{
  "question": "My AI agent bought something I didn't want with my card. Can I dispute the charge, and what do I need to win?",
  "slug": "can-you-dispute-a-purchase-your-ai-agent-made-with-your-card",
  "url": "https://www.rightshold.com/answers/can-you-dispute-a-purchase-your-ai-agent-made-with-your-card",
  "short_answer": "Usually not as fraud, but you still have options. In the US, the rules for unauthorized charges protect you from people who had no authority to use your card. If you gave an agent your card and it went beyond what you meant, regulators' own examples treat that like a family member who overspends: you're liable until you tell the card issuer that this user is no longer authorized. That's in the official commentary to Regulation Z for credit cards (12 CFR 1026.12(b)) and Regulation E for debit cards (12 CFR 1005.2(m)). What's left is the merchant and the billing-error process. Ask the merchant for a refund first. If the item wasn't delivered as agreed or you didn't accept it, a credit card billing-error notice in writing within 60 days of the first statement showing the charge starts a required investigation (12 CFR 1026.13). OpenAI's agentic checkout spec says OpenAI isn't the merchant of record and refunds and chargebacks stay with the merchant. American Express announced on April 14, 2026 that it will cover some errors made by registered agents, with conditions, but its page still describes that as coming in the future. Either way, you'll need a record of exactly what you told the agent it could buy, made before the purchase. This isn't legal advice; whether an agent had authority is decided under state law.",
  "checklist": [
    "Stop further charges first. Remove the card from the agent or its platform, and tell your card issuer that purchases by that agent are no longer authorized. Both regulations' commentary make that notice the point after which an authorized user's charges can count as unauthorized.",
    "Contact the merchant and ask for a return or refund. It's often fastest, and some protections require it: Regulation Z's claims-and-defenses right needs a good-faith attempt to resolve the dispute with the merchant, and Amex says its agent protection applies only after you've started a return where possible.",
    "Decide which kind of dispute you have. An item that never arrived or wasn't what was agreed is a billing error. A legitimate agent following a bad or vague instruction usually isn't fraud. A compromised agent, or a criminal's agent using a stolen card, can be unauthorized use.",
    "For a credit card billing error, send written notice that your issuer receives within 60 days after it sent the first statement showing the charge, at the address or electronic channel it lists for billing errors. A phone call alone may not trigger the investigation rules.",
    "For a debit card, report errors within 60 days of the statement, and report a lost or stolen card or credential within 2 business days of learning of it to keep the $50 liability tier instead of $500.",
    "Gather the evidence of what you authorized: your exact instruction, the spending limits and allowed merchants you set, any approval you gave for this order, the order confirmation, and the merchant's terms at checkout.",
    "If the platform running the agent made the error, check its terms. The Goodwin analysis (June 2026) notes that disputes between a user and the agent platform fall to contract and common-law principles, decided case by case on what the user said and what records exist.",
    "Next time, set limits before the agent shops: per-purchase and daily caps, allowed merchants, and a human approval bound to the exact merchant, amount and items for anything above a threshold."
  ],
  "sections": [
    {
      "heading": "Why it usually isn't treated as fraud",
      "points": [
        "Regulation Z defines unauthorized use of a credit card as use by someone other than the cardholder who has no actual, implied or apparent authority, and from which the cardholder gets no benefit; liability for that is capped at $50. Its official commentary gives the case that matters here: if you give your card and authority to someone, such as a family member or coworker, who goes beyond the authority given, you're liable for those charges unless you've told the issuer that person's use is no longer authorized. Whether authority existed is decided under state or other applicable law.",
        "Regulation E says the same for debit cards and other access devices. Its commentary says that if a consumer furnishes an access device and grants authority to someone who exceeds it, the consumer is fully liable until the institution is told those transfers are no longer authorized. Commentators reading these rules for agents agree on the direction. Goodwin's June 2026 alert calls the user-versus-bank side largely settled: a user who hands credentials to a third party, human or AI, is responsible unless they notified a revocation or the institution breached its own security procedures.",
        "That changes when the agent wasn't yours or wasn't under your control. Regulation Z's commentary says unauthorized use includes a card obtained through fraud or robbery, so a stolen card used by someone else's agent is a different case from your own agent misreading an instruction."
      ]
    },
    {
      "heading": "What you can still dispute",
      "points": [
        "A billing error under 12 CFR 1026.13(a)(3) includes property or services not accepted by you or your designee, or not delivered as agreed. The written notice has to reach the issuer within 60 days after it sent the first statement that shows the charge. Separately, 1026.12(c) lets you raise claims and defenses you have against the merchant with the card issuer, if you tried in good faith to resolve it with the merchant and, for most cards, the charge is over $50 and in your state or within 100 miles of your address (where an internet order happens is decided under state law).",
        "Who ends up paying is mostly the merchant. OpenAI's Delegated Payment Spec for the Agentic Commerce Protocol says OpenAI is not the merchant of record and that settlement, refunds, chargebacks and compliance remain with the merchant and its payment provider. The same spec makes each delegated payment single-use, with a maximum amount and an expiry, so it's worth checking what limit the agent's checkout actually carried.",
        "Card networks are adding their own rules. American Express announced Amex Agent Purchase Protection on April 14, 2026. Its terms cover US Amex credit cards, require the agent to be registered with Amex and to send Amex your authenticated purchase intent, cover purchases that deviate from that intent, apply only after you've started a return where possible, and may not apply where the intent was subjective, like \"best\" or \"really nice\". The page still says the protection is coming in the future (checked Nov 9, 2026)."
