarly, starting with registered agents, obtaining user consent, and authentication. Mastercard's tokenization service issues tokens representing the user's existing card for agent use. According to its disclosed advanced checkout process, agents submit purchase details and restrictions through the Intent API, receiving an intent ID and tokenized payment credential in return.

AmEx's Agentic Commerce Experiences (ACE) breaks down registration, intent approval, and credential acquisition into three steps. Account activation allows users to register their cards with verified agents and complete issuing bank authentication. AmEx, being both an issuing bank and a card organization, can control the entire issuance lifecycle. Agents call the Create Intent API to submit purchase instructions and restrictions, and when ready to pay, they exchange the proof token for a limited-scope checkout credential.

From a cross-card organization perspective, two major decisions are crucial: issuance and payment authorization. Issuance determines whether a card can be registered and whether an agent can create usable tokens. Authorization (as today) determines whether the payment is approved once the credential reaches the checkout stage. Given these solutions, why not use them directly? The problem is that several issuing banks currently do not support cross-card organization issuance of these tokens. Major banks like Chase explicitly do not support agent tokens, and many other banks also cannot provide stable support. Additionally, authorization friction is high, with a very high challenge rate for 3D Secure.

The agent tokens launched by card organizations look great in theory, but in practice, they often face difficulties due to two reasons—technical architecture and resistance from issuing banks.

Crossmint specifically targets gaps where issuing banks do not support proxy tokens. It does not issue new cards but directly uses the user's own card. During registration, it first checks if the card can obtain a proxy token (VIC, Agent Pay, or ACE); if not, it falls back to PCI-compliant vault direct card numbers: the card number is encrypted using a public key generated by a proxy browser, computer, or UCP component, then locally decrypted and auto-filled at checkout. Alfongi told me that Crossmint discussed this plan with Visa and Mastercard but ultimately chose not to issue virtual cards because the card organizations guarantee that they will not allow it in the long term.

The actual performance is not ideal either. Crossmint admits that both the authorization rate and issuance rate are not good, but they have been improving over the past two to three months. According to their data, Mastercard performs much better, while Visa is not doing well, especially with Chase and commercial cards.

Card organizations can define credentials and control, but issuing banks still need to assess risks and serve cardholders when issues arise. Without reliable evidence proving what the user authorized or whether the purchase matches the intent, issuing banks are hesitant to underwrite the additional risks brought by proxy delegation. AmEx, being both a card organization and an issuing bank, has a unique advantage as it explicitly emphasizes passing the intent to the issuing bank before execution. This is also where the passkey exemption is critical: the passkey is the only step for cardholders to prove they authorized the instruction, and by exempting the passkey for every major proxy platform, issuing banks lose this signal precisely when they need it most.

### Issuance Model: Stripe Link Proxy Wallet and Link Balance

For reference, Stripe was the first company to widely launch this method, but I know of several others that have already established or are in the process of establishing issuance plans.

How it works: An intermediary issues a new card to the proxy (usually a one-time use virtual card), and each purchase becomes two segments: your card pays Link, and Link's card pays the merchant. Link has effectively become a proxy wallet, with a 38-fold increase in proxy purchases year-on-year by September 2026.

Economic account: After deducting program costs and payments to the proxy, credit card funds leave about $0.40 in margin on a $100 purchase. On the user side: Link appears on your bill, category rewards do not apply, and disputes and refunds go back to the merchant through Link. On the merchant and issuing bank side: the merchant receives a commercial card without risk data, with acquiring costs potentially higher by about 200 basis points; the issuing bank loses merchant-level data. On the card organization side: Visa prohibits real-time card fronting outside its phased wallet rules. Mastercard went further in its Q3 2026 earnings call: CEO Michael Miebach stated, "We do not support the practice of issuing one-time virtual card numbers for transaction fronting," calling VCN a bridge, "not a long-term solution we will support."

Operators I spoke with expressed the same sentiment from another angle: the current practice is converging towards issuing trustworthy virtual cards. The problem is evident—when you are essentially designing for a MOR/card-to-card funding model, the accounting simply does not add up. Privacy.com spent over ten years refining this model: clever strategies on the funding side optimize acquiring costs and card organization fees, fraud models are finely tuned, and credit and transaction loss underwriting, customer service, and chargeback handling are all done in-house. Stripe may be willing to push hard and absorb massive losses to capture market share.

