Bank of America and five other banks warn of fraud in AI shopping agents, as Amazon blocks Meta

By Zendoric · September 23, 2026.

Bank of America has joined Capital One, NatWest Group, ING Group, ASB Bank and Commonwealth Bank of Australia in publishing a set of security principles aimed at AI shopping agents, according to the document released by the six institutions. The core warning: the more control you give an AI assistant over your money, the greater the damage if that assistant ends up hijacked, impersonated or manipulated by a scammer.

So-called "shopping agents" are already a real product, not a lab experiment. ChatGPT's Instant Checkout allows purchases from more than a million Shopify and Etsy stores without leaving the chat, though it requires confirming the order and the payment before closing the sale. Google Shopping's agentic checkout goes a step further: it can execute the purchase automatically as soon as a product hits the price you set, using Google Pay, although the company insists it always asks permission before charging. Muse, Meta's shopping agent that crawls the entire web looking for products, did not offer that same transparency: Amazon blocked it from its platform this very week, alleging, as the company itself explained, that the agent never identified itself as AI, accessed customer accounts without authorization and stored their login credentials.

That case is, in fact, the best summary of the problem the banks describe. It is not that AI shops badly; it is that it shops with an authority no one has fully delimited, audited or been able to revoke with any guarantees. The joint report notes that some of these bots type the card number directly into the payment screen instead of using safer methods that hide the real number, so that a breach in the bot exposes the full card. And they add a deeper problem: when something goes wrong, the bank often cannot tell which agent made the purchase, what exactly it was asked to do, or whether the final order matches the user's intent. Without that traceability, detecting fraud in time —or refunding the money— becomes much harder.

The data confirm that the distrust is not gratuitous paranoia. According to a Harris Poll survey commissioned by Visa in May, 72% of consumers have already used some AI assistant, but only 23% would trust one to handle a payment autonomously, without supervision. And a Credit One Bank survey published this month found that more than two in five Americans have already run into an AI-driven scam, or come close to falling for one.

Our reading is that this episode fits a pattern we have been observing across this year's entire wave of agentic AI: the ability to act in the real world is growing faster than the trust infrastructure that should underpin it. It does not take a superintelligent AI for this to go wrong; it is enough to hand an agent your credit card before a shared standard exists to identify, authenticate and audit it. It is the same mismatch we already see in offensive cybersecurity: the attacker acts within hours and autonomously, while the defense is still organizing itself document by document, principle by principle.

What is interesting is that the banks' response does not call for banning agents, but for requiring of them the same rails that already exist for the rest of digital payments: tokenization instead of card numbers in the clear, explicit user confirmation before every significant purchase, and a clear record of which agent acted and on what instruction. That is exactly what separates ChatGPT and Google Shopping, which ask for confirmation, from the Muse case, which Amazon describes as opaque from the outset. The underlying technology is similar; what changes is whether the design forces the human to sign off on every expense.

That, in our view, is where the real long-term bet lies. Truly autonomous commerce —where an agent compares, negotiates and buys for you without your having to look at every screen— is exactly the kind of everyday friction AI ought to take off our hands, freeing up time for what really matters. But that promise is only fulfilled if the boring part is settled first: who answers when something goes wrong, how the power of a compromised agent is revoked, and how to prove what the user actually asked for. In the meantime, the practical advice is already available today: insist that your agent ask for confirmation before paying, use a virtual card number if your bank offers one —Capital One, Citi and Google Pay with participating banks already allow it— and always check who you are buying from, especially on marketplaces like Amazon, where the actual seller may not be the platform.