Visa and Mastercard are racing to build the payment rails for a future where AI agents search, compare, and buy products on your behalf, all without you touching a checkout button. Both companies have completed pilot programs and expect commercial rollout as early as the first quarter of 2026, according to payment executives who spoke to CNBC.
The pitch is straightforward: tell an AI what you want (a red-eye flight under $500, running shoes in your size, groceries when prices drop) and let it handle the rest. The reality is more complicated.
The trust problem nobody's solved
AI-driven traffic to U.S. retail sites jumped 4,700% year-over-year by July 2025, according to Adobe data that tracks over a trillion site visits. But here's the number that matters more: traffic from AI sources was still 23% less likely to convert than non-AI traffic as of July, down from 49% in January. People are using chatbots to browse. They're not yet comfortable letting bots buy.
Visa's own October survey found that 47% of U.S. shoppers have used an AI tool for at least one shopping task, with finding gift ideas the most common use. When it comes to agentic commerce, price comparison was the most compelling application. That's research behavior, not purchasing behavior.
Only 47% said they're comfortable with AI agents purchasing recommended products on their behalf, according to a March 2025 Salesforce survey. The card networks are betting they can close that gap by building verification systems that make bot transactions feel as secure as swiping a card.
How the protocols work
Visa launched its Trusted Agent Protocol in October, developed with Cloudflare. The framework uses cryptographic signatures to help merchants distinguish legitimate AI shopping assistants from malicious bots. The protocol is available on Visa's Developer Center and GitHub, and partners backing it include Microsoft, Shopify, Stripe, and Worldpay.
Mastercard rolled out Agent Pay around the same time, taking a slightly different approach. Through Mastercard's framework, AI agents must be registered and verified before they are allowed to transact on the network. Both systems rely on Cloudflare's Web Bot Auth technology as the authentication layer.
Jack Forestell, Visa's chief product and strategy officer, framed it as table stakes: "For the past year, we've worked closely with sellers, issuers and partners to make sure agent-initiated transactions are as seamless and secure as any payment today."
That's the kind of thing chief product officers always say. The question is whether merchants will actually adopt these protocols, and whether consumers will trust them enough to hand over purchasing authority.
Who's already live
Perplexity and PayPal launched Instant Buy on November 25, just ahead of Black Friday. U.S. consumers can now complete purchases directly in Perplexity's AI chat, using PayPal for payment. Participating merchants include Abercrombie & Fitch, Fabletics, Ashley Furniture, and Newegg, with access to more than 5,000 merchants through PayPal's network.
PayPal sweetened the launch with a 50% cashback offer (up to $50) on first purchases through the end of Cyber Week, essentially paying people to try the new checkout flow. That promotional budget tells you something about how much convincing consumers still need.
Amazon began testing Buy For Me in April, a feature that allows users to purchase products from other websites directly through the Amazon Shopping app when Amazon doesn't carry what they're looking for. The AI visits external sites, fills out payment details, and completes the purchase. Amazon is simultaneously blocking external AI agents from crawling its own site, having blocked 47 bots as of late December.
OpenAI launched Instant Checkout in ChatGPT in September through partnerships with Etsy and Shopify, with PayPal integration announced later.
What this means for merchants
Large retailers face an uncomfortable choice. Embrace agentic commerce and potentially lose direct customer relationships, or resist it and watch AI-native platforms capture shopping journeys before they ever reach your site.
Mastercard's chief digital officer Pablo Fourez laid out the merchant dilemma in a blog post: "How can they distinguish between legitimate AI agents and malicious bots? How do they know the consumer authorized the agent to make the purchase? How can they know if the agent has carried out the consumer's instructions correctly?"
Fiserv announced partnerships with both Visa and Mastercard in late December, becoming one of the first major processors to adopt both frameworks. That gives smaller merchants access to the protocols without building custom integrations.
The conversion gap is closing
Adobe's data shows AI-referred shoppers behave differently than typical site visitors. They spend 32% more time on sites, view 10% more pages, and have a 27% lower bounce rate. These aren't casual browsers.
Revenue per visit from AI traffic increased 84% between January and July 2025, Adobe reported. By July, an AI-driven visit was worth just 27% less than a non-AI visit, compared to 97% less a year earlier.
The trend reversal is real. In October, AI traffic was 16% more likely to convert than non-AI traffic, the second consecutive month where AI visitors outperformed traditional traffic sources. Adobe calls it "the first meaningful signal that consumers are completing purchases directly after an AI-powered chat."
T.R. Ramachandran, Visa's APAC head of products and solutions, told CNBC that commercial use of personalized, secure agent transactions could come as early as Q1 2026. Mastercard's executives have offered similar timelines.
Visa CEO Ryan McInerney was more direct during a recent company event: "These technologies have the potential to radically transform commerce, to radically transform how we all shop, how we all buy."
The 2026 holiday season will be the test.
