Mastercard bets future payments run through AI agents instead of people

Mastercard unveiled Agent Pay today, payment infrastructure built on the premise that artificial intelligence agents will execute transactions on behalf of humans rather than humans clicking "buy" buttons themselves. The system establishes security protocols, trust mechanisms, and verification frameworks addressing what happens when software rather than people initiates financial commitments.

The announcement coincided with Google's launch of the Universal Commerce Protocol, disclosed today during the National Retail Federation's annual conference. Mastercard is collaborating with Google on technical standards enabling AI agents to discover products, negotiate checkout parameters, and complete purchases without requiring custom integrations for each merchant platform.

"Open, interoperable protocols are the spark for agentic commerce," according to Pablo Fourez, chief digital officer at Mastercard, in materials distributed today. "As this ecosystem evolves, Mastercard is leaning in with the industry to advance protocols that embed trust, security, and responsibility from day one."

That philosophy reflects Mastercard's assessment that autonomous commerce requires infrastructure enabling any AI agent to transact with any merchant rather than walled gardens where platforms control both agents and transactions. OpenAI reached 800 million active users between February and April 2025, with adoption doubling in weeks according to company statements. Adobe Analytics documented traffic to US retail websites from generative AI sources jumping 1,200 percent during the first quarter of 2025. These numbers suggest commerce is shifting whether payment networks prepare infrastructure or not.

Four principles underpin Mastercard's infrastructure bet

Mastercard built Agent Pay around assumptions about what breaks when software replaces humans in transaction flows. The architecture addresses four specific failure points: unverified agents executing fraudulent purchases, incompatible technical standards fragmenting merchant access, ambiguous transaction intent creating disputes, and unauthorized payments proceeding without consumer approval.

Agent registration tackles the identity problem. Current payment systems verify cardholders through credentials like CVV codes and billing addresses. When AI agents shop, who gets verified? Agent Pay requires agents themselves to register with Mastercard's network using cryptographic tokens proving their legitimacy. Only verified agents can initiate transactions, with network tokens creating audit trails showing which agent executed which purchase.

"Only registered agents can transact—governed and traceable with Mastercard network tokens—setting new standards for trust and accountability," according to product documentation published today on Mastercard's website.

Interface standardization addresses fragmentation where each AI agent developer builds custom integrations with each merchant platform. Building an agent to shop across Target, Walmart, and Best Buy currently requires three separate integration projects. Mastercard is establishing what it characterizes as a "universal data exchange protocol" enabling agents to communicate with any merchant supporting those standards without custom development work.

Order intent verification confronts a problem that sounds abstract until money moves without permission. Payment systems assume clicking "buy" means authorization. What does it mean when an AI agent places an order? Did the consumer actually want that specific product, or did the agent misinterpret instructions? If someone tells an agent to "buy healthy snacks" and it purchases kale chips instead of trail mix, who determines whether the agent followed directions?

"We're creating a future where user intent isn't assumed—it's verified, consented, and central to every transaction," according to Mastercard materials published today.

Consumer consent closes the loop. Mastercard integrates biometric authentication requiring explicit authorization before agents execute purchases. The system positions consumer approval as mandatory rather than optional, preventing scenarios where agents spend money without checking whether humans actually wanted those transactions to proceed.

Google partnership extends Mastercard principles into open standards

Google's Universal Commerce Protocol provides technical specifications for the commerce workflows that Agent Pay secures. Where UCP defines how agents discover products and negotiate checkout parameters, Agent Pay determines whether those transactions actually proceed with legitimate authorization from real consumers.

"By working with Google and industry partners to extend the foundational principles of Mastercard Agent Pay into these protocols, Mastercard is helping the industry to deliver on the promise of AI-powered commerce for consumers, merchants, and issuers," Fourez stated in today's announcement.

Google developed UCP with major retailers including Shopify, Etsy, Wayfair, Target, and Walmart, releasing technical specifications today. More than 20 additional companies endorsed the protocol including payment networks Visa and Mastercard, payment processors Adyen and Stripe, and merchants Best Buy, Flipkart, Macy's Inc., The Home Depot, and Zalando. This coalition suggests industry consensus that open protocols rather than proprietary platforms will define autonomous commerce infrastructure.

