For twenty years, card fraud controls have rested on a simple assumption: a human is at the other end of the checkout. On 14 October 2025 Visa published the clearest sign yet that the assumption is breaking. Its new Trusted Agent Protocol, built with Cloudflare, gives merchants a way to verify that an AI agent arriving at their site is legitimate and acting for a real customer, rather than a bot scraping prices or testing stolen cards[1].

The protocol is deliberately unglamorous. It builds on the existing HTTP Message Signatures standard, so an agent signs its requests and a merchant can check the signature without redesigning its checkout. More than ten partners signed up at launch, including Adyen, Checkout.com, Coinbase, Fiserv, Microsoft, Shopify, Stripe and Worldpay.

Why the networks are moving now

The volume is already real. Visa cites Adobe data showing AI-driven traffic to US retail sites up more than 4,700% in a year to August 2025[1]. Most of that is research rather than purchasing today, but merchants cannot tell the helpful agent from the hostile bot, and the default response to unknown automated traffic is to block it. A trust signal the whole ecosystem recognises unblocks the commercial opportunity.

The part that lands on banks

Networks can standardise how an agent proves who it is. They cannot, on their own, answer the three questions that decide whether agentic commerce works for consumers:

  1. What did the customer actually authorise? "Buy me running shoes under £120" is a mandate with limits. Someone has to hold that mandate, check each purchase against it and show it later.
  2. Who pays when the agent gets it wrong? A mistaken purchase is not fraud in the traditional sense, but the customer will call their bank, not the agent developer.
  3. How is a dispute resolved? Chargeback rules were written for humans who can say "I did not make this purchase". An agent did make it, and possibly badly.

All three sit with the issuer. The card is the bank's product, the customer relationship is the bank's, and the complaint will be the bank's.

The network can vouch for the agent. Only the bank can vouch for the customer's intent.

What an issuer agent strategy looks like

Banks do not need to build agents. They need to decide how their cards behave when an agent holds them:

  • Treat agents as a channel. Give each authorised agent its own credential, scoped by merchant category, amount and time, so it can be switched off without reissuing the customer's card.
  • Own the consent record. Let customers set and see agent mandates in the banking app. The bank that holds the mandate holds the dispute evidence.
  • Adapt fraud models. Agent traffic is fast, precise and repetitive, which is exactly what current models flag. Separate verified agent traffic from anonymous automation, or false declines will teach customers to use someone else's card.
  • Write the service model before the volume arrives. Decide now how an agent-made mistake is handled, what the customer is told, and when the bank absorbs the cost.

The strategic risk

If banks treat this as plumbing the networks will sort out, the mandate layer will be built by whoever builds the agents, and the most valuable data in agentic commerce (what customers delegate, to whom, and within what limits) will sit outside the bank. The networks have moved first on identity. Issuers still have time to lead on intent, but not much.