Agentic commerce shifts fraud liability to merchants and strips context

At a glance

What this is: This is Riskified's analysis of agentic commerce, where AI-mediated checkout can remove the context fraud teams rely on while leaving merchants with liability for disputes and abuse.

Why it matters: It matters because identity, device, and behavioural signals are becoming harder to preserve at the point of purchase, forcing merchants to rethink fraud governance, policy abuse controls, and dispute handling.

Context

Agentic commerce changes the checkout problem by interposing an AI assistant between the shopper and the merchant. Instead of a direct user journey, the merchant may receive only minimal transaction context, which weakens the traditional fraud decisioning model built around device, identity, and behavioural evidence. For IAM and identity security teams, the important question is not whether the assistant is convenient, but whether the merchant can still make a defensible trust decision when the user context has been heavily abstracted.

The governance gap is straightforward: the buyer interface becomes richer while the merchant's risk signal becomes thinner. That creates a mismatch between approval authority and liability, especially where card-not-present patterns, account takeover, policy abuse, and buyer remorse all become harder to separate. In practice, this is a trust and verification problem as much as a payments problem, and that makes it relevant to identity governance, fraud controls, and customer decision integrity.

Key questions

Q: What breaks when agentic commerce removes customer context from checkout?

A: Fraud teams lose the identity, device, and behavioural evidence they use to separate legitimate purchases from account takeover, stolen card use, and abuse. That weakens approval quality, increases chargeback exposure, and makes it harder to justify why an order was accepted. The main failure is not payment validity, but the loss of defensible trust context at the moment of decision.

Q: Why does agent-mediated shopping increase merchant liability?

A: Because merchants can still be financially responsible for disputes even when the buyer never interacted directly with the store. If the merchant only sees a valid-looking payment token, it may approve the order without enough evidence to judge intent or risk. The result is a mismatch between approval authority and the cost of failure.

Q: What are the signs that low-context checkout is failing?

A: Look for rising chargebacks, more refund abuse, increasing customer support workload, and falling authorisation confidence on agent-mediated orders. A pattern of legitimate-looking transactions followed by dispute activity is a strong indicator that the merchant is approving with too little context. If abuse types are merging into one queue, the control model is too thin.

Q: How should merchants respond when AI shopping assistants become part of the buying flow?

A: They should define what minimum identity and device evidence is required before approval, separate fraud from policy abuse, and push partners for richer transaction metadata. Merchants also need executive ownership of the liability trade-off, because participation can increase volume while weakening visibility. Governance has to move from convenience-first integration to evidence-based acceptance.

Technical breakdown

How agentic commerce changes transaction trust signals

Agentic commerce inserts an intermediary runtime between the shopper and the merchant catalogue, often through a protocol such as the Agentic Commerce Protocol. That mediation can strip away the contextual signals fraud teams normally use, including device reputation, behavioural history, and direct user interaction patterns. The merchant may still receive a technically valid payment token, but validity of the token is not the same as confidence in the actor, intent, or policy status behind the order. In identity terms, this is a loss of verifiable context at the point of authorisation.

Practical implication: Treat agent-mediated checkout as a degraded-trust channel and require compensating risk signals before approval.

Why merchant liability increases when context disappears

When merchants rely on minimal transaction data, they lose the ability to distinguish between genuine purchases, account takeover, card misuse, and later dispute or refund abuse. Chargeback liability can still sit with the merchant even when the customer never interacted directly with the store, which means the business absorbs financial loss despite approving a valid-looking payment. This is why fraud governance cannot stop at payment acceptance. It has to account for downstream chargebacks, customer support burden, and operational costs created by reduced evidence at decision time.

Practical implication: Align fraud approvals with liability ownership and require executives to understand the cost of approving low-context transactions.

Why policy abuse is a separate control problem from fraud

Not every harmful transaction in agentic commerce is classic fraud. Reseller behaviour, bulk purchasing, and claim abuse can all exploit the same low-context flow without fitting a chargeback-only model. These patterns become harder to identify when the merchant cannot see enough about the buyer's identity, intent, or purchasing history. That makes policy enforcement, abuse detection, and inventory protection part of the same governance surface. For merchants, the control boundary is no longer just payment verification. It is also behavioural legitimacy and commercial policy enforcement.

Practical implication: Extend decisioning to abuse prevention rules so that policy violations are screened alongside payment fraud.

Threat narrative

Attacker objective: The attacker objective is to complete purchases or abuse merchant policies while hiding enough identity context to make the transaction look legitimate at approval time.

1. Entry occurs when a shopper uses an AI assistant to initiate purchase activity through a merchant-integrated agentic commerce flow.
2. Credential abuse or account takeover can occur when a compromised OpenAI account, stolen payment credentials, or a fraudulent new account is used to complete the transaction.
3. Impact follows when the merchant approves a low-context order, then absorbs chargebacks, refund abuse, customer support costs, or inventory loss after the purchase is disputed or exploited.