"The future of agentic commerce is open and collaborative," according to Ashish Gupta, VP/GM Merchant Shopping at Google, in materials distributed today. "We're proud to work across the industry with partners like Mastercard to ensure the Universal Commerce Protocol makes retail seamless and helpful for the entire ecosystem."

The collaboration specifically addresses Agent Payments Protocol integration and Verifiable Credentials implementation within UCP. These technical elements establish cryptographic signatures proving transaction authorization came from legitimate users rather than compromised systems. Payment processors verify signatures before moving money, creating accountability chains when disputes arise about whether agents operated within authorized scope.

Why Mastercard needs other companies to adopt its vision

Agent Pay only matters if merchants, payment processors, AI platforms, and consumers actually use it. Mastercard emphasizes that the infrastructure works across existing payment networks without requiring merchants to implement new technical integration. The company characterizes this compatibility as removing friction from adoption.

The infrastructure addresses both consumer purchases and business transactions. While initial deployment targets consumer e-commerce, the architecture accommodates enterprise procurement where AI agents might manage supplier relationships and negotiate pricing without requiring human approval for routine purchases below certain thresholds.

"Built for trust, engineered for scale," according to Mastercard marketing materials published today. "Works seamlessly across existing payment networks—no friction, just instant global scalability."

Mastercard positions Agent Pay alongside its existing AI infrastructure including Decision Intelligence for fraud detection, tokenization for secure payments, Dynamic Yield for personalization, Brighterion for machine learning, and Open Finance for account aggregation. The company processes billions of transactions while applying artificial intelligence to fraud prevention and risk assessment. Agent Pay extends these capabilities to scenarios where software initiates transactions rather than humans.

Competing visions for who controls autonomous shopping

Today's announcement positions Mastercard and Google against platforms pursuing closed ecosystems where they control both AI agents and transactions. Amazon deployed its own agentic AI capabilities across its shopping platform in November 2025, reporting 250 million users for its Rufus conversational shopping assistant. Amazon simultaneously blocked competing AI agents from accessing its marketplace, implementing technical restrictions against OpenAI, Anthropic, Meta, and other platforms.

The divergent strategies reflect incompatible business models. Amazon protects $56 billion in annual advertising revenue by preventing third-party agents from helping consumers discover products outside Amazon's controlled channels. Mastercard and Google pursue open protocols where they provide infrastructure capturing transaction fees and advertising revenue without requiring exclusive relationships.

OpenAI launched instant checkout capabilities with Stripe on September 29, 2025, introducing the Agentic Commerce Protocol for AI-mediated transactions. Google simultaneously announced checkout functionality for its AI Mode and Gemini app in November 2025. These moves preceded today's more comprehensive infrastructure announcements establishing broader industry standards.

Payment infrastructure development accelerated throughout 2025. Cloudflare announced partnerships with Visa and Mastercard in October 2025 developing security protocols for AI agents. Multiple industry groups launched standards initiatives including the Ad Context Protocol for advertising automation in October 2025 and the IAB Tech Lab's Agentic RTB Framework for programmatic advertising in November 2025.

How tokenization extends from cards to AI agents

Agent Pay operates within Mastercard's existing network infrastructure rather than building parallel systems. The architecture extends network tokens that already secure millions of daily transactions across e-commerce, mobile payments, and digital wallets.

Network tokens function as aliases for payment credentials. When consumers store payment information with merchants or digital wallets, tokenization substitutes a unique identifier for the actual card number. This identifier works only within specific contexts—a particular merchant, payment channel, or transaction type. If tokens are stolen, they're worthless because they don't reveal real card numbers and can't be used outside their authorized context.

Extending this to AI agents means tokens can track which agent initiated which transaction. When an agent attempts a purchase, the authorization request includes the agent's cryptographic token alongside the payment token. Mastercard can verify the agent's legitimacy and revoke access if agents behave suspiciously. The system maintains audit trails showing which agent executed which purchase on behalf of which consumer.

Interface standardization solves practical scaling problems. Without common protocols, each AI agent developer builds custom integrations with each merchant platform. An agent designed for shopping across Target, Walmart, and Best Buy requires three separate integration projects, each maintained independently as merchants update their systems.

