Mastercard Rewrites Fraud Rules to Let Agents Spend
The Development
At VB Transform 2026 on July 14, Mastercard chief AI and data officer Greg Ulrich disclosed that the company is actively rewriting the risk rules it spent over twenty years building to block bots from its network — because those same bots are now legitimate buyers. Mastercard processes 175 billion transactions annually, scoring each in under 100 milliseconds. The new architecture, Agent Pay, has launched with Microsoft, OpenAI, Google, and others. It operates across five layers: agent identity and KYA (know your agent) registration, cryptographic verifiable intent, spend controls, authenticated execution via Agent Pay's tokenization framework, and continuous intelligence monitoring. Ulrich identified B2B procurement — autonomous agents managing inventory, supplier relationships, and budgets — as the larger commercial opportunity beyond consumer purchases.
Our Take
This is the missing piece the agentic commerce conversation has been circling. Capability was never the constraint — trust infrastructure was. Mastercard's five-layer model resolves the core blocker: how do you delegate purchasing authority to an agent without creating uncontrollable financial exposure? The verifiable intent layer is particularly significant; a tamper-proof cryptographic record of original instructions that travels with the transaction creates the audit trail regulators and procurement teams will require. Ulrich's B2B framing is the tell — the real volume in agentic commerce is not consumers buying sneakers, it is procurement agents managing approved supplier lists and inventory thresholds at scale. Brands that are slow to map their supplier and payment credentials into agent-compatible frameworks will find themselves excluded from autonomous procurement flows as enterprise buyers enable this.
What Changed
Verified agentic identity now exists as a structured primitive within a major payment network. An AI agent can be registered, authenticated, bound to a consumer or business identity, and governed by cryptographically recorded intent — enabling autonomous spend that is auditable end-to-end without human approval at point of transaction.
Marketing Impact
Ecommerce and procurement marketing teams face a structural shift: the buying agent, not the human, becomes the conversion target. Product data, supplier credentialing, and pricing logic need to be machine-readable and Agent Pay-compatible to remain in consideration sets that no human ever reviews.
Competitive Implication
Brands that register with Agent Pay and structure their catalog and contract terms for agentic consumption gain preferred-supplier status inside autonomous procurement loops. Brands without agent-compatible infrastructure are invisible to that buying motion — not deprioritized, simply absent.
Strategic Outlook
Open standards for cross-network agent identity — the gap Ulrich explicitly flagged — will attract standardization efforts from W3C, ISO, and platform coalitions through 2027. Brands that wait for those standards before acting cede early positioning inside Agent Pay's already-live network to faster-moving competitors.
The Exploit
Action Item
Ecommerce and procurement directors should audit their product catalog and supplier credentials for Agent Pay compatibility now, before autonomous B2B procurement pilots move into production at enterprise buyers in Q4 2026.