AI Agents Are About to Start Buying From You. Is Your Checkout Ready?

Somebody's agent is going to try to buy something from you, and the most likely outcome is that your fraud system blocks it.

That is not a hypothetical any more. The protocol layer for agent purchasing came together faster than most people expected. Google's Agent Payments Protocol launched in late 2025 with sixty-odd partners including Mastercard, PayPal, Amex and Coinbase, reached v0.2, and was donated to the FIDO Alliance in April. ACP, from OpenAI and Stripe, handles the checkout half. Google's UCP, Visa's TAP, and a few others fill in around them, with MCP and A2A doing the plumbing underneath.

The interesting thing about AP2 specifically is what it solves. It carries signed Intent, Cart, and Payment mandates: a cryptographic chain proving that a human actually authorised this purchase, at this price, with these constraints. That is the piece merchants and networks were missing, because without it an agent transaction is indistinguishable from an unauthorised one.

The protocols being ready does not mean your systems are.

Your fraud stack was built to stop exactly this

Start here, because it is the failure that will happen first and it will look like a technical glitch rather than a strategic problem.

For two decades, ecommerce fraud prevention has been trained on a simple heuristic: humans behave like humans. Mouse movement, dwell time, typing rhythm, a session that browses before it buys. Anything that arrives, goes straight to a product page, and checks out in four seconds is a bot, and bots are bad.

An agent buying legitimately on behalf of a real customer with real intent trips every one of those signals. No mouse movement. No dwell. Straight to purchase. Possibly from a data centre IP. Possibly buying three things in ninety seconds because it was asked to reorder the household staples.

So your first agentic commerce decision is not strategic at all. It is whether your risk engine can distinguish an authorised agent from an unauthorised bot, and right now, for most merchants, it cannot. That is what the mandate chain is for: a signed proof of authorisation is a much stronger signal than behavioural inference ever was. But you have to be able to receive it, verify it, and route on it, which is work.

In the meantime, I would at minimum start tagging suspected agent traffic rather than blocking it silently, so you can see the volume you are currently turning away.

Your product data is worse than you think, in a specific way

The second failure is quieter and more damaging.

Product content is written for humans looking at a page. A human sees a photo, reads "runs small, size up", looks at the picture again, and understands. An agent gets structured data, and if the structured data does not contain the answer, it either guesses or gives up and recommends a competitor whose data did contain it.

The specific things that break agents, in the order I see them:

Variants that are ambiguous without the image. If the difference between two SKUs is visible in the photo and not in the fields, an agent cannot choose correctly.

Specifications that live in a PDF or a marketing image rather than in attributes. Multimodal models can read the image, and that is slower, less reliable, and often skipped.

Availability that is not real. If the page says in stock and the truth is a three-week backorder, a human tolerates the correction at checkout and an agent has already compared you against three alternatives on the basis of the wrong number.

Pricing rules that only exist in the checkout flow. Bulk discounts, bundle logic, and shipping thresholds that only reveal themselves at step four mean an agent's comparison is made on wrong figures. If the agent is optimising across merchants, you lose comparisons you would have won.

The fix here is not glamorous: complete, structured, accurate attributes with real availability and real landed cost, exposed somewhere machine-readable. It is the same product data hygiene work that has been on everyone's roadmap for years, except now there is a customer that cannot compensate for the gaps.

Returns and disputes get strange

This is the part I have not seen many merchants think about, and it is the one that could cost real money.

If an agent bought the wrong thing, who is responsible? The mandate chain helps, because it establishes what the user authorised: if the user's intent mandate said "running shoes, size 9, under £120" and the agent bought size 10, that is a demonstrable deviation. If the intent was loose and the agent made a reasonable choice the customer dislikes, you are in ordinary returns territory.

Two practical consequences.

Your return rate assumptions may need revising, at least early on. Agent purchases made under vague intent are more likely to come back than purchases a human deliberated over. Whether that settles down as agents get better is an open question and I would not assume either way.

Your dispute process needs to be able to read a mandate. When a chargeback comes in, the mandate chain is your evidence, and it is much better evidence than a session log. But only if you stored it, which means the mandate has to be captured and retained at the point of transaction rather than discarded after the authorisation succeeds.

The analytics question comes before the strategy question

I get asked whether merchants should be building for agentic commerce now or waiting. My honest answer is that most should be doing one thing now and deciding the rest later.

The one thing is measurement. You cannot make any sensible decision about agent traffic until you can see it separately in your analytics. What share of sessions, what conversion rate, what basket size, what return rate, what margin. Right now that traffic is mixed into your direct channel and possibly partly blocked by your fraud rules, so the numbers you are looking at are wrong in ways you cannot quantify.

Getting to the point where you have an agent traffic line in your reporting is a couple of weeks of work and it converts a strategic guess into an observation. Every merchant I know who has done it was surprised by the number, in both directions.

Once you can see it, the strategy follows naturally from the volume and the economics. If agent traffic is 0.3% of sessions and converts badly, you have a monitoring job. If it is 6% and converts well, you have a channel.

What good looks like, roughly

For a merchant who wants to be ready rather than early, the checklist is short.

Product data complete and structured, with real availability and full landed cost including shipping and tax, exposed in a machine-readable feed. This is the highest-value item on the list by a distance and it helps your human customers too.

Risk rules that can accept a signed authorisation as a strong positive signal rather than treating automation as inherently suspicious. Practically, that means being able to verify a mandate and route verified agent transactions down a different path.

Mandate capture and retention wired into your order records, so disputes and returns can be adjudicated against what the customer actually authorised.

Analytics that separate agent traffic from human traffic at session and order level.

And a decision, made by an actual person, about which agents you will transact with and on what terms. Not every agent is a good customer. Some are comparison engines that will only ever send you the price-sensitive tail. Being able to differentiate is a commercial capability, and it requires the identification work above.

The part I am genuinely unsure about

I do not know how big this gets, or how fast. There is a plausible version where agent-mediated purchasing stays a niche for reorders and commodity items, and a plausible version where a large share of considered purchases starts running through an agent that shortlists on the customer's behalf. The protocol work suggests the industry is betting on the second. The industry has been wrong before.

What I am confident about is the asymmetry. The preparation work, structured product data, distinguishable traffic, verifiable authorisation, is valuable regardless of how the agent question resolves. Clean product data improves human conversion. Better risk signals reduce false declines you are already eating. Analytics that separate traffic types is just good instrumentation.

So the case for doing it does not rest on the forecast, which is the kind of investment I like.

The case against doing nothing rests on something simpler: at some point an agent will try to buy from you, and you will either take the order or send it to a competitor whose feed was better. That happens whether or not it is on your roadmap.

We build the data and integration layer this depends on, and we are happy to start with the measurement piece so you can see the traffic before committing to anything larger. Let's talk.