Universal protocols eliminate redundant work. Agents implement standard specifications once, then interact with any merchant supporting those standards. Merchants implement protocols once, then serve any compliant agent. This mirrors how web browsers and websites interact through HTTP standards rather than custom protocols for each browser-site combination.

Numbers show demand exists even if infrastructure lags

Mastercard cites substantial consumer momentum toward AI-assisted commerce in materials supporting Agent Pay's launch. According to PYMNTS Intelligence data, 39 percent of US consumers have used generative AI for online shopping, with 53 percent planning to do so during 2025. These percentages translate to tens of millions of people already experimenting with AI agents for product discovery even before payment infrastructure handles the actual transactions.

Adobe Analytics tracking showed generative AI sources driving traffic to US retail websites jumped 1,200 percent during the first quarter of 2025 compared to previous periods. That growth reflects consumers discovering products through conversational interfaces rather than traditional search engines or direct merchant navigation. The traffic arrives whether merchants built agent-friendly infrastructure or not.

OpenAI's user growth demonstrates scale. The company reached 800 million active users by April 2025, doubling from 400 million just weeks earlier in February. For context, Amazon took years to reach similar user numbers. When platforms acquire hundreds of millions of users within months, commerce infrastructure either adapts or gets bypassed.

Industry analysts project substantial revenue. PYMNTS Intelligence estimates agentic AI will handle up to 20 percent of e-commerce tasks during 2025. McKinsey research released in November 2025 projected agentic commerce could orchestrate between $900 billion and $1 trillion in US B2C retail revenue by 2030, with global projections reaching $3 trillion to $5 trillion.

These projections assume successful resolution of trust, security, and liability challenges that Agent Pay aims to address. Without reliable authentication, fraud prevention, and dispute resolution mechanisms, merchants resist allowing autonomous agents to transact on their platforms regardless of consumer demand.

Merchant and issuer benefits

Mastercard emphasizes Agent Pay's value for merchants and card issuers alongside consumer benefits. The infrastructure enables merchants to reach customers through AI agent channels without implementing separate payment systems or security protocols.

Merchants accepting Mastercard payments can support agent-initiated transactions through existing acquiring relationships. Agent Pay operates within current payment flows, processing transactions through established merchant services providers rather than requiring new technical infrastructure or business relationships.

Issuers gain visibility into agent-initiated transactions through network tokens and enhanced authorization data. When an AI agent attempts a purchase, the authorization request includes information identifying the agent, the consumer who authorized it, and the specific intent being executed. This visibility enables issuers to apply appropriate fraud controls and risk assessment.

The system also addresses liability concerns when disputes arise. If a consumer claims an AI agent executed an unauthorized transaction, Agent Pay's audit trails document the authorization chain, agent identity, and consumer consent at the time of purchase. This information helps resolve disputes by establishing whether agents operated within their authorized scope.

Privacy and data governance considerations

Agent Pay's architecture requires balancing transaction visibility with consumer privacy protections. The system must verify agent authorization and consumer consent while limiting unnecessary data exposure to network participants.

Mastercard positions Verifiable Credentials as central to its privacy approach. These cryptographic credentials enable agents to prove authorization without revealing underlying consumer data to merchants or other parties. A consumer might grant an agent permission to purchase groceries up to $100 weekly, with the agent proving this authorization to grocery merchants without sharing the consumer's identity, purchase history, or other transactions.

The universal data exchange protocol includes specifications for minimal data sharing. Agents request only information necessary to complete specific transactions rather than comprehensive consumer profiles. Merchants receive purchase details required for fulfillment without accessing broader consumer behavior data the agent might hold.

This approach contrasts with traditional e-commerce where merchants often collect extensive consumer information during checkout processes. Agent-mediated commerce shifts data custody toward agents and payment networks while limiting merchant access to individual transactions.

Implementation timeline and adoption expectations

Mastercard provided limited specifics about Agent Pay deployment timelines beyond the January 11 announcement date. The company characterized the infrastructure as available for merchant and issuer implementation, with UCP collaboration continuing to evolve.

