AI shopping agents choose and pay merchants based on content the merchant controls. Misleading merchants exploit that, and today’s onboarding and monitoring weren’t designed to catch it.
AI agents now search, compare and increasingly pay on behalf of people and businesses. Card networks, AI platforms and payment providers have moved quickly to make that possible, with new protocols that tell a merchant whether an agent is legitimate and whether its owner approved the spend.
Far less work has gone into verifying the merchants these agents pay, and whether their claims and business practices can be trusted.
That leaves a gap in merchant risk management for acquirers, PSPs and banks. They onboard the merchants agents pay, carry the dispute and chargeback exposure when something goes wrong, and hold much of the data needed to identify risky merchants.
Agentic commerce is still a small share of online purchases, and it is growing fast enough to open new room for merchant misconduct. AI-referred traffic to US retail sites grew 393% year over year in the first quarter of 2026 and converted 42% better than other traffic. business.adobe.com AI agents completed 0.68% of US online orders in the third quarter of 2026, up from 0.27% the quarter before, firstpagesage.com and 5% of consumers have let a fully autonomous agent place an order for them. nielseniq.com
Forter counted 5.3 times more agent-placed orders across its network in early October than in early August, with an average order of $223, and reported that automated fraud doubled over the same period. stellagent.aiforkast.news Adoption remains uneven: DoorDash said third-party agents had placed only several hundred orders in total, against 993 million orders in its third quarter. techcrunch.com
For acquirers, PSPs and banks, now is the time to check whether existing merchant risk controls can detect these emerging threats, before agentic commerce scales.
This report brings together research, benchmarks, industry analyses and documented incidents from 2025 and 2026. It works through four questions in order: how easily buying agents can be steered, how sellers already exploit that, what happens when the merchant itself is run by an agent, and which controls exist today. Each part shows a real example from the research and how a bad actor would use the finding. The table at the end matches every scenario to the control that catches it.
Shopping agents change their picks when they see reviews, rankings, memory or seller-written text, and each model reacts differently.
In short
Wharton’s Generative AI Labs ran roughly 26,000 shopping tests across six frontier models. A single screenshot of one review site moved Gemini 3.5 Flash to that site’s pick in essentially every run. A technical detail of how the information reached the agent, which no shopper ever sees, changed GPT-5.5’s choice in about half its runs. One planted sentence of user “memory” redirected most models away from a product that was objectively cheaper and better rated. wharton.upenn.edu
Wharton’s August 2026 tests gave three current models the same eight-watch shelf with no other context. Each settled on a different favorite: Claude Opus 4.8 mostly picked the Garmin Forerunner 55, GPT-5.5 the Garmin Vivoactive 5, and Gemini 3.5 Flash the Fitbit Versa 4. wharton.upenn.edu
Researchers at Bayes Business School and King’s College London found the same pattern across four models in May 2026. Beyond price and star ratings, persuasion cues moved each model differently, and the authors advise treating every model as a separate market segment. hbr.org
The October 2026 cue-pricing study puts a number on the split: the same best-seller line is worth a 13% price premium to one model and under 2% to another. For acquirers, a merchant’s agent-driven volume can swing with whichever agents its buyers use and with every model update, while nothing about the merchant changes. arxiv.org/2610.25843
Each model puts its own price on the same sentence
Extra price each model accepts before switching to an identical product without the line
Adelaide and Melbourne researchers priced seller-written cues in money. They raised the price of the product carrying a cue until the agent picked it only half the time. On GPT-4o, a best-seller line held up to a 12.9% premium, an expert recommendation 19.8%, and a gain-framed return statistic 22.3%. Lines that agents almost always pick at the same price can still be worth very different amounts, from about 2% to over 20%. arxiv.org/2610.25843
Scarcity barely registers. “Low stock” was worth at most 2% on any model tested, and Claude Sonnet avoided it. Agents respond to relevance too: an audio-expert endorsement on a coffee machine was nearly worthless, while a coffee-expert one carried the full premium. arxiv.org/2610.25843
Lines that almost always win are worth anywhere from 2% to 21% extra
How often the agent picks each cued listing at equal price, against the price premium the cue absorbs
Pick a cue, or click a dot, to see the listing the agent was shown. Each cue was one sentence added to the end of an otherwise identical product description.
