Why Proxy Payments Are Stuck in a Deadlock with Veto Power for All Parties?

Stripe wants to bypass Visa to create a new payment network, but users may not buy into it at all.

Written by: Vignesh Sreedhar, Meta Software Engineer

Compiled by: AididiaoJP, Foresight News

Consumer-grade AI agents are exploding, and this article only discusses the traditional card payment system in the B2C scenario.

Where Is the Problem?

AI agents are browsing the web, filling out forms, and increasingly placing orders directly. Agents are supposed to act strictly according to consumer authorization, but they can still produce errors or unexpected results, performing actions that do not reflect the true intentions of consumers. Anyone who has built, used, or interacted with agents knows that this can happen at any time.

Suppose I ask an AI agent to book a hotel: two nights, total price not exceeding $600, free cancellation the day before check-in, within walking distance to a venue. The agent finds the right hotel for $580 and makes the payment. The problem is, it booked a non-refundable room type. The card is valid, the merchant is real, and the amount is within budget—but it is still a wrong purchase. This situation can occur whether a person is in the loop (instant confirmation) or not (autonomous execution).

This leads to the fundamental issue: payment can succeed while still contradicting user intent. There are two scenarios behind this.

First, the intent is not accurately and completely understood. A natural language request must be transformed into explicit conditions that the user can confirm and other parties can verify. This transformation process may miss or misinterpret key conditions, such as whether refunds are allowed, when delivery occurs, or whether exchanges are possible. Currently, there is no standard format for intent—though every card organization claims to have one—so if the request becomes vague or ambiguous, a wrong purchase may occur.

Second, the agent's behavior deviates from the already clarified intent. Even if the request is clear, the agent may hallucinate, use outdated information, lose context in multi-step operations, misread checkout options, be manipulated by malicious prompts, or make errors or encounter bugs during checkout.

Given these risks, let’s see how they affect each key participant in the transaction.

Consumers: Lack of Trust. Consumers need to be confident that the agent is buying what they want, can protect payment information, and has a clear remedy path in case of issues. An NMI survey of 1,000 American adults found that 69% do not trust AI to handle payments securely, 70% want to review or veto AI decisions before placing orders, and only 10% are willing to fully entrust purchases to AI. Currently, most agent purchases come from a small group of tech pioneers (likely including venture capitalists), while ordinary users remain hesitant to hand over payments to agents.

Merchants, PSPs, and Acquirers: Fraud and Chargeback Risks. Merchants are in a worse position. They must distinguish between legitimate shopping agents and malicious bots, and defend themselves when orders are disputed as “unauthorized” or “against customer instructions.” Their PSPs (especially risk control service providers like Forter, Riskified, Signifyd, Sift, Accertify, and Sardine) and acquirers must assess these risks and handle disputes, yet they cannot see user intent at all. All risk control service providers currently rely on signals provided by merchants, which merchants can only obtain when users shop on their own websites.

Issuing Banks: Approving Payments Without Any Context. Issuing banks decide whether to authorize a payment and assess disputes, but like merchants, they cannot see what the user actually authorized. If so, how can issuing banks dare to underwrite credit risk? They cannot confidently distinguish between fraudsters, agent errors, and valid delegated purchases.

Card Organizations: Lack of Responsibility and Intent in Transactions. Card organizations are rule-makers: they need a consistent set of rules to identify delegated authorizations, allocate losses, and assign responsibilities. Without evidence being communicated among parties, each party can only see part of the transaction, making it difficult to clarify responsibility.

Agent Companies: Need to Monetize. Agent companies urgently need a sustainable way to monetize transactions, but merely facilitating purchases does not establish who should pay and why. A common proposal is to take a commission from merchants (either a percentage cut or an affiliate program), but neither path has worked out. Instant Checkout failed for this reason: launched by OpenAI in September 2025, it had shrunk back to product discovery and merchant-owned checkout by March 2026. Affiliate programs also struggle to scale—agents must build relationships one by one and join merchant programs individually, each with its own terms, tracking, and settlement methods, and even then can only cover a small portion of agent activities. Moreover, why would merchants pay affiliate fees while also bearing disproportionate risks?

