The agent can buy it. Nobody has settled who pays for it.

The forecasts for agent-led spending now come with decimal points. The liability model does not. A new projection puts agent-facilitated consumer spending close to a trillion dollars this year, while the people who actually run fraud and dispute teams cannot agree on who is on the hook when one of those purchases goes wrong. That gap between the volume forecast and the liability answer is the story worth watching.

The forecast finally has a number

Research published this week by Omnicom's PHD with WARC estimates that consumer spending facilitated by AI agents reaches roughly $944bn in 2026, about 1.3% of global consumer spending, rising to $3.35tn by 2030, or 3.8% of the total [1]. Ten markets account for close to 68% of the 2030 figure, with the United States at $1.1tn, China at about $505bn and the UK at $131.2bn [1]. Treat the 2030 number as a directional claim rather than a fact. The 2026 figure is the one that matters operationally, because it describes transactions being written now.

Nobody agrees who pays

Ask the people closest to the problem and there is no settled answer. In a survey of 500 senior fraud and risk professionals across US and UK firms with $30m or more in annual revenue, respondents split on liability for a transaction an AI agent got wrong: 39% put it on the agent provider, 20% on the customer, and only 15% supported a shared model [2]. The same research found 52% of organisations cannot explicitly track or label AI-assisted fraud at all, and only 36% can intervene at any point across the customer journey rather than at isolated checkpoints like login or checkout [2]. You cannot allocate liability for events you are not recording.

The dispute layer was built for humans

Chargebacks911 has been making a narrower version of this argument: the industry is switching on agentic payment programmes without the post-transaction machinery to resolve what comes out of them [3]. Existing chargeback frameworks assume a human made the decision, with intent, authorisation and liability all read back from what a cardholder chose to do. An agent acting on delegated authority set at some earlier point, with no confirmation at the moment of purchase, breaks that assumption [3]. Their recommendation is the practical one: document authorisation at the point of delegation instead of reconstructing it after a dispute, and log agent behaviour continuously across the journey rather than only at checkout [3]. American Express has taken a different route and committed to cover erroneous purchases made by registered agents on its network, which is one way to answer the question while everyone else argues about it [3].

The rails keep shipping regardless

Meanwhile the plumbing gets easier to adopt. Zero Hash and Marqeta announced a partnership on 22 July to put stablecoin balances behind card spending, with Zero Hash handling custody, compliance and liquidity for the onchain leg and Marqeta handling issuance, acceptance and the bank and network relationships [4]. The pitch is that a customer can spend a stablecoin balance at any merchant while the merchant still settles in fiat, and the issuer does not have to rebuild core systems to offer it [5]. That is a genuine reduction in integration cost. It also adds another party to the chain that a disputed agent-initiated purchase will eventually have to travel back through.

Read from the rails

Liability in payments has never really been decided by argument. It gets decided by evidence, and specifically by who can produce a record when the dispute lands. The scheme rules that look like they allocate risk are mostly rules about who has to prove what, and the party that cannot produce the proof absorbs the loss regardless of what anyone thinks is fair. That is why the 52% who cannot label AI-assisted fraud is the more alarming number in that survey than the 39% who want to blame the agent provider.

The delegation record is the artefact that matters. Not the checkout log, the delegation record: what the customer authorised, how wide the mandate was, when it was granted, when it expired, and which agent instance fired under it. Everything downstream can be reconstructed from that. Nothing downstream can be reconstructed without it. Ten years of moving money through operations taught me that reconciliation questions always arrive later than you would like and never in the shape you prepared for, which is the argument for capturing more than you currently need. If you are building an agent checkout this quarter, the useful work is not choosing a protocol. It is making sure that when the first serious dispute comes back, you can show the mandate rather than describe it.

Liability does not follow the argument. It follows the evidence. The party that cannot produce the mandate is the party that pays.