AI Agents Can Spend Your Money Wrong — Your Card Type Decides Who Pays

AI agents embedded in browsers and apps can now make purchases on behalf of users, but existing consumer protection laws were not written with autonomous software in mind. In the US, debit transactions fall under Regulation E, which hinges on whether a transfer was 'authorized' — a question that remains legally unresolved when an AI acts outside a user's precise intent. Credit cards, governed by the Truth in Lending Act and Regulation Z, offer broader protections, including a dispute right for goods not accepted or not delivered as agreed, without requiring proof of fraud. As of mid-2026, regulators have not issued clear guidance on AI-driven transaction disputes, despite industry calls for clarity from groups like the Consumer Bankers Association. In most erroneous agent-purchase cases, financial liability ultimately falls on the merchant, making accurate transaction record-keeping increasingly important for sellers.