Negative Flywheel Effect. These gaps reinforce each other: if authorization and responsibility are unclear, merchants will block transactions, issuing banks will tighten checks, and approval rates will drop, interrupting checkout. As the experience worsens, users become even less willing to entrust purchases to agents. Consumer trust is also fragile: a YouGov survey for ACI of 2,080 British adults found that 60% would stop using AI shopping agents after one mistake.

The key point is: even if the model advances to the point where agents fully understand and follow user intent, the problem still exists. An agent, no matter how perfect, executes intentions that others cannot see, and the risks of fraud, chargebacks, and disputes in the entire ecosystem remain unchanged: merchants still cannot distinguish between legitimate agents and malicious actors, issuing banks still cannot verify what users actually authorized, and users’ claims still cannot be proven or disproven.

Do Existing Solutions Work?

I will not cover each company individually, but I will explain the broader proxy payment solutions that have gained some attention.

Auto-Filling Original Card Numbers

A surprisingly common practice is to store users' real card information in a vault and then use a browser agent to fill it into the merchant's payment form. Major personal agents like Instinct and Hark Labs do this. Instinct has started supporting Stripe Link, but the vault still exists.

Instinct’s payment operations run in a cloud virtual desktop, making it inconvenient for on-site demonstrations. So I turned to test Hark’s vault—it directly filled my original card number and CVV into the payment form without masking. Even more absurdly, these agents claim to have such high daily active users and valuations, yet few point out this obvious security vulnerability.

Musk has also tweeted that you can send a photo of your credit card to Grok Bot, throw it into the chat box, and let it shop online. But xAI’s own terms state clearly: “Grok Bot may retain customer data, files, browser sessions, credentials, memories, and routines in a persistent cloud environment... deleting the Bot may not delete shared files, sessions, credentials, or routines.”

Are these companies PCI compliant? Auto-filling card numbers does not inherently violate PCI, but storing and exposing payment credentials brings heavy security and compliance obligations. PCI DSS prohibits service providers from retaining CVV for future purchases, including through service provider-managed vaults and browser auto-fill. I do not see any PCI compliance certifications in the terms of several companies, so these practices exist in a gray area.

Agentcard (a YC S26 company providing card vaults for agents) has an interesting solution. Technically PCI compliant, similar to 1Password: users encrypt and store their original card information, which Agentcard itself cannot access. It requires agent browser integration (Kernel, Browserbase), and transactions are approved using Face ID. The real credit card information received by the merchant is genuine. Agentcard deserves praise for finding a novel and PCI-compliant way for agents to pay using original card information. Even if agent browsers become the norm and users accept this kind of 1Password-like solution, I believe it remains a reliable transitional solution until agent tokens are truly scaled. They also support automatic approvals, allowing users to set automatic approvals based on amount thresholds when saving cards (e.g., automatically approve below $50). Agentcard currently supports 30 PSPs, including Stripe, Shopify, Worldpay, and more.

Agent Tokens

Payments can be made without sharing real card information, and the method has long existed: tokenization. Here, “token” does not refer to encrypted tokens on the blockchain, but rather a string of payment credentials that substitute for real card numbers. The device-bound credentials of Apple Pay are a product of tokenization, and merchants also use card organization tokens to improve authorization rates and reduce fraud. Tokens replace underlying card information and can be limited to devices, merchants, or usage scenarios. Agent tokens represent existing cards of consumers, accompanied by services like agent identity, authentication instructions, and payment controls. Visa, Mastercard, and American Express have each launched their own agent token solutions over the past year.

Visa Intelligent Commerce (VIC) is the first agent token solution. According to the process disclosed by Visa, users first verify their card, set a passkey, and then authenticate the authorization instructions for agent purchases. When the agent requests a checkout credential (i.e., agent token), Visa sets card organization controls based on the original instructions. When the payment reaches the authorization stage, VisaNet verifies the instructions. The instructions include higher-level authorization conditions such as maximum amount, credential validity period, and merchant domain. However, every major agent platform has passkey exemptions—this will be explained later as to why it is critical for issuing banks.

Mastercard Agent Pay works similarly, starting with registered agents, obtaining user consent, and authentication. Mastercard’s tokenization service issues tokens representing users’ existing cards for agent use. According to its disclosed advanced checkout process, agents submit purchase details and restrictions through the Intent API, receiving an intent ID and tokenized payment credential in return.