The attitude of card organizations is nuanced. Some card organization franchise teams dislike fronting, but in reality, card organizations earn more because each purchase adds several card swipe steps. Affirm/Klarna-style BNPL is an example: paying the merchant first through virtual cards at e-commerce POS, then collecting installment payments from the consumer's underlying debit card. Moreover, Visa will never allow Mastercard to take the lead in the proxy space, and vice versa. Therefore, both will make exceptions to support transitional solutions, just as they have done with stablecoin settlements and cross-border issuance exemptions.

On October 26, Stripe launched Link Balance for proxies, initially implemented through Instinct. The architectural change separates funds and individual purchases: consumers pre-load funds and grant spending permissions, allowing proxies to act according to permissions when the consumer is not present. In short:

How it works: A KYC-completed pre-loaded balance exists in a Privy wallet as stablecoins (USDC on Tempo), spent using a consumer prepaid Visa card issued by Lead Bank, which enjoys Durbin exemptions.

Why use stablecoins: By using stablecoins, proxy permissions are placed at the wallet level, also giving Stripe distribution capabilities: a programmable balance can pay regular card merchants, machine payment tracks (like Stripe's Machine Payments Protocol), and can extend USD balances overseas without needing to establish local deposit products in every market. However, this balance is not covered by FDIC insurance.

Economic account: Debit recharges are cheap, about $0.26 per $100; each $100 purchase can yield about $1.95 in interchange fees; plus, the idle balance can earn float income, and if Link shifts to Bridge's OUSD, the float will be even more.

Liability: Mistakes made by the proxy are borne by the consumer. Link's terms do not cover unauthorized transactions, and your original issuing bank only sees a recharge.

This is currently the most mature solution for proxy companies in payment and monetization, but it makes things worse for consumers, merchants, issuing banks, and card organizations. The above article contains a complete breakdown, numbers, and sources.

### Checkout Execution: Shopify and UCP

Shopify's approach is the opposite of merchants like Amazon—Amazon directly blocks proxies like Meta's Muse from purchasing on its site. In January, Shopify collaborated with Google to create the Universal Commerce Protocol (UCP), allowing proxies to search for products across merchants, add to cart, and checkout. In September, Shopify expanded WebMCP support to the checkout phase, including Shop Pay, covering all eligible merchants. This way, browser-based proxies can read, update, and complete checkouts through structured tools, no longer relying on screenshots and scraping. It also collaborates directly with Muse and Instinct, but reports suggest they do not share economic benefits with proxy companies like Stripe does. In payments, Shop Pay uses proxy tokens for non-Shopify stores, and as mentioned earlier, the authorization and issuance rates for proxy tokens are poor.

Several third parties are building on top of it, such as Crossmint and Sapiom. Crossmint's headless checkout API supports merchants using UCP and WebMCP; if not supported, it uses custom browser tools. It claims to cover 90% of e-commerce websites, with a median processing time of less than two minutes. Additionally, it's worth mentioning Agentcard's opencommerce.sh: giving proxies an endpoint and SDK allows them to search for products, checkout, and track orders across 5,026 online stores. After users approve the cart, payments are processed from the Agentcard vault, soon to support Stripe Link and Shop Pay. A 1% fee is charged for each completed order.

But this only addresses the checkout phase. Shopify, Crossmint, Agentcard, and others make it easier for proxies to complete purchases but do not change one thing: when proxies buy the wrong items, who bears the risk.

### We Are Stuck in a Stalemate

Business is essentially a multi-party risk network, where both merchants and issuing banks hold veto power. Consumers may wish for proxies to buy on their behalf all day, but as long as the merchant (the party supplying the goods) does not accept or the issuing bank (the party supplying purchasing power) does not authorize, the purchase will not happen, and users will likely end up placing orders themselves.

You might say that consumer demand alone can turn the positive flywheel: as more people shop using proxies, merchants will naturally build the infrastructure to accept these payments, and resisting issuing banks and card organizations will be bypassed, with players like Stripe and Shopify dominating proxy commerce.

I believe this is not impossible, largely because Stripe is playing a long game. Alfongi mentioned that Visa built its empire by controlling both ends, and Stripe is currently holding both ends: one end is merchants, with $19 trillion processed on Stripe last year; the other end is consumers, with over 350 million using Link, which is also pre-installed in popular proxies.

Surrounding these two ends, Stripe has also pieced together other parts of the network: Tempo for rails, OUSD for currency, and MPP for protocol. Once the Link balance on Tempo can be paid to Stripe merchants through MPP, a complete payment path bypassing Visa will be established—no interchange fees, no chargeback risks, and instant settlement for merchants.

This path will undoubtedly face layers of obstacles from issuing banks, card organizations, and possibly users. But Stripe is betting on this ambitious gamble: to create a closed-loop network for proxy commerce. They should make this bet.