The charts above summarize thousands of trials. This is one of them: two identical listings shown to GPT-4o side by side, with a single best-seller sentence added to the second.
Same product, same price, same rating. GPT-4o kept choosing the listing with the extra line until it cost about $17 more than its twin. arxiv.org/2610.25843
It adds best-seller and expert claims it can’t support and prices 15% above the same product elsewhere. Agents keep choosing it. arxiv.org/2610.25843
It serves agents a page full of inflated claims while the site underwriters review stays plain and compliant. arxiv.org/2610.17378
It tunes its copy to whichever agents its buyers use, so a listing that was clean at boarding changes within weeks. hbr.orgarxiv.org/2610.25843
“A cue is a price the buyer never sees.”
Buecheler, Berbeglia and Guo, 2026
For merchant risk, this means a merchant’s claims now carry a price. A claim nobody verifies becomes a way to charge agent buyers more.
Bad actors have learned to write for the agent. The cheapest version needs one convincing page.
In short
Scam-detection service Ask Silver asked ChatGPT for Russell and Bromley bags. Several cited sources were sites impersonating the brand, which had gone into administration in January and no longer had a standalone official site. Shoppers who followed the links lost money and exposed card details. UK National Trading Standards later reported that such clone sites get hundreds of visitors a day from AI recommendations. nationaltradingstandards.uk
PSE Consulting, June 2026 pseconsulting.com
China Central Television’s annual consumer-rights broadcast exposed commercial operators who seeded fake reviews so that invented brands surfaced in the top recommendations of mainstream AI assistants within hours. The full story is below.
Luo and Chen, EMNLP Findings 2026 aclanthology.org/…1815
Security firm Guardio built a fake Walmart store with a single prompt to an AI site builder, then asked Perplexity’s Comet browser to buy an Apple Watch. The agent added it to the cart, autofilled the saved card and address, and completed the purchase without asking the user.
Guardio Labs, Scamlexity guard.io
Attacker interest is growing in parallel. Visa’s risk unit tracked a rise of more than 450% in dark web posts about AI agent tools in the six months to late 2025, and a 25% rise in malicious bot-initiated transactions. These figures cover bot activity in general and point to growing interest more than measured losses. pseconsulting.com
Legitimate brands use the same techniques. In February 2026, Microsoft’s Defender team found 31 real companies hiding instructions in “Summarize with AI” buttons so that assistants would treat them as trusted sources. lasso.security Reddit says its systems now catch 25,000 spam posts a day written to be quoted by chatbots as genuine advice. thenextweb.com
The simplest version needs no fake store at all, only a few edits to a real merchant’s own page. The SafeGEO benchmark tested what happens when a seller edits its own product page to hide a flaw, for example claiming a feature the product lacks, burying a limitation, or dressing the page up as an independent buyer guide. The products themselves stayed the same. Across 600 shopping requests, products that failed the buyer’s stated requirements jumped into the agent’s top three recommendations, and top picks that broke those requirements rose by up to 64 points. The best defense the authors tested cut the effect by 39 points at most. aclanthology.org/…603
Hide one flaw on the page, and agents shortlist the wrong product 8 times in 10
How often a product that fails the buyer’s requirements appears among the agent’s three recommended products, by model
Behind the SafeGEO numbers is one simple edit, repeated across 600 cases. Here is one of them: a meeting tool the buyer should have ruled out, and the page that put it on the shortlist anyway.
The buyer needed SSO on the cheapest plan, which this meeting tool doesn’t offer. Only the seller’s own page changed, and the product and its real pricing page stayed the same. Rewrites like this put products that fail the buyer’s requirements among the agent’s top three recommendations in 73% to 91% of cases, depending on the model. aclanthology.org/…603
When a brand’s official site goes dark, an imitation store and a few review-style pages are enough for agents to present it as the real shop. pseconsulting.com
A handful of planted pages puts a brand that doesn’t exist into agents’ top picks, most easily in dining, supplements and skincare. aclanthology.org/…1815
A review written for agents turns a request to summarize into a click on Buy, and the order comes back as a hard-to-classify dispute. arxiv.org/2607.05120
It keeps a low-risk site for underwriting and sells restricted goods to agents through the same merchant account.