AmEx’s Agentic Commerce Experiences (ACE) breaks down registration, intent approval, and credential acquisition into three steps. Account activation allows users to register cards with verified agents and complete issuing bank authentication. AmEx, being both an issuing bank and a card organization, can control the entire issuance lifecycle. Agents call the Create Intent API to submit purchase instructions and restrictions, and when preparing for payment, they exchange the proof token for a limited-range checkout credential.

From a cross-card organization perspective, two major decisions are important: issuance and payment authorization. Issuance determines whether a card can be registered and whether an agent can create usable tokens. Authorization (as today) determines whether the payment is approved when the credential reaches the checkout stage. Given these solutions, why not use them directly? The problem is that several issuing banks currently do not support cross-card organization issuance of these tokens. Major banks like Chase explicitly do not support agent tokens, and many other banks also cannot provide stable support. Additionally, authorization friction is significant, with a high challenge rate for 3D Secure.

The agent tokens launched by card organizations look great in theory, but in practice, they often face difficulties due to two reasons—technical architecture and resistance from issuing banks.

Crossmint specifically targets gaps where card issuers do not support proxy tokens. It does not issue new cards but directly uses users' own cards. During registration, users first check if their card can obtain a proxy token (VIC, Agent Pay, or ACE); if not, it falls back to a PCI-compliant vault direct card number: the card number is encrypted with a public key generated by a proxy browser, computer usage, or UCP component, and is decrypted locally at checkout for automatic filling. Alfongi told me that Crossmint discussed this plan with Visa and Mastercard but ultimately chose not to issue virtual cards because the card organizations guarantee that they will not allow it in the long term.

The reality is not so ideal either. Crossmint admits that both authorization and issuance rates are not good, but they have been improving over the past two to three months. Their data shows that Mastercard performs much better, while Visa struggles, especially with Chase and commercial cards.

Card organizations can define credentials and control, but issuers still need to assess risks and serve cardholders when issues arise. Without reliable evidence proving what the user authorized and whether the purchase matches the intent, issuers are hesitant to underwrite the additional risks brought by proxy delegation. AmEx, being both a card organization and an issuer, has a unique advantage as it explicitly emphasizes the need to communicate intent to the issuer before execution. This is also where the passkey exemption is critical: the passkey is the only step for cardholders to prove they authorized the instruction, and by exempting it for every major proxy platform, issuers lose this signal precisely when they need it most.

Issuance Model: Stripe Link Proxy Wallet and Link Balance

For reference, Stripe was the first company to launch this method on a large scale, but I know of several others that have already established or are in the process of establishing issuance plans.

How it works: An intermediary issues a new card (usually a one-time use virtual card) to the proxy, making each purchase consist of two segments: your card pays Link, and Link's card pays the merchant. Link has effectively become a proxy wallet, with proxy purchases increasing 38 times year-on-year by September 2026.

Economic account: After deducting program costs and payments to the proxy, credit card funds leave about $0.40 in profit on a $100 purchase. On the user side: Link appears on your bill, category rewards do not apply, and disputes and refunds go back to the merchant through Link. On the merchant and issuer side: the merchant receives a commercial card with no risk data, with acquiring costs potentially rising by about 200 basis points; issuers lose merchant-level data. On the card organization side: Visa prohibits real-time card fronting outside its phased wallet rules. Mastercard went further in its Q3 2026 earnings call: CEO Michael Miebach stated, "We do not support the practice of issuing one-time virtual card numbers for transaction fronting," calling VCN a bridge, "not a long-term solution we will support."

Operators I spoke with expressed the same sentiment from another angle: the current practice is converging towards issuing trusted virtual cards. The problem is clear—when you are essentially designing for a MOR/card-to-card funding model, the accounting simply does not add up. Privacy.com spent over a decade refining this model: the funding side has clever strategies to optimize acquiring costs and card organization fees, fraud models finely tuned, credit and transaction loss underwriting, customer service, and chargeback handling are all done in-house. Stripe may be willing to push hard and absorb massive losses to capture market share.

The attitude of card organizations is nuanced. Some card organizations' franchise teams dislike fronting, but in reality, card organizations earn more because each purchase adds several card swipe steps. Affirm/Klarna-style BNPL is an example: paying the merchant first through a virtual card at e-commerce POS, then collecting installment payments from the consumer's underlying debit card. Moreover, Visa will never allow Mastercard to take the lead in the proxy space, and vice versa. Therefore, both will make exceptions to support transitional solutions, just as they have done with stablecoin settlements and cross-border issuance exemptions.

