--- title: "When the First Agent Purchase Gets Disputed" canonical: "https://current.tinyfish.ai/issue/39/market-pulse/article/32330/when-the-first-agent-purchase-gets-disputed" publication: "TinyFish" publisher: "TinyFish" language: "en-US" guide: "https://current.tinyfish.ai/llms.txt" author: "Sevda Polat" author_url: "https://current.tinyfish.ai/team/200" issue: 39 section: "market-pulse" section_name: "Market Pulse" published: 2026-07-23 word_count: 374 source_links: 2 --- # When the First Agent Purchase Gets Disputed *By [Sevda Polat]()* *July 23, 2026* [Read on the website]() Visa's July 2 announcement wasn't a pilot. AI agents [completed purchases](https://www.visa.co.uk/about-visa/newsroom/press-releases.3457328.html) with independent European merchants, authenticated by Payment Passkeys, recognized through a Trusted Agent Protocol and Agent Directory. Over 30 issuers. Four merchants spanning travel, retail, and e-commerce. Live transactions, not controlled demos. So the infrastructure for making agent purchases is arriving faster than the infrastructure for contesting them. Today's chargeback process asks a binary question: did the cardholder authorize this transaction? Agentic commerce produces a harder case. The account was valid. The spending limit held. The merchant processed correctly. But the agent booked the wrong flight, interpreting "under $500 at travel merchants" in a way the user didn't intend. Both ends of the transaction look right, and something in the middle went wrong. Resolving that requires evidence the dispute system doesn't yet collect: what the user actually asked for, how the agent interpreted the constraints, why it chose this option over that one. Visa's rules already require "cardholder-defined payment instructions" and 120-day order confirmation retention. Those preserve what was processed. They don't preserve the reasoning that got there. No public agent-specific dispute code exists in either major network's current guides. Lastminute.com's CEO called it "[early days](https://www.visa.co.uk/about-visa/newsroom/press-releases.3457328.html)." He's right, and the specifics of what comes next matter enormously. The mandate, the constraint interpretation, the decision trace: these are where contestability stops being an abstract design principle and starts costing someone real money. **What's live:** 30+ European issuers (including Barclays, BBVA, ING, Revolut, Klarna, Lloyds) transacting with lastminute.com, Frasers, Cleverbridge, and BrickDepot **Authentication:** Visa Payment Passkeys meeting EU Strong Customer Authentication requirements **Agent identity:** Trusted Agent Protocol + Agent Directory give merchants a consistent signal to distinguish verified AI agents from unverified traffic **User controls (via [OpenAI partnership](https://visa.gcs-web.com/news-releases/news-release-details/visa-partners-openai-power-next-generation-ai-commerce)):** Spending limits, merchant categories, required approvals, tokenized credentials, real-time fraud monitoring **What Visa's rules require:** Defined payment instructions, identity verification, cardholder responsibility acknowledgment, 120-day order confirmation retention **What's missing from public dispute guides:** - No agent-specific reason code (Visa or Mastercard) - No mandate-content field in dispute files - No constraint-interpretation evidence category - No decision-trace representment standard **The liability clause to watch:** Visa's rules state the cardholder is responsible for agent actions "as if the cardholder initiated the transaction," while simultaneously requiring defined instructions and controls ## More - [Market Pulse — Issue 39]() - [Issue 39]() - [Publication guide]()