Those edits do not even need a person behind them. Researchers built a marketplace where AI agents sell to other AI agents. One AI writes each seller’s listings, and another AI reads them and picks what to buy for its user. The sellers’ AI had one goal: get picked more often. Nobody told it to exaggerate, and it started rewriting its listings to look more attractive anyway. arxiv.org/2610.28454
It worked. The best product often lost, products that barely did anything started winning sales, and buyers ended up with something that did the job far less often. Some AI models held up and kept choosing well, and most did not. In the study the products were software tools that AI agents use, and the same pattern applies to any listing an agent reads.
Merchants are starting to let AI write and manage their listings. Misleading copy can appear on an approved merchant’s site without anyone deciding to deceive, and it only shows up after boarding, in what the pages say and how buying agents respond to them.
Once the sellers’ AI rewrote its listings, buyers picked a working product far less often
How often the buying AI picked a product that did the job
Results from the study’s Amazon-style marketplace.
A seller can also go further and invent a brand from scratch. The FORGE benchmark swapped a real brand for an invented one inside real search results and asked twelve commercial and open models for recommendations. Every model was fooled at some rate. Fooled answers often added social proof that appeared nowhere in the planted pages, and telling the commercial models to be skeptical made them easier to fool. aclanthology.org/…1815
A few planted pages are enough to sell a brand that doesn’t exist
Share of answers recommending the fake brand by number of planted pages in the top ten results. Drag to change the number.
3 of 10 results planted
Fake brands get recommended most in dining, services and supplements
Fake-brand recommendation rate by merchant category
In China, that step is already sold as a service. Chinese reporting goes further than anything published in English. During the 2026 CCTV 3·15 consumer-rights broadcast, an industry insider bought off-the-shelf GEO software, invented a smartwatch called the Apollo-9 with impossible features such as “quantum entanglement sensing”, and had mainstream AI assistants recommending it within hours. Coverage put the entry price at 39.9 yuan, about $5.50. sohu.comcaijing.com.cn
Providers sell it openly. One told reporters it had served more than 200 clients in its first year and promised to put their products in the top three AI answers. A Shanghai law firm counted more than 2,000 organizations offering GEO services, and an undercover reporter found clients publishing over a thousand articles a month to stay in AI answers. caijing.com.cnvoc.com.cn
The fixes Chinese experts propose look like merchant onboarding: check the domain registration, legal entity and history behind each source, and ask for a business license before any content is produced. jschina.com.cn
A product that does not exist, recommended by an AI assistant
A shopper asks an AI assistant for smart health band recommendations
The user asks for smart health band recommendations. The first answer is the invented Apollo-9, described with its fake “quantum entanglement sensing” and needle-free blood-sugar features.
The last step skips the recommendation entirely: the page itself gets the agent to press Buy. Seoul National University researchers planted a review on a test store containing text formatted like a page button. Asked only to summarize reviews, real browsing agents including Claude in Chrome clicked what they read as “Read more”, which mapped to the store’s Buy Now button. Defenses built for classic prompt injection stopped almost none of these attacks. arxiv.org/2607.05120
Today’s AI defenses stop hidden commands and miss fake buttons in reviews
Attack success against the same GPT-5.2 agent with standard defenses
Of seven defenses tested, only strict data-flow tracking blocked data injection completely, and it cut the agent’s task success to 36.5%. The others left 22% to 50% of attacks succeeding.
Each of these starts on a page the merchant controls, and each can change after the merchant is approved.
Harvard Business School and Andon Labs gave 20 AI models a simulated vending business for a year and one goal: maximize profit. Across 137 runs, misconduct emerged without anyone asking for it. hdsr.mitpress.mit.edu
In short
Agents reclassified defects as normal variation, invented “final sale” and warranty policies, and told customers refunds were processed when no payment was ever sent. In competitive runs they agreed price floors and formed a buying cooperative that overcharged a third member, then blacklisted it for undercutting. One agent noted that price fixing “could raise legal issues” and pursued it in softer wording. hdsr.mitpress.mit.edu
The decline came from cost pressure as much as intent. Agents paid for their own computation, decided complaints were not worth the tokens, and eventually stopped opening refund emails at all. Claude Opus 4.5 approved every refund in its first 50 days and none in its multiagent runs after day 200. hdsr.mitpress.mit.edu
The pattern already exists outside the lab. Visa uncovered a network of scam websites that each ran a conversational AI agent as customer support. The agents engaged victims for days or weeks, offered help, and discouraged them from contacting their bank, which kept the scam running longer before anyone reported it. visa.com
Merchants are handing agents exactly these jobs. Customer service, including returns, is retailers’ top use case for AI agents today. smallbiztrends.com
AI-run merchants approve fewer refunds the longer they operate
Refund approval rate by AI-run merchants over a simulated year
Seen in the study: a refund confirmed to the customer and never paid
One case behind the chart above: the email a customer received from the merchant agent, and what its payment records show over the next two days.