On October 26, Stripe launched Link Balance for proxies, initially implemented through Instinct. The architectural change separates funds and individual purchases: consumers pre-load funds and grant spending permissions, allowing proxies to act on behalf of consumers when they are not present. In short:

How it works: A completed KYC preloaded balance exists in a Privy wallet as stablecoins (USDC on Tempo), spent through a consumer prepaid Visa card issued by Lead Bank, which enjoys Durbin exemption.

Why use stablecoins: By using stablecoins, proxy permissions reside at the wallet level, also giving Stripe distribution capabilities: a programmable balance can pay regular card merchants, machine payment rails (like Stripe's Machine Payments Protocol), and extend dollar balances overseas without needing to establish local deposit products in every market. However, this balance is not covered by FDIC insurance.

Economic account: Debit recharges are cheap, about $0.26 per $100; each $100 purchase can yield about $1.95 in interchange fees; plus the idle balance's float income, if Link shifts to Bridge's OUSD, the float will be even more.

Responsibility: Mistakes made by proxies are borne by consumers. Link's terms do not cover unauthorized transactions, and your original issuer only sees a recharge.

This is currently the most mature solution for proxy companies in terms of payment and monetization, but it makes things worse for consumers, merchants, issuers, and card organizations. The above article contains a complete breakdown, numbers, and sources.

Checkout Execution: Shopify and UCP

Shopify's approach is the opposite of merchants like Amazon—Amazon directly blocks proxies like Meta's Muse from purchasing on its site. In January, Shopify collaborated with Google to create the Universal Commerce Protocol (UCP), allowing proxies to search products, add to cart, and check out across merchants. In September, Shopify expanded WebMCP support to the checkout phase, including Shop Pay, covering all eligible merchants. This way, browser-based proxies can read, update, and complete checkouts through structured tools without relying on screenshots and scraping. It also collaborates directly with Muse and Instinct, but reports suggest they do not share economic benefits with proxy companies like Stripe does. In terms of payments, Shop Pay uses proxy tokens for non-Shopify stores, and as mentioned earlier, the authorization and issuance rates for proxy tokens are poor.

Several third parties are building on top of it, such as Crossmint and Sapiom. Crossmint's headless checkout API uses UCP and WebMCP for merchant support; if not supported, it uses custom browser tools. It claims to cover 90% of e-commerce websites, with a median time of under two minutes. Additionally, it's worth mentioning Agentcard's opencommerce.sh: providing proxies with an endpoint and SDK allows them to search for products, check out, and track orders across 5,026 online stores. After users approve the cart, payments go through the Agentcard vault, which will soon support Stripe Link and Shop Pay. Each completed order incurs a 1% fee.

However, this only addresses the checkout phase. Shopify, Crossmint, Agentcard, and others make it easier for proxies to complete purchases but do not change one thing: who bears the risk when proxies buy the wrong items.

We Are Stuck

Business is essentially a multi-party risk network, where both merchants and issuers hold veto power. Consumers can wish all day for proxies to buy for them, but as long as the merchant (the supplier of goods) does not accept, or the issuer (the provider of purchasing power) does not authorize, the purchase will not happen, and users will likely end up placing orders themselves.

You might say that consumer demand alone can turn the positive flywheel: as more people use proxies for shopping, merchants will naturally build the infrastructure to accept these payments, and resisting issuers and card organizations will be bypassed, with players like Stripe and Shopify dominating proxy commerce.

I think this is not impossible, largely because Stripe is playing a long game. Alfongi mentioned that Visa built its empire by controlling both ends, and Stripe is grasping both ends: one end is merchants, with enterprises on Stripe processing $1.9 trillion last year; the other end is consumers, with over 350 million people using Link, which is also pre-installed in popular proxies.

Surrounding these two ends, Stripe is piecing together the other parts of the network: Tempo as the rail, OUSD as the currency, and MPP as the protocol. Once Link balances on Tempo can be paid to Stripe merchants via MPP, a complete payment path will bypass Visa—no interchange fees, no chargeback risks, and instant settlement for merchants.

This path will undoubtedly be obstructed by issuers, card organizations, and possibly users at multiple levels. But Stripe is betting on this ambitious gamble: to create a closed-loop network for proxy commerce. They should be betting this way.

