Mastercard's Agentic-Commerce Bet Hangs on One Unanswered Question: Who Absorbs the Loss?

On Thursday, three payment giants who ordinarily guard their own rails did something unusual: Mastercard, Visa, and Ant International agreed to standardize how the industry recognizes an AI agent that has been approved to spend someone else's money. The "Know-Your-Agent" initiative ties Mastercard's Verifiable Intent protocol to Visa's Trusted Agent Protocol and Ant's Agentic Mobile Protocol, so that card networks, wallets, marketplaces, and AI platforms can all identify a legitimate purchasing agent — without any of them surrendering control of their own authorization rules.

The stock's reaction said it all: Mastercard shares slipped a fraction of a percent. This was not a market event. It was a positioning move, and the reason investors are right to be calm is the same reason the initiative is genuinely important — the three companies announced the plumbing but not the painful part. No adoption timetable, no defined revenue model, and no rule for who absorbs the financial loss when an approved agent authorizes the wrong transaction. That last question is the whole ballgame, and it is unanswered.

The "next fraud problem" is a visibility gap

Mastercard's core product is a fee charged on every switched transaction — 47.4 billion of them last quarter, feeding $9.28 billion in revenue. For decades, fraud prevention read human behavior: the tap of a card, the rhythm of keystrokes, the deviceless signal of a person about to hit "buy." AI agents erase that signal. When software shops on a consumer's behalf, the merchant no longer has a human in the room to point at, which Mastercard itself describes as a "visibility gap" at the moment of transaction.

The fraud is real and already moving. Impersonation scams have become one of the fastest-growing gen-AI threats, and Deloitte projects U.S. generative-AI fraud losses to climb from $12.3 billion in 2023 to roughly $40 billion by 2027. Mastercard's own research puts the average organization's yearly payment-fraud losses at $60 million. Against that backdrop, verifying who — or what — authorized a purchase stops being optional.

The mechanism Mastercard is betting on is Verifiable Intent: a cryptographic record that links identity, intent, and action into a single, tamper-resistant authorization trail. Mastercard has open-sourced the specification and is wiring it into Agent Pay, the service that lets AI agents initiate tokenized purchases. A human authorizes the agent once; every autonomous transaction afterward carries proof of that authorization, giving issuers and merchants an audit trail for the disputes that will inevitably follow machine spending. The company's own framing captures the strategic bet: "agentic commerce will only scale at the speed of trust."

A two-sided bet on an engine that already works

This matters for Mastercard's economics on two levels, and the first one is easy to miss. Agentic commerce is not just a fraud problem — it is a potential new source of switched transactions. Every purchase an AI assistant makes on a consumer's behalf is another transaction that can run across Mastercard's network, the same rails that have compounded revenue at roughly 16% a year. If agents scale, Mastercard gets paid simply for being the railroad under machine spending.

The second level is where the trust layer becomes a product. Value-Added Services — the fraud scoring, identity, biometrics, and data subscriptions that sit on top of the network — already account for 41.2% of Mastercard's revenue and grew 20% in the latest quarter, far faster than core payments. Cyber and identity services are the natural home for a paid "approved-agent registry." Mastercard has spent years turning its transaction data into sellable trust products, and agentic commerce is a new workload for exactly that flywheel.

In that light, the pact is a strategic dark-horse move in miniature: rather than fighting Visa and Ant over whose standard wins, Mastercard is joining them to make sure the whole industry recognizes approved agents — writing the rules the way card networks standardized EMV and FIDO before it. Whoever owns the identity-and-intent layer collects a toll on every agent transaction regardless of which wallet or marketplace initiated it.

The liability question is the only number that matters

Here is where the discipline cuts in. A road map creates value only when it reaches revenue, and on the specifics this pact is still a claim, not a result. There is no monetization model disclosed for the initiative, no timetable for adoption, and no clarity on chargebacks — the mechanism by which a disputed purchase gets reversed and someone eats the cost. In traditional card payments, the liability rules took years of industry negotiation to settle. For machine-initiated purchases they are unwritten.

That single unresolved variable separates two very different outcomes. If the industry settles on a rule where the agent platform or the verified-intent record allocates loss fairly, Mastercard's trust layer becomes a durable, high-margin addition to a machine that already converts half its revenue into free cash flow — a call option on the next decade of commerce that the current ~30-times-earnings price has not paid for. If instead the loss lands on whoever verified the agent, an approved-agent registry becomes less a toll booth and more an indemnity obligation, and the fraud-prevention product turns into a fraud-cost liability.

A market selloff on weak news is often a buying opportunity in the AI trade; here the market barely moved because there is nothing to react to yet. The absence of a price reaction is the honest read of the situation: this is free optionality layered on top of a compounding business that did not need it to justify owning it. Mastercard's near-term case is unchanged by Thursday's announcement. What changes would be worth a second look is a disclosed revenue model, a settled chargeback rule, or a visible queue of merchants and platforms actually routing agent purchases through Verifiable Intent. Until one of those lands, the right judgment is straightforward: admire the architecture, note the unanswered liability question, and let the numbers do the talking.