"UCP and Agent Pay will collaborate over time and help agentic commerce evolve in a high trust environment for merchants and issuers," according to Mastercard's January 11 statement.

The phrase "collaborate over time" suggests ongoing development rather than immediate production deployment. Payment infrastructure typically requires extensive testing, regulatory review, and gradual rollout across merchant populations before reaching full scale.

Google's UCP announcement included similar phasing. The protocol specifications were published January 11, enabling developers to begin implementation work. However, production adoption across major merchants and AI platforms likely requires months of integration work, security audits, and operational preparation.

Industry observers expect uneven adoption across markets. US merchants may implement agentic commerce infrastructure faster than European counterparts due to regulatory differences. Strong Customer Authentication requirements in Europe add complexity to AI agent authorization flows, potentially slowing deployment.

Markets like Germany and Japan where traditional payment methods remain dominant may see slower adoption than markets where digital payments already constitute the majority of transactions. Cultural factors including trust in AI systems and comfort with automated financial decisions will influence consumer uptake independent of technical infrastructure availability.

Regulatory and compliance considerations

Mastercard's announcement did not detail specific regulatory compliance approaches for Agent Pay beyond emphasizing trust and responsibility. However, agentic commerce raises novel regulatory questions across multiple jurisdictions.

Payment card network rules were written assuming human cardholders authorize transactions. When AI agents execute purchases, questions emerge about who bears responsibility when transactions violate network rules. Is it the consumer who configured the agent, the developer who built the agent software, or the platform hosting the agent?

Consumer protection regulations similarly assume humans make purchasing decisions. Laws governing unauthorized transactions, billing disputes, and merchant refund obligations may require interpretation or amendment when AI agents mediate commerce.

Data protection frameworks including GDPR establish requirements for lawful data processing. When agents collect consumer information, make inferences about preferences, and execute transactions, questions arise about which entities qualify as data controllers, what constitutes valid consent, and how data subject rights apply.

Financial services regulations governing payment systems, anti-money laundering controls, and sanctions screening were designed for human-initiated transactions. Applying these frameworks to autonomous agents requires determining whether agents qualify as payment instruments, whether they must implement know-your-customer procedures, and how they should handle transactions involving sanctioned parties.

Mastercard's emphasis on verified agent registration, consumer consent, and transaction audit trails suggests anticipation of regulatory requirements in these areas. The company likely engaged with regulators during Agent Pay development to ensure infrastructure aligns with existing frameworks or positions Mastercard to adapt as regulations evolve.

Competitive positioning and strategic implications

Agent Pay positions Mastercard as infrastructure provider for agentic commerce rather than operator of agent platforms or merchant channels. This strategy aligns with Mastercard's traditional role in payment networks while extending capabilities into autonomous commerce.

The approach contrasts with vertically integrated competitors who control agent platforms, payment processing, and merchant relationships simultaneously. Amazon operates its own marketplace, payment system, and emerging Rufus AI shopping assistant. This integration enables Amazon to optimize the full commerce experience but limits interoperability with competing platforms.

Mastercard's open protocol approach potentially creates larger addressable markets by enabling any agent to transact with any merchant. If Agent Pay becomes the dominant standard for AI-mediated payments, Mastercard captures transaction volume from diverse agent platforms rather than depending on adoption of Mastercard-operated services.

However, open protocols also introduce risks. If competing standards emerge and fragment the market, Mastercard may invest significant resources building infrastructure that achieves limited adoption. Proprietary systems controlled by dominant platforms might capture transaction volume despite offering less interoperability.

The strategy reflects lessons from payment network competition. Open card network standards enabled Visa and Mastercard to process transactions across thousands of issuers and millions of merchants globally. Closed-loop systems like American Express achieved smaller scale despite controlling issuing, acquiring, and network functions.

Whether similar dynamics apply to agentic commerce remains uncertain. Network effects in AI agent platforms differ from traditional payment networks. Consumer switching costs, data portability, and platform lock-in effects will influence whether open protocols enable market growth or fragment adoption across incompatible systems.

Technical challenges and open questions

Agent Pay addresses several technical challenges in autonomous commerce while leaving others unresolved. The infrastructure establishes agent registration, intent verification, and consumer consent mechanisms. However, practical implementation will reveal additional complexity.

Agent authentication must balance security with usability. Rigorous verification prevents fraudulent agents from accessing payment networks but increases integration complexity for legitimate developers. Mastercard must determine appropriate trust levels for agent registration without creating barriers that prevent innovative applications from emerging.

Intent verification faces definitional challenges. When consumers grant agents permission to "buy healthy snacks," what constitutes faithful execution of that intent? Different agents might interpret the instruction differently based on their understanding of health, snacks, and consumer preferences. Determining whether agents acted within scope requires subjective judgment that payment systems traditionally avoid.

Consumer consent mechanics require user interface design decisions. How often should agents request authorization? Should they confirm every transaction individually, operate under standing instructions, or use intermediate approaches where consumers set spending limits and product categories? The balance between convenience and control will shape consumer adoption.

Transaction dispute resolution presents novel challenges. When consumers claim unauthorized transactions, current systems investigate whether cardholders actually initiated purchases. With AI agents, disputes might involve whether agents correctly interpreted instructions, whether authorization scopes were reasonable, or whether agents malfunctioned. These questions require technical investigation beyond traditional fraud detection.

Liability allocation remains ambiguous. If an agent purchases prohibited items, executes transactions exceeding authorization limits, or otherwise violates network rules, who bears financial responsibility? Mastercard's materials emphasize accountability through audit trails but don't specify contractual obligations for consumers, developers, or platforms when agents misbehave.

Broader implications for digital commerce

Agent Pay's launch signals fundamental shifts in commerce infrastructure development. Payment networks traditionally evolved incrementally, adding capabilities like contactless payments or mobile wallets while maintaining backward compatibility. Agentic commerce requires more substantial architectural changes.

The shift from human-initiated to agent-initiated transactions affects every commerce system layer. Product catalogs designed for human browsing must become machine-readable for agent discovery. Checkout flows optimized for human interaction must support agent-negotiated parameters. Order management systems must distinguish between consumer-direct and agent-mediated purchases for customer service and fulfillment.

Advertising and marketing require reimagining when AI agents mediate product discovery. Traditional strategies target human attention through visual design, emotional appeals, and brand recognition. Agents likely evaluate products algorithmically based on specifications, reviews, and pricing rather than responding to creative advertising.

Google's simultaneous announcement of Direct Offers advertising format demonstrates platform responses to this shift. The format delivers product advertisements directly to AI agents during research phases, positioning merchants to influence agent recommendations before consumers see curated options.

Merchant strategies may fragment between agent-friendly and human-focused approaches. Some retailers might optimize for agent discovery through structured data, API access, and algorithmic pricing. Others might emphasize human shopping experiences through physical retail, personalized service, or experiential commerce that agents cannot replicate.

The infrastructure development also creates strategic choices for technology platforms. OpenAI, Google, Amazon, and others must decide whether to support open protocols like Agent Pay and UCP or build proprietary systems. Open protocols potentially accelerate adoption by reducing integration work but limit platform differentiation and control.

What matters more than the technology

Mastercard's Agent Pay infrastructure and collaboration with Google on Universal Commerce Protocol establish technical foundations for autonomous AI commerce. The systems address authentication, authorization, and verification challenges that would otherwise prevent AI agents from executing reliable financial transactions.

Whether these protocols achieve widespread adoption depends on factors beyond technical capability. Merchants must see value in supporting agent-initiated transactions rather than protecting direct customer relationships. Consumers must trust AI agents to make appropriate purchasing decisions rather than maintaining control over every click. Regulatory frameworks must accommodate autonomous commerce while protecting consumers and preventing fraud. Payment networks must resolve liability questions when disputes arise about whether agents operated within their authorized scope.

Today's announcements position Mastercard and Google as infrastructure providers for an open agentic commerce ecosystem. This strategy contrasts with vertically integrated approaches where platforms control agents, transactions, and merchant relationships simultaneously. The coming months will reveal whether open protocols enable larger markets than proprietary systems or whether dominant platforms capture transaction volume through closed ecosystems that consumers prefer because they work better even if they limit choice.

For marketing professionals and payment industry participants, Agent Pay represents infrastructure responding to commerce patterns already emerging. Consumers increasingly use AI for product discovery and purchase decisions. The question facing merchants isn't whether agentic commerce will exist but which infrastructure will support it, how quickly adoption will occur, and whether their businesses benefit from the transition or get disrupted by it. Mastercard's bet on open, interoperable protocols reflects a strategic judgment that collaborative standards will define autonomous commerce just as they defined traditional payment networks. Amazon's opposite bet on closed ecosystems suggests the industry hasn't reached consensus about which approach wins.

Timeline

• September 29, 2025: OpenAI launches instant checkout with Stripe, introducing Agentic Commerce Protocol for AI-mediated transactions
• October 24, 2025: Cloudflare announces partnerships with Visa and Mastercard for Agent Payments Protocol security development
• November 13, 2025: Google launches agentic checkout and AI shopping tools for holiday season
• November 18, 2025: Amazon deploys generative and agentic AI across shopping platform with 250 million Rufus users
• Today: Mastercard introduces Agent Pay infrastructure at National Retail Federation conference
• Today: Google launches Universal Commerce Protocol with major retail partners including Shopify, Etsy, Wayfair, Target, and Walmart
• Today: Mastercard announces collaboration with Google on Universal Commerce Protocol, extending Agent Pay principles into open standards

Summary

Who: Mastercard, a global payment network processing billions of transactions annually, introduced Agent Pay infrastructure in collaboration with Google and major retail partners. Pablo Fourez, chief digital officer at Mastercard, led the announcement alongside Google's Ashish Gupta, VP/GM Merchant Shopping. Partner companies include Shopify, Etsy, Wayfair, Target, Walmart, Visa, Stripe, Adyen, American Express, Best Buy, Flipkart, Macy's Inc., The Home Depot, and Zalando.

What: Agent Pay establishes payment infrastructure enabling AI agents to execute autonomous purchases through four foundational principles: agent registration and identification using network tokens, interface standardization through universal data exchange protocols, order intent verification ensuring transactions reflect consumer preferences, and consumer consent management integrating biometric authentication. The system operates within Mastercard's existing network infrastructure while extending capabilities to autonomous commerce. Mastercard simultaneously announced collaboration with Google on the Universal Commerce Protocol, aligning Agent Pay's technical foundations with open industry standards for AI-mediated shopping.

When: Mastercard announced Agent Pay today during the National Retail Federation's annual conference. The announcement coincided with Google's launch of the Universal Commerce Protocol, positioning both companies as infrastructure providers for emerging agentic commerce. Prior developments include OpenAI's instant checkout launch in September 2025, Cloudflare's payment security partnerships in October 2025, and Google's agentic checkout features in November 2025.

Where: Agent Pay operates globally across Mastercard's existing payment network infrastructure, supporting transactions in markets where Mastercard processes payments. The system works across digital commerce channels without requiring geographic limitations. However, adoption patterns will likely vary across regions due to regulatory differences, payment method preferences, and consumer trust in AI systems. US markets may see faster implementation than European markets due to Strong Customer Authentication requirements. Markets like Germany and Japan where traditional payment methods dominate may adopt more slowly than markets where digital payments already constitute transaction majorities.

Why: Agent Pay addresses fundamental security, trust, and verification challenges preventing AI agents from executing reliable financial transactions at scale. Current payment systems assume humans directly authorize purchases by clicking "buy" buttons on trusted websites. When AI agents initiate transactions, questions arise about authorization verification, authenticity confirmation, and liability determination when disputes occur. Adobe Analytics documented traffic to US retail websites from generative AI sources jumping 1,200 percent during the first quarter of 2025. OpenAI reported reaching 800 million active users by April 2025, doubling in weeks. PYMNTS Intelligence projects agentic AI will handle 20 percent of e-commerce tasks during 2025. These adoption patterns create market demand for payment infrastructure supporting autonomous commerce. Mastercard's open protocol approach positions the company as infrastructure provider for diverse agent platforms rather than operating proprietary systems, potentially creating larger addressable markets by enabling any agent to transact with any merchant supporting standardized protocols.