Before a purchase, an agent should check which business is making the offer and how the shop domain, merchant and payment recipient are related. It then needs to check whether that offer meets the customer’s request, including price, availability, delivery and access to support.
What if the names are different?
A shop trades under a brand, the invoice names a legal entity and the payment screen names a provider. This can be entirely normal. The connection should be explainable from traceable information such as merchant details, a company register where available and the payment information confirmed for this checkout. If payment unexpectedly goes to a recipient the flow cannot account for, the agent should pause and let the customer check the discrepancy.
What does a signature prove?
A valid signature can establish where a message came from and whether it changed, provided the key can reliably be tied to the responsible party. Visa’s Trusted Agent Protocol, for example, describes how merchants can check incoming requests from agents. In the opposite direction, the shopping agent still needs traceable information about the merchant and the offer. A useful test is a lookalike domain with a different payment destination.
Book chapters, articles and sources
- Chapter 12 · Control and law
- Chapter 13 · Security for agents that act
- What are the risks of agentic commerce for merchants?
- Stefan Hamann · Commerce Is Quietly Changing Hands
- Visa Developer · Trusted Agent Protocol