The Identity Gap in Agentic Commerce
AI-generated image · Bay Street Wire
As AI agents move from recommending products to executing purchases, operators must solve the authorization challenge to prevent fraud at scale.
Agentic commerce is shifting toward a "human-led, agent-executed" model where AI agents handle the logistics of shopping and payment, as BetaKit first reported. According to a Mastercard report, more than one in 10 online shoppers are predicted to routinely use these agents by 2030.
However, BetaKit reports that scaling this technology requires solving a complex trust and identity gap. For a transaction to be secure, the agent must follow the buyer's specific guardrails—such as budget and location—while the seller and financial institutions must verify that the agent is legitimate and acting with authorized permission in real time.
To test this, Mastercard partnered with credit card issuer Rogers Bank and AI company Flybits this fall to complete the first Canadian transaction using Mastercard's Agent Pay service. Amisha Parikh, vice-president of security solutions at Mastercard, Canada, told BetaKit that the trial successfully verified the agent's legitimacy and ensured the transaction amount matched the consumer's authorized intent.
Without these safeguards, operators face significant risks. Parikh noted that agents are susceptible to "prompt injection" attacks, where bad actors redirect an agent's instructions, or scams from fraudulent merchants. To combat this, Mastercard is utilizing its Agent Pay Trust Framework to analyze identity, behavioral patterns, and customer intent. Parikh emphasized that evolving fraud controls must be able to distinguish legitimate AI agents from malicious bots to maintain accountability and security.