Visa’s James Mirfin says e-commerce risk is transferable to AI

• Key insight: E-commerce risk technology concepts can also be used to protect agentic commerce payments, according to Visa. 
• Forward look: The card brand argues agentic commerce standards should be interoperable. 

The world’s largest payment companies have spent most of the past decade pushing a common payment experience for online and mobile app payments, an effort that could also help boost agentic commerce by standardizing all agentic payments. 

Processing Content

“We have seen huge value in standards,” James Mirfin, Visa’s senior vice president and global head of risk and security intelligence solutions, told American Banker. Mirfin spoke with American Banker ahead of publishing a Visa blog about agentic AI risks and how banks can respond. The blog is not a direct response to any specific security event or announcement, though it comes at nearly the same time that JPMorganChase warned about the risks inherent in accessing AI agents to perform banking tasks and amid Amazon’s dispute with Meta over access to the social network’s Muse AI assistant. “Bankers are spending a lot of time talking about AI security,” Mirfin said. “Everyone is curious.”

Why worry?

The buzz over AI has been accompanied by often extreme worries about security, along with more plausible risks such as noncompliant AI agents.

The risk isn’t just fraud, but AI agents going outside their “instructions,” or misinterpreting prompts, according to John Meyer, a managing director at Cornerstone Advisors. 

“If I set up an agent to buy a ticket when the fare falls under $500, what happens if it buys five tickets under $500?” Meyer told American Banker. “A lot of our clients are also worried about AI agents contributing to things like account takeovers.” 

Tightening access controls can help address this risk, according to Meyer. “Many CIOs are looking at ‘least privilege data access,'” Meyer said of the policy of strict limitations for AI agent authorization, such as dollar amounts or purchase parameters.This concept is partly borrowed from limits on traditional corporate spending cards that do not allow purchases outside of a particular merchant category or budget line item. 

Some of the AI fear from banks is also about responsibility for a bad transaction or increase of worry about hacking or a rogue AI agent, Meyer said, while noting it’s important for banks to have a strategy to mitigate and respond to security breaches involving AI agents.  Existing rules that govern responsibility for disputed card payments, such as Reg Z and Reg E, aren’t clear about what happens in the case of a disputed agentic purchase, according to Meyer.

Until regulatory clarity emerges, banks should make sure they have a policy for agentic payment disputes, and a strategy to battle and respond to fraud or scams involving AI agents, according to Meyer. 

Past as prologue

The answers to some of the concerns about agentic commerce security could be found in existing programs, according to Mirfin. 

“Agentic is similar to e-commerce,” Mirfin said, adding measures that shield e-commerce from security risk while ensuring user experience can be adopted for agentic AI. As agentic commerce has expanded, standards are starting to emerge to guide transactions. 

“We have put our own standard out there, but many of these standards are designed to be agnostic,” Mirfin said, adding it’s important that these standards gain adoption and do not compete. “You don’t want 50 competing approaches to this.” 

Some of the steps to guide online and mobile payments can be used for agentic commerce, according to Mirfin.

“The good news about agentic commerce and fraud is that it lends itself to technology and protocols that are already out there,” Mirfin said, noting multifactor authentication and tokenization can both be used to manage agentic AI risk. 

Tokenization in this case refers to digital security and not cryptocurrency. For e-commerce payments, a substitute number stands in for real account numbers, rendering a stolen card useless, for example. 

Read more:

These substitute numbers, or “tokens,’ in theory can restrain an AI agent by limiting how a digital identity can be used. A token can only be used for a specific purpose, which could cut off an AI agent’s path toward unauthorized activity. 
There is technology in existence to support this concept. “Bot tokenization” generates a credential that enables authentication and permission to perform tasks as defined by the firm that deploys the bot. 

The card brands are working to scale these tools. Visa and Mastercard recently released agentic commerce tools that support agentic standards. In an earlier interview, Sherri Haymond, executive vice president of digital commercialization at Mastercard, said “There are definitely things that have to be addressed. There is potential risk if agentic AI is left unchecked.”