When the Customer Authorized the Purchase, But Something Still Went Wrong
I recently read an Inc. article on AI agents making purchases on behalf of customers, and it raised a question I don’t think enough organizations are asking yet: what happens when the agent you trusted gets manipulated?[1]
The shift underway is real, and it’s happening fast. According to Salesforce, AI agents influenced $262 billion in holiday spending last year. This year, Salesforce expects AI chatbots to originate 20 percent of all holiday e-commerce traffic. That’s not a forecast for some distant future. That’s this holiday season.[2]
We’re moving into a world where AI agents can make purchases, move money, access sensitive information, and execute transactions without a person involved in every decision. For most organizations, that’s a capability worth building toward. It’s also a responsibility worth taking seriously, and the two have to move together.
Here’s the scenario that gets my attention. The customer authorized the agent. The credentials are valid. The transaction passes every check built to catch fraud. Everything about it looks legitimate.
But what if a fraudster manipulated that agent into doing something the customer never asked it to do?
That’s a different problem than the one most security programs were built to catch. Traditional controls were designed to tell the difference between an authorized user and an unauthorized one. They weren’t necessarily designed to tell the difference between an authorized agent doing its job and an authorized agent doing something it was never supposed to do. That gap doesn’t stay inside financial services, either. Any organization deploying AI agents on behalf of customers or employees needs to think this through.
At Neovera, we’re not waiting to find out the hard way. Our Fraud Red Team is testing these scenarios today: how AI agents can be manipulated, how existing security and fraud controls respond, and where the gaps sit between what a customer authorized, what they intended, and what actually happened. Some of what we’re finding is already strengthening how we think about fraud prevention.
As agents take on more autonomy, I think organizations are going to need to answer three questions, not one:
- Was the agent authorized to act?
- Was the action consistent with what the user actually intended?
- Did the agent execute that intent without being manipulated along the way?
An AI agent can have legitimate authority and still become the instrument of an attack. If we’re only testing whether an action was authorized, we’re probably missing the part that matters most.
The work to solve this is still early, and it’s encouraging to see it underway. Visa, Mastercard, American Express, and Google are all building ways to make agentic commerce verifiable, not just fast. That’s the direction the whole industry needs to move in, and we intend to be part of that work, not after the fact, but now, while the right questions are still being asked.