Image credit: Bank of America
Bank of America has joined five other major banks, including Capital One, NatWest Group, ING Group, ASB Bank, and Commonwealth Bank of Australia, to warn that AI shopping assistants could make it easier for criminals to steal your money and your personal information. Today, the banks published a new set of safety principles aimed at "AI agents," the computer programs that can now search for products, compare prices, and even complete a purchase on your behalf.
These agents are already live. ChatGPT's Instant Checkout lets you buy from over a million Shopify stores and Etsy without leaving the chat, but it still makes you confirm your order and payment details before the sale goes through. Google Shopping's agentic checkout goes further: it can automatically buy an item once the price drops to your target, using Google Pay, though Google says it always asks your permission first too. Meta's Muse, a newer AI agent that shops for you across the web, didn't offer that same transparency: Amazon blocked Muse from its site this week, saying the agent never identified itself as AI, accessed customer accounts without permission, and stored people's login credentials.
The banks' new safety principles (PDF) warn that the more control you hand an AI shopping agent, the more damage a scammer can do if that agent gets hijacked, impersonated, or tricked. The report warns that criminals could pose as legitimate AI shopping agents or compromise real ones to make fraudulent purchases in your name. Some shopping bots also type your credit card number directly into checkout pages instead of using a safer method that keeps your real number hidden, so a breach of that bot could expose your card details.
The banks also say they often can't tell which AI agent made a purchase, what you asked it to buy, or whether the order matches what you intended when something goes wrong. Without that information, they say it's harder to catch fraud quickly or help you get your money back.
A Visa-commissioned survey conducted by Harris Poll in May found that 72% of consumers have already used an AI assistant, but only 23% say they'd trust one to manage a payment on its own. Separately, a Credit One Bank survey published this month found that more than 2 in 5 Americans have already encountered, or come close to falling for, an AI-powered scam of some kind.
Until stronger safeguards are in place, don't let an AI shopping agent complete a purchase without requiring you to approve it first. If you want to try one anyway, ask your bank about a virtual credit card number, a stand-in number tied to your real account that you can shut off instantly if something looks wrong. Capital One and Citi let you create virtual credit card numbers in their app and Google lets you choose to use a virtual credit card number through Google Pay with participating banks. And always check exactly who you're buying from, especially on sites like Amazon that host third-party sellers, since their return policies and buyer protections can be different from the retailer's own.
