Agentic Commerce on Shopify: Agentic Storefronts, Catalog and UCP for Merchants
Shopify Agentic Storefronts explained: how Shopify Catalog and UCP connect your store to AI channels like ChatGPT and Gemini, and what merchants should check.
Services
Page
Agentic Checkout Security: Payment Tokens, Fraud and Chargebacks for Merchants
Want to discuss
your project?
your project?
Key takeaways
- Why it matters: when an AI agent pays for a shopper, your fraud rules, your evidence and your dispute process meet a buyer you never see. The risk sits in the gaps between those three.
- What changes: the card number is replaced by a scoped, expiring token, and the browser session your fraud tools rely on is gone.
- Who pays: under the current rules you remain the merchant of record. Fraud disputes may be covered when a tokenized, authenticated flow was used. Disputes about intent, such as "I did not mean to buy that", have far less protection.
- What to do now: keep proof that the shopper delegated the purchase, review fraud rules for sessions without a device fingerprint and write down your dispute playbook before the first agent order arrives.
- Liability rules are still being written, so check the current documents from your payment provider and card networks.
When a person buys from your store, you collect a lot of context without asking for it: a browser, a device, a session, an address history. When an AI agent buys, most of that context disappears. What arrives instead is a token, a cart and a claim that a human approved the purchase.
What changes when the buyer is software
An agent order is still a card-not-present payment. The shopper is not at your checkout, so the usual rules for remote payments apply. What is new is the chain of delegation: the shopper approves, the agent acts, a payment credential is handed over in a controlled form, and you receive an order that you must be able to defend.
Three practical consequences follow:
- No device or browser fingerprint. Signals such as screen size, cookies and typing patterns do not exist for an agent session.
- Delegated intent. You need to know what the shopper actually authorized: which product, which limit, which time window.
- A new party in the middle. The agent platform and its payment partner sit between the buyer and you, and some of the evidence lives with them.
Payment tokens: what the agent holds
In agentic checkout, the agent holds a token in place of a card number.
Stripe describes its Shared Payment Token as a limited reference to a payment method stored in the agent platform's Stripe account. It has usage limits and an expiry window, and it never exposes the raw card number. OpenAI's documentation describes a Delegated Payment Spec for passing such credentials, and Stripe's token is its first compatible implementation. Stripe also says risk signals, such as the likelihood of card testing, travel with the token, so your fraud screening gets some data without a browser session.
The card networks are building their own versions. Mastercard describes agentic tokens that carry the cardholder's authorization of the agent, including details such as cart contents, spending limits and validity windows. Visa describes a Trusted Agent Protocol that lets a merchant verify an agent's identity. Several of these programs are still maturing, so ask your payment provider which ones it supports for your region and card mix.
What this means for you: a scoped, expiring token is safer than a card number sitting in a database. It also creates a record of what was authorized, and that record is your best evidence later.
Fraud: what to review
Your existing rules were written for human sessions. Review them before agent orders arrive.
1. Rules that depend on browser data. If a rule blocks orders without a device fingerprint, it will block every agent order.
2. Velocity limits. An agent can place several legitimate orders in a short time for one shopper. Decide how many is normal, per token and per agent platform.
3. Shipping and billing mismatch. Gifts and delegated purchases make mismatches more common, so a blanket block loses real orders.
4. New signals to use. Verified agent identity, the scope of the token, and the risk signals that come with it.
5. Manual review path. Decide who looks at flagged agent orders and how fast.
Chargebacks: who pays
Checkout.com states that the merchant remains the merchant of record and stays responsible for fraud, chargebacks and disputes. Stripe makes the same point about the seller keeping control of fulfillment and pricing through that role. Commentary from chargeback specialists adds a distinction that matters:
- Fraud disputes. Where the agent authenticated properly and a tokenized flow was used, liability can follow the existing rules for authenticated, tokenized payments, and the issuer may carry the risk.
- Intent disputes. Existing liability shifts are tied to fraud. A shopper who says "my agent bought the wrong thing" or "I did not authorize that limit" falls outside them, and you may carry the cost unless you win the dispute.
Worldpay describes liability for agentic transactions as still being written, and other analysts say the allocation between merchant, issuer and agent platform is unresolved beyond straightforward fraud. Treat any claim of a settled answer with caution.
The evidence to keep
A dispute is won with documents. For agent orders, keep these for every order:
- The token or credential reference and its limits and expiry.
- The agent platform and agent identifier.
- Proof of delegation: what the shopper approved, when and with what limit.
- The cart exactly as submitted, and the price you charged.
- Your order confirmation and the delivery record.
- Any messages exchanged about the order.
If the platform or your payment provider holds some of this, find out how you retrieve it within a dispute deadline.
Seven controls before go-live
1. Confirm your payment provider supports delegated, tokenized payments for agent orders.
2. Store the token reference and its scope with every order.
3. Remove or adjust fraud rules that need a browser fingerprint.
4. Set velocity and amount limits for agent sessions.
5. Define a dispute playbook for agent orders, with an owner in finance or support.
6. Keep the delegation evidence listed above and test that you can export it.
7. Run a test purchase end to end, including a refund and a simulated dispute.
If you want an outside review of your payment and checkout setup, our agentic commerce readiness audit covers these areas in one week at a fixed price. For the protocol side of payments, see how ACP vs UCP compare.
FAQ
Do I need a different payment provider for agent orders?
Not necessarily. Check whether your current provider supports delegated, tokenized payments for the protocols you plan to use. If it does, you may only need configuration.
╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌
Who is liable for a fraudulent agent order?
It depends on how the payment was made. A tokenized, authenticated flow may shift fraud liability away from you under existing rules, while other disputes follow ordinary card-not-present rules. Confirm the details with your provider and the card networks.
╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌
Can an agent order be refunded like any other?
Yes. The refund runs through your payment provider as usual. Make sure your support team can find the order and see that it came from an agent.
╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌
Should I block agent traffic until the rules settle?
That is a business choice. Blocking removes a new sales channel, while accepting orders with the controls above keeps the risk manageable. Many merchants start with low-value products and tight limits.
╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌
What should I log for every agent order?
The token reference and limits, the agent identifier, the proof of delegation, the cart as submitted and the delivery record. These are the documents a dispute will ask for.
Conclusions
How do ACP and UCP handle payments?
Need expert advice on your project?
Schedule a call with our team to discuss your needs and get expert guidance.
Related articles
What Is the Agentic Commerce Protocol (ACP)? How OpenAI’s Standard Works for Merchants
What is the Agentic Commerce Protocol? How ACP connects AI agents, merchants and payment providers, what changed in 2026 and what merchants must prepare.
ACP vs UCP: Which Agentic Commerce Protocol Should Merchants Support?
ACP vs UCP: how OpenAI's and Google's agentic commerce protocols differ on discovery, checkout and payments, and which one your store should support.