      ]
    },
    {
      "heading": "The record that decides it",
      "points": [
        "Every one of these routes turns on the same question: what did you actually authorize, and when? Goodwin recommends capturing authorization in retrievable form, saying a voice prompt or checkbox isn't enough, and adding approval checkpoints for unusual merchants and amounts. Amex's protection turns on purchase intent you authenticated before the purchase.",
        "A chat log the agent can edit, or a summary it writes afterwards, is weak evidence. Better is a record made at the time, outside the agent: the limits in force, the exact order you approved (merchant, amount, currency, items), and when you approved it. request_human_approval hashes the exact action you're asked to approve and returns an approval id; only the owner's account key can decide it, and the signed, timestamped decision goes on Rightshold's ledger. Later, verify_human_approval shows what was approved and checks whether a given order matches it."
      ]
    }
  ],
  "checks": [],
  "ask_rightshold": {
    "start": "https://www.rightshold.com/start?ref=seo",
    "mcp_endpoint": "https://www.rightshold.com/mcp",
    "ask": "Before you buy anything for me, ask me to approve the exact order: merchant, amount, currency and the items, and wait for my yes or no. If it's ever disputed, I want a signed record of what I approved.",
    "mcp_call": {
      "tool": "request_human_approval",
      "arguments": {
        "action": {
          "merchant_domain": "shop.example.com",
          "amount_minor": 8499,
          "currency": "USD",
          "items": [
            "<item and size>"
          ],
          "order_ref": "<cart or order id>"
        },
        "summary": "Agent asks to buy 1 item at shop.example.com for $84.99",
        "credential_id": "crd_YOUR_AGENT_CREDENTIAL",
        "expires_in_minutes": 60
      }
    },
    "also": [
      "The action object is hashed, so the approval covers exactly that merchant, amount and items. verify_human_approval (free) shows the approval's status and receipts and checks whether an order matches what was approved.",
      "Only the owner's account key can decide (decide_human_approval). Delegated agent keys are refused, so the agent can't approve its own purchase.",
      "With an account key, set_spend_policy sets per-purchase and daily caps and allowed merchants, and authorize_spend returns a signed allow or deny for each purchase. Both record decisions only and never move money."
    ],
    "scope": "Rightshold records approval requests, decisions and spending decisions on a hash-chained ledger. It never holds or moves money, isn't a card issuer, merchant or payment network, and doesn't file or decide disputes; a Rightshold record is evidence you can show, and your issuer, the merchant or a court decides. Not legal or financial advice."
  },
  "sources": [
    {
      "title": "CFPB: 12 CFR 1026.12 Special credit card provisions (unauthorized use, $50 limit, comment 12(b)(1)(ii)-3, claims and defenses)",
      "url": "https://www.consumerfinance.gov/rules-policy/regulations/1026/12/"
    },
    {
      "title": "CFPB: 12 CFR 1026.13 Billing error resolution (not accepted or not delivered as agreed; 60-day written notice)",
      "url": "https://www.consumerfinance.gov/rules-policy/regulations/1026/13/"
    },
    {
      "title": "CFPB: 12 CFR 1005.2 Definitions (unauthorized electronic fund transfer; comment 2(m)-2)",
      "url": "https://www.consumerfinance.gov/rules-policy/regulations/1005/2/"
    },
    {
      "title": "CFPB: 12 CFR 1005.6 Liability of consumer for unauthorized transfers ($50 / $500 tiers)",
      "url": "https://www.consumerfinance.gov/rules-policy/regulations/1005/6/"
    },
    {
      "title": "CFPB: 12 CFR 1005.11 Procedures for resolving errors (60 days, 10 business days, 45 days)",
      "url": "https://www.consumerfinance.gov/rules-policy/regulations/1005/11/"
    },
    {
      "title": "OpenAI: Agentic Commerce Delegated Payment Spec (not merchant of record; refunds and chargebacks remain with the merchant)",
      "url": "https://developers.openai.com/commerce/specs/payment"
    },
    {
      "title": "American Express: Agentic Commerce Experiences and Amex Agent Purchase Protection terms (checked Nov 9, 2026)",
      "url": "https://www.americanexpress.com/en-us/company/agentic-commerce/"
    },
    {
      "title": "Goodwin: Authorizing Agentic Payments (June 2026)",
      "url": "https://www.goodwinlaw.com/en/insights/publications/2026/06/insights-technology-aiml-authorizing-agentic-payments"
    }
  ],
  "related": [
    {
      "title": "Requiring human approval before an AI agent spends money",
      "url": "https://www.rightshold.com/answers/how-to-require-human-approval-before-an-ai-agent-spends-money"
    },
    {
      "title": "Requiring quote-bound approval before an agent payment settles",
      "url": "https://www.rightshold.com/answers/how-to-require-quote-bound-approval-before-an-agent-payment-settles"
    },
    {
      "title": "Revoking an AI agent's spend authority mid-task",
      "url": "https://www.rightshold.com/answers/how-to-revoke-an-ai-agents-spend-authority-mid-task-and-freeze-pending-payments"
    },
    {
      "title": "Stopping a prompt injection from making your AI agent buy something",
      "url": "https://www.rightshold.com/answers/how-to-stop-a-prompt-injection-from-making-your-ai-agent-buy-something"
    }
  ],
  "computed_from": "Curated guidance; license verdicts computed from Rightshold's license profiles at render time. Not legal advice.",
  "updated": "2026-11-09"
}