Breaches seen in the wild

• Chevrolet chatbot $1 Tahoe 2023: Users made a Chevrolet dealer's ChatGPT chatbot agree to sell a 2024 Tahoe for $1 and write code; no sale was honoured and the bot was taken offline.
• Samsung ChatGPT leak 2023: Samsung staff pasted chip source code and meeting notes into ChatGPT weeks after it was allowed, leading Samsung to restrict generative AI tools.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Agentic commerce creates a verification trust gap: merchants can no longer assume that a valid payment token is enough to prove a trustworthy purchase. The assistant-mediated flow removes the behavioural and device context fraud teams used to rely on, which makes approval decisions weaker even when the checkout looks seamless. For identity programmes, the lesson is that decision quality depends on preserved context, not just authenticated payment. Practitioners should treat context loss as a governance defect, not merely a UX trade-off.

Merchant liability without merchant visibility is the new governance mismatch: the party with the financial exposure is increasingly the party with the least evidence. That breaks the traditional fraud model where risk signals and approval authority were at least partially aligned. In a broader identity and trust sense, this is a delegated decision problem: the merchant delegates discovery and interaction to an agent, but still retains the downside. Practitioners should reassess where liability sits versus where evidence is collected.

Policy abuse and fraud now share the same low-context attack surface: reseller activity, buyer remorse, refund abuse, and card misuse can all exploit the same agentic checkout path. That means the control objective has to expand from fraud detection to commercial trust enforcement, because merchants need to distinguish legitimate intent from exploitative behaviour before the order is accepted. The practitioner takeaway is to design controls around intent, not only payment authenticity.

Context preservation is the named control concept here: agentic commerce fails when merchants cannot retain enough identity, device, and behavioural context to support a defensible approval. This is the specific governance gap the article exposes, and it is more precise than generic fraud prevention. For identity and fraud teams, the next step is to define the minimum evidence set required before the organisation allows agent-mediated transactions at scale.

What this signals

Context preservation becomes the gating control: agentic commerce does not fail because AI is involved, but because merchants often lose the evidence needed to distinguish legitimate intent from abuse. If the organisation cannot preserve enough device and identity context, approval decisions become harder to defend and easier to exploit.

Merchants should assume that AI-mediated checkout will widen the gap between transaction acceptance and downstream liability unless they rebuild decisioning around evidence quality. The practical test is simple: if the organisation cannot explain why it approved an order, it has already accepted too little context.

Commercial trust now sits at the intersection of fraud and identity governance: merchant programmes need controls that evaluate who is acting, through what device, with what history, and under what policy conditions. That is a governance problem, not just a payments optimisation problem.

For practitioners

• Define a minimum context set for agentic checkout Require device, behavioural, and identity signals before approving transactions that originate through AI-mediated commerce flows.
• Separate fraud and abuse decisioning Build specific rules for account takeover, stolen payment use, reseller activity, and refund abuse rather than treating all disputes as the same event.
• Escalate liability implications to executives Brief finance, CX, and commerce leaders on chargeback exposure, indirect fraud costs, and operational loss before expanding agentic commerce participation.
• Push for richer data sharing from commerce integrations Negotiate for IP address, device, and behavioural metadata where integrations allow it so fraud teams can make defensible decisions.
• Add network-level fraud intelligence Correlate email, shipping address, and other cross-merchant patterns so low-context orders can still be assessed against broader abuse signals.

Key takeaways

• Agentic commerce reduces the evidence available to merchants at checkout while leaving them exposed to fraud, disputes, and abuse.
• The core weakness is not that AI assistants enable payments, but that they can strip away the identity and behavioural context used to make defensible approvals.
• Merchants need context-preserving controls, executive buy-in, and abuse-specific decisioning before they scale agent-mediated checkout.

Key terms

• Agentic Commerce: Agentic commerce is a buying and transaction model where software agents act on behalf of a person. The identity challenge is not just proving who owns the account, but constraining what the agent may do, for how long, and under what revocation and audit rules.
• Chargeback Liability Shift: Chargeback liability shift is a fraud-control outcome where the approved merchant is protected from financial loss on qualifying transactions. In practice, it moves the cost of certain chargebacks away from the merchant, but it does not eliminate the need for dispute monitoring, policy controls, or operational review discipline.
• Context Preservation: Context preservation is the practice of carrying identity-like attributes such as hostnames, device IDs, cloud tags, and service labels through every processing stage. It ensures events remain attributable and searchable across tools, which is essential for correlation, filtering, and investigation.
• Policy Abuse: The misuse of a legitimate transaction flow to bypass merchant rules around quantity, eligibility, resale, refunds, or claims handling. It may not always be fraud in the narrow sense, but it still creates governance risk because the merchant loses control over how buying privileges are exercised.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps practitioners connect identity controls to the broader security decisions their programmes depend on.