However, I believe the probability of success is quite low for two reasons.

First, the barriers to entry are extremely high. Over the past decade, payment experiences have been refined to be smoother: saving payment information, one-click checkout, Apple Pay, etc., with wallets and card organization tokenization landing in 2014. Today's checkout is the result of decades and hundreds of billions of dollars in investment, nearing optimality. How mature is it? Global payment revenue is projected to grow only 3% from 2024 to 2025, compared to an average growth of 11% in previous years. Therefore, if the proxy commerce experience is worse—more chargebacks, more verification challenges, more session blocks—people will not use it on a large scale. They will bypass proxies and buy themselves.

Second, trust. Payments are extremely sensitive, and trust is extremely fragile. Many proxy companies treat PCI compliance as an afterthought, leading to numerous security incidents. Unexpected purchases may also occur: without consumer protection, dispute rights, rules, or any ecosystem participant willing to take responsibility. As soon as someone nearby encounters a pitfall—an unexpected payment, a block by a merchant or issuing bank, a security violation—they will never use it again.

Building payment trust takes a long time. The first secure online card payment was for a Sting CD bought in August 1994. By Q4 1999, e-commerce accounted for only 0.64% of U.S. retail; by 2010, it was 4.2%; today, it is only 17.1%. It took a full 30 years. Moreover, the growth behind it is institutional trust: Visa's zero liability policy in 1997, 3DS in 2001, PCI DSS in 2004, card organization tokenization and Apple Pay in 2014. Proxy payments have none of these. While seeing others use it may encourage a trial, what truly scales it is institutional trust.

Furthermore, we are creating an ecosystem where the incentives of all parties fundamentally do not align:

Card organizations want to maintain their influence. They have built proxy tokens, access keys, and intent APIs (which barely capture true intent) to keep proxy commerce running on their own tracks and rules. However, issuers like Chase are not issuing them, and each major proxy platform has access key exemptions. The worst part is that they are competing with each other, standards are conflicting, and rules are fragmented. They should not be complacent: Stripe is betting on becoming the true giant in the payment field, and anyone competing with Stripe is in a tough position.

Merchants are on the defensive. Large merchants are bringing in proxies to handle the extra transaction volume, but they are still using black-box fraud models designed for humans: IP addresses, browser session histories, fingerprints, geographic locations not matching, etc. Hundreds of companies are discussing KYA and complex fraud models, but none have a coverage and distribution capability large enough to genuinely attract interest. I even feel that if the people and intentions behind the proxies are not clear, KYA simply won't work, and proxy companies will not easily disclose this information.

Issuers cannot ethically underwrite transactions that they can barely see. But they may take on a significant role here. As Nikil Konduru said, only issuers have the full set of capabilities to cover the mistakes of proxies: premium interchange fees, underwriting, funding certificates, dispute resolution. They can require proxies to submit intent before authorization to provide purchase protection, then combine this intent with cross-merchant purchase history to ultimately build the retail media network they have always wanted. However, issuers are slow to act, and this model only works if the big five banks band together to push demands before standards are set (which they are unlikely to do).

Proxy companies need scalable GMV monetization to pay for computing bills. So whatever method can get purchases through today and provide them with money, they will use: insuring inventory with original cards, issuing through Link, negotiating custom agreements with merchants, all are fine, regardless of the costs incurred to merchants, issuers, or card organizations.

They also have macro tailwinds. In the first quarter of 2026, AI took about 80% of the approximately $300 billion in global venture capital financing; OpenAI and Anthropic raised about $217 billion in the first half of the year; Alphabet, Amazon, Microsoft, and Meta plan to spend about $725 billion on AI infrastructure in 2026, a 77% increase year-over-year. Consumer-grade proxies are also not short on cash: Instinct just launched in August with an invitation-only model and raised $1 billion at a $10 billion valuation in September, just a month after raising a round at a $2.5 billion valuation.

With so much money, such great influence, and pressure on consumer-grade AI, proxy commerce is expected to become a sustainable monetization method, and proxy companies and their investors will not wait for the payment ecosystem to slowly figure things out. They will act quickly to make this happen, regardless of whether there are others involved—this is where Stripe and other companies betting on "service proxies" are smart.

But I believe they ultimately need to monetize these users. For all the reasons mentioned above, unless the entire business ecosystem has the motivation to make it work, users will not adopt it on a large scale.

Only benefiting users without benefiting merchants will not lead to significant growth. Only benefiting merchants without benefiting issuers will not lead to significant growth. Only benefiting issuers without benefiting proxy companies will also not lead to significant growth.