As AI agents start shopping, booking, and transacting on our behalf, the trust infrastructure built for a world of people dealing with people is quietly being repurposed for one where it no longer is — changing what it means to verify an identity, and raising questions about liability and fairness that nobody has fully answered yet.
Picture a shopping cart being filled right now, somewhere, by something that isn’t a person. An AI agent is comparing four pairs of running shoes, reading reviews faster than any human could, and about to check out with a card number it was handed, not one it owns. On the other end, a fraud engine has half a second to decide: is this a real transaction, a legitimate agent acting on someone’s behalf, or something that’s been hijacked entirely?
We didn’t just automate shopping. We quietly removed the assumption our entire trust infrastructure was built on: that at least one side of a transaction is a person who can be held accountable. That changes what we are actually verifying. For decades, identity verification meant confirming a human. Now it means confirming an agent, and the human who stands behind it.
A trust equation with only one variable
For most of commercial history, “trust” meant trusting a person. Medieval merchants sealed contracts with a signet ring pressed into wax — an object so tied to identity that losing the ring wasn’t just bad luck, it was identity theft in its most literal form. Whoever held the ring was you, legally, until someone caught on. The system worked because there was always a human being on the other end who could be recognized, vouched for, or punished.
Modern KYC (Know Your Customer) is a more bureaucratic version of the same idea: a document, a face, a database check. One human verifying another. It’s the model every fraud system alive today was built on — including the ones I spent years building at PayPal. And it’s the model that has just quietly stopped being universally true.
An old problem, in a new uniform
In World War II, radar gave operators a strange new problem: a blip on the screen with no way to know if it was a returning bomber or an incoming enemy fighter. The fix wasn’t teaching radar to “recognize” aircraft — it was IFF, Identify Friend or Foe: a transponder that let one machine vouch for another before a human ever had to make the call.
That’s close to what major payment networks and security providers have been building this year: early frameworks to authenticate AI shopping agents and to bind a human to the agent acting on their behalf. We are, in effect, re-inventing IFF for the checkout cart. The same problem, eighty years later, wearing a different uniform. Promising, but partial. The hardest parts, what happens when that binding fails or is abused, remain open.
The urgency is not theoretical. Card-network risk teams have reported a sharp rise in dark-web chatter specifically about compromising AI agents this year, and Forter’s fraud benchmarks show automated fraud attempts climbing in step with the growth in legitimate agentic activity. The bad actors did not wait for the infrastructure to be ready. They rarely do.
The open questions
This is the part I find most interesting, and most unresolved:
- When an AI agent is involved in fraud, who is actually responsible? Consider two cases. In the first, the agent you authorized is hijacked and does something you never intended. In the second, it is operated by a third party who has stolen someone’s identity or financial details, so the agent acts in the victim’s name. Is the person whose name it acted under responsible, simply because the agent was acting as them? Or is it the platform that allowed it? Or the company that built the agent? There is no settled answer yet, and the sums of money involved mean we will need one soon.
- Should an AI agent carry its own verifiable identity, separate from the human it acts for? Is that closer to a driver’s license, or closer to something resembling legal personhood — and are we sleepwalking toward the latter without quite meaning to?
- How much friction is fair to add in order to catch bad agents, given that added friction has historically fallen hardest on real humans using assistive technology that happens to behave in “bot-like” patterns?
- Are we building this trust infrastructure because we have thought carefully about the future we want — or because the agents already showed up at checkout, and we are paving the road as fast as we can behind them?
I don’t have tidy answers to any of these. I’m not convinced the industry does either, not yet. But after a decade spent building fraud prevention and identity systems for humans, I find myself unexpectedly energized by the prospect of building them for a world where I can no longer be certain who — or what — is on the other side of the transaction.
The liability question, in particular, feels like the one with the shortest runway. The money is already moving. The rules are still being written.