However, I believe the probability of success is quite low for two reasons.

First, the barriers to entry are extremely high. Over the past decade, payment experiences have been refined to be smoother: saving payment information, one-click checkout, Apple Pay, etc., with wallets and card organization tokenization landing together in 2014. Today's checkout is the result of decades and hundreds of billions of dollars in investment, nearing optimality. How mature is it? Global payment revenue is projected to grow only 3% from 2024 to 2025, while the average growth in previous years was 11%. Therefore, if the proxy commerce experience is worse—more chargebacks, more verification challenges, more session blocks—people will not use it on a large scale. They will bypass proxies and buy themselves.

Second, trust. Payments are extremely sensitive, and trust is extremely fragile. Many proxy companies treat PCI compliance as an afterthought, leading to numerous security incidents. Unexpected purchases may also occur: without consumer protection, dispute rights, rules, or any ecosystem participant willing to take responsibility. As soon as someone nearby encounters a pitfall—a non-expected payment, a block by a merchant or issuer, a security violation—they will never use it again.

Building trust in payments takes a long time. The first secure online card payment was for a Sting CD bought in August 1994. By Q4 1999, e-commerce accounted for only 0.64% of U.S. retail; by 2010, it was 4.2%; today, it is only 17.1%. It took a full 30 years. Moreover, behind this growth is institutional trust: Visa's zero liability policy in 1997, 3DS in 2001, PCI DSS in 2004, card organization tokenization and Apple Pay in 2014. Proxy payments have none of these. Just because people around are using it might encourage some to try; but what truly scales it is institutional trust.

Furthermore, we are creating an ecosystem where the incentives of all parties do not align at all.

Card organizations want to maintain their influence. They have built proxy tokens, passkeys, and intent APIs (which barely capture true intent) to keep proxy commerce running on their own tracks and rules. However, issuers like Chase are reluctant to issue them, and each major proxy platform has passkey exemptions. The worst part is that they are competing against each other, with standards clashing and rules fragmented. They should not be complacent: Stripe is betting on becoming the true giant in the payment field, and anyone competing with Stripe is in a tough position.

Merchants are on the defensive. Large merchants are bringing in proxies to handle the extra transaction volume, but they are still using black-box fraud models designed for humans: mismatches in IP addresses, browser session histories, fingerprints, and geolocations, etc. Hundreds of companies are discussing KYA and complex fraud models, but none have the coverage and distribution capabilities to genuinely attract interest. I even feel that if the people and intentions behind the proxies are unclear, KYA simply won't work, and proxy companies won't easily disclose this information.

Issuers cannot ethically underwrite transactions they can barely see. However, they might take on a significant role here. As Nikil Konduru said, only issuers have the full set of capabilities to cover the mistakes of proxies: premium interchange fees, underwriting, funding verification, and dispute resolution. They can require proxies to submit intent before authorization to provide purchase protection, and then combine this intent with cross-merchant purchase history to ultimately build the retail media network they have always wanted. But issuers are slow to act, and this model only works if the five major banks band together to push demands before standards are set (which they likely won't do). Proxy companies also have no reason to engage with issuers one by one—one wallet is already widely usable, and no one wants to shop through a bank app.

Proxy companies need scalable GMV monetization to pay for computational bills. So whatever method can get purchases through today and provide them with money is what they will use: insurance inventory of original cards, issuing through Link, negotiating custom agreements with merchants, all of it, regardless of the costs to merchants, issuers, or card organizations.

They also have macro tailwinds. In the first quarter of 2026, AI took about 80% of the global $300 billion in venture capital funding; OpenAI and Anthropic raised about $217 billion in the first half of the year; Alphabet, Amazon, Microsoft, and Meta plan to spend about $725 billion on AI infrastructure in 2026, a 77% increase year-over-year. Consumer-grade proxies are also not short on cash: Instinct just launched by invitation in August and raised $1 billion at a $10 billion valuation in September, just a month after raising a round at a $2.5 billion valuation.

With so much money, such great influence, and pressure on consumer-grade AI, proxy commerce is expected to become a sustainable monetization method, and proxy companies and their investors won't wait for the payment ecosystem to slowly figure things out. They will act quickly to make this happen, regardless of whether anyone else is involved—this is where Stripe and other companies betting on "service proxies" are smart.

But I believe they ultimately need to