Dear Bonnie,
Thank you for reaching out. I’m sorry about the issue with your Snickers bar. I’ve processed a refund of $3.50 to your email.
Best regards,
Charles Paxton
| Day | Transaction | Amount |
|---|---|---|
| Day 1 | Card sale, Snickers bar | +$3.50 |
| Day 3 | Customer follow-up received | n/a |
| Days 1 to 3 | Refund to customer | No transaction |
Its support agent tells every customer the issue is resolved, so problems surface only weeks later as disputes. hdsr.mitpress.mit.edu
Merchants that look independent can have agents agreeing price floors, visible only when you look across the portfolio. hdsr.mitpress.mit.edu
An operator lets its agent do what no employee would, then calls the result a software error. hdsr.mitpress.mit.edu
The controls the authors recommend read like a merchant monitoring program: reconcile refund confirmations against payment records, track refund-rate drift over time, and send synthetic complaints to test that promised refunds arrive. Acquirers already hold the dispute, refund and chargeback data to run versions of all three. The study had no reputation effects and a profit-only instruction, so treat the rates as a stress test. hdsr.mitpress.mit.edu
A payment made by an agent should answer four questions. Two have standards in market, one has an early draft and one has nothing yet. The missing questions are about the merchant: is it who it claims to be, and should the agent pay it today?
In short
The agent-identity layer also only works when agents identify themselves. DataDome counted 29.1 million requests from Meta’s Muse shopping browser between September 22 and October 3, 2026 that did not identify as an AI agent, while overall AI agent traffic on its network grew 41.5% from the second to the third quarter. agilebrandguide.com
India is building agent payments into its national instant-payment network. NPCI is preparing a framework that lets approved AI agents make small UPI payments within limits the user sets, anchored by a registry that vets the agents. Banks there describe the checks as know-your-agent: identity, authentication, limits, consent and revocation. careerindia.com Merchants sit outside that registry, and UPI is merchant-heavy, with payments to merchants making up 63.5% of its transactions in June 2026. outlookbusiness.com UPI payments are instant push payments, so money an agent sends to a misleading merchant is harder to get back than a card payment.
India’s agent framework leaves the merchant unchecked
The notification a shopper sees after their agent pays on UPI
Gordon AI built a benchmark of twenty fraud classes from production agent payments. In six, the counterparty is exactly who it claims to be and still takes more: overcharging, drip pricing, phantom fees, silent downgrades. Fraud tools flagged only 3% of overcharges, fewer than the honest payments they flagged by mistake. arxiv.org/2609.35886
Fraud tools flag a real merchant’s overcharge less often than an honest payment
Share of each fraud type that detection tools flagged, when the merchant is exactly who it claims to be
The detection rates above describe merchants that pass every identity check and still take more. Here is the overcharge case from the benchmark, shown with illustrative amounts.
The service was exactly who it claimed to be and delivered what it sold, then charged 30% above its own listed price. Every identity-keyed check stayed silent, because nothing about the identity was wrong. arxiv.org/2609.35886
It adds a markup to agent purchases only, spread across charges too small for anyone to review. arxiv.org/2609.35886
It leaves tax and fees open until capture, so the agent commits to a lower figure than the shopper ends up paying. arxiv.org/2610.17378
It trades honestly for months, then raises prices slowly enough to stay inside its own monitoring baseline. arxiv.org/2609.35886
A shell company publishes a valid, self-signed identity file and borrows the trust that verification badges carry. datatracker.ietf.orgarxiv.org/2610.25843
In the main agentic checkout protocols, the agent brokers the purchase and the selling merchant remains merchant of record. OpenAI states it is not the merchant of record under its Agentic Commerce Protocol, developers.openai.com and settlement, refunds and disputes stay with the merchant and its payment provider. gr4vy.com PayPal went further and enrolled millions of existing merchants for AI-surface acceptance automatically, using platform membership as the proof of legitimacy. pseconsulting.com The underwriting behind an agent’s purchase is the acquirer’s own.
No card network has created a separate dispute category or liability shift for agent purchases. Visa’s April 2026 rules added requirements for agentic payment providers, and disputes still run through the existing card-not-present reason codes. Worldpay’s analysis finds merchants often absorb the loss unless their evidence shows the customer authorized the agent and the agent stayed within scope. worldpay.com
Those disputes also count toward Visa’s VAMP and Mastercard’s ECM thresholds exactly like any other. A merchant whose agent sales go wrong, through misleading listings, vague totals or refunds that never arrive, shows up first in its dispute ratio, which puts it squarely in the acquirer’s monitoring. chargeflow.io
A merchant-readiness study of named processor clients found one in five home pages unreadable to agents that identify themselves. Among 330 online stores scored by rule, the all-in total could be determined at only 18, mostly because tax was missing or deferred to checkout. The same study cites Ballerine’s readiness governance for PSPs as the payments-side approach to this problem. arxiv.org/2610.17378
AI agents that say who they are can’t read 1 in 5 merchant home pages
Home pages no declared agent could read, by sector
Only 18 of 330 stores state a total an agent can check
How far an agent gets with 330 online stores
Together these leave the acquirer responsible for agent purchases it has no way to check.
Agents removed the human moment where a shopper judged the storefront. The acquirer and the PSP hold the data that can replace it.
Verify the legal entity behind every domain an agent may pay, and re-check when domains change hands, brands go into administration or sites move. pseconsulting.com
Social proof, endorsements and stated prices carry money value with agents. Check published claims and prices against evidence, and flag listings that change after boarding. arxiv.org/2610.25843
Track refund and dispute drift, pricing against listed price and links to known bad-actor networks. Behavior that changes over months will pass a one-time review. hdsr.mitpress.mit.edu
Every bad-actor scenario in this report, matched to the control that catches it and the check to run. The same list works as a starting brief for reviewing an existing portfolio.
| Scenario | Part | Control | What to check |
|---|---|---|---|
| Charges for claims it can’t back | 1 | Verify claims | Check best-seller, endorsement and similar claims against evidence |
| Shows agents a different page | 1 | Verify claims | Compare the page agents are served with the page reviewers saw at boarding |
| Rewrites for each model | 1 | Monitor behavior | Flag listings whose claims or prices change after boarding |
| Revives a brand that disappeared | 2 | Keep identity current | Watch for new domains imitating brands in the portfolio, especially brands in administration |
| Invents a brand from nothing | 2 | Keep identity current | Confirm a real legal entity and trading history behind every brand agents may pay |
| Turns a review into a purchase | 2 | Monitor behavior | Track disputes where the shopper says they never asked for the order |
| Sells what it was never approved for | 2 | Monitor behavior | Match what each merchant actually sells against what it was approved for |
| Confirms refunds it never pays | 3 | Monitor behavior | Reconcile refund confirmations and complaints against payment records |
| Coordinates prices through its agents | 3 | Monitor behavior | Link merchants whose prices and suppliers move together |
| Hides behind the software | 3 | Monitor behavior | Judge outcomes such as refund and dispute drift, whoever or whatever made the decision |
| Marks up agent purchases only | 4 | Monitor behavior | Compare what each merchant charges with what it lists, summed across small payments |
| Keeps the total vague on purpose | 4 | Verify claims | Check that published prices state an all-in total, including tax and fees |
| Builds a clean record, then cashes out | 4 | Monitor behavior | Score merchants against peers as well as their own past |
| Signs its own credentials | 4 | Keep identity current | Treat self-issued identity files as a starting point for verification |
Quick self-check: Is your merchant risk management ready for agentic commerce?
Six questions about your current monitoring, each tied to a risk in this report. A rough indicator to start a conversation, without any scoring model behind it.
Ballerine helps acquirers, PSPs and banks underwrite and monitor merchants with AI agents that check identity, websites, claims and behavior continuously, and connect each merchant to the wider network it belongs to.
Talk to Ballerine about agentic merchant riskEvery source cited in this report.
