My AI agent bought something I didn't want with my card. Can I dispute the charge, and what do I need to win?

What should I check, step by step?

1. Stop further charges first. Remove the card from the agent or its platform, and tell your card issuer that purchases by that agent are no longer authorized. Both regulations' commentary make that notice the point after which an authorized user's charges can count as unauthorized.

2. Contact the merchant and ask for a return or refund. It's often fastest, and some protections require it: Regulation Z's claims-and-defenses right needs a good-faith attempt to resolve the dispute with the merchant, and Amex says its agent protection applies only after you've started a return where possible.
3. Decide which kind of dispute you have. An item that never arrived or wasn't what was agreed is a billing error. A legitimate agent following a bad or vague instruction usually isn't fraud. A compromised agent, or a criminal's agent using a stolen card, can be unauthorized use.
4. For a credit card billing error, send written notice that your issuer receives within 60 days after it sent the first statement showing the charge, at the address or electronic channel it lists for billing errors. A phone call alone may not trigger the investigation rules.
5. For a debit card, report errors within 60 days of the statement, and report a lost or stolen card or credential within 2 business days of learning of it to keep the $50 liability tier instead of $500.
6. Gather the evidence of what you authorized: your exact instruction, the spending limits and allowed merchants you set, any approval you gave for this order, the order confirmation, and the merchant's terms at checkout.
7. If the platform running the agent made the error, check its terms. The Goodwin analysis (June 2026) notes that disputes between a user and the agent platform fall to contract and common-law principles, decided case by case on what the user said and what records exist.
8. Next time, set limits before the agent shops: per-purchase and daily caps, allowed merchants, and a human approval bound to the exact merchant, amount and items for anything above a threshold.

Is a purchase my AI agent made with my card treated as unauthorized use or fraud?

Regulation Z defines unauthorized use of a credit card as use by someone other than the cardholder who has no actual, implied or apparent authority, and from which the cardholder gets no benefit; liability for that is capped at $50. Its official commentary gives the case that matters here: if you give your card and authority to someone, such as a family member or coworker, who goes beyond the authority given, you're liable for those charges unless you've told the issuer that person's use is no longer authorized. Whether authority existed is decided under state or other applicable law.

• Regulation E says the same for debit cards and other access devices. Its commentary says that if a consumer furnishes an access device and grants authority to someone who exceeds it, the consumer is fully liable until the institution is told those transfers are no longer authorized. Commentators reading these rules for agents agree on the direction. Goodwin's June 2026 alert calls the user-versus-bank side largely settled: a user who hands credentials to a third party, human or AI, is responsible unless they notified a revocation or the institution breached its own security procedures.
• That changes when the agent wasn't yours or wasn't under your control. Regulation Z's commentary says unauthorized use includes a card obtained through fraud or robbery, so a stolen card used by someone else's agent is a different case from your own agent misreading an instruction.

What can I dispute about a purchase my AI agent made, and who pays?

A billing error under 12 CFR 1026.13(a)(3) includes property or services not accepted by you or your designee, or not delivered as agreed. The written notice has to reach the issuer within 60 days after it sent the first statement that shows the charge. Separately, 1026.12(c) lets you raise claims and defenses you have against the merchant with the card issuer, if you tried in good faith to resolve it with the merchant and, for most cards, the charge is over $50 and in your state or within 100 miles of your address (where an internet order happens is decided under state law).

• Who ends up paying is mostly the merchant. OpenAI's Delegated Payment Spec for the Agentic Commerce Protocol says OpenAI is not the merchant of record and that settlement, refunds, chargebacks and compliance remain with the merchant and its payment provider. The same spec makes each delegated payment single-use, with a maximum amount and an expiry, so it's worth checking what limit the agent's checkout actually carried.
• Card networks are adding their own rules. American Express announced Amex Agent Purchase Protection on April 14, 2026. Its terms cover US Amex credit cards, require the agent to be registered with Amex and to send Amex your authenticated purchase intent, cover purchases that deviate from that intent, apply only after you've started a return where possible, and may not apply where the intent was subjective, like "best" or "really nice". The page still says the protection is coming in the future (checked Nov 9, 2026).

What record do I need to dispute an AI agent's purchase?

Every one of these routes turns on the same question: what did you actually authorize, and when? Goodwin recommends capturing authorization in retrievable form, saying a voice prompt or checkbox isn't enough, and adding approval checkpoints for unusual merchants and amounts. Amex's protection turns on purchase intent you authenticated before the purchase.

• A chat log the agent can edit, or a summary it writes afterwards, is weak evidence. Better is a record made at the time, outside the agent: the limits in force, the exact order you approved (merchant, amount, currency, items), and when you approved it. request_human_approval hashes the exact action you're asked to approve and returns an approval id; only the owner's account key can decide it, and the signed, timestamped decision goes on Rightshold's ledger. Later, verify_human_approval shows what was approved and checks whether a given order matches it.