The banks have looked at the future of retail, an AI agent that roams the web with your card details and buys things on your behalf, and collectively decided they would rather you didn’t.
This week a run of major lenders, Bank of America, Capital One and NatWest among them, warned that AI shopping agents are moving faster than the fraud protections meant to catch them. Their worry is that you are about to hand your money to a bot that might (probably will) buy the wrong thing, overspend, or fall for the next gen of scams targeting those AI shopper bots explicitly (e.g. prompt injection etc). The safeguards the banks built to stop those kinda shenanigans were designed for humans clicking buttons, not for autonomous software going on a shopping spree at 3am. Thankfully, the way things are going lately, you probably won’t have much money to lose anyway, soon enough.
This is already happening, by the way, it’s not some far-off hypothetical.
British retailer John Lewis said shopping searches coming from AI agents jumped to 2.5% of its total, up from 0.3% a year earlier, an eightfold rise with the curve still bending upward. So the banks are not flagging a distant risk. And apparently, nobody has bothered to consider who eats the loss when an agent buys something you never wanted, or gets fleeced by a fake storefront; you, the bank, or the company whose bot made the call? Everyone is thrilled to build the agent that spends your money. Nobody has volunteered to be on the hook when it spends it like a moron.
If you are tempted to let an agent loose on your card, the grown-up move is to treat it like a new intern with your wallet: tight limits, a short leash, and nothing it can spend that you cannot afford to lose while the fraud rules catch up. They will catch up eventually. Your bank is telling you, plainly, that eventually has not arrived.
Sources: CNBC, Gizmodo, Insurance Journal, September 2026. Related: AI agents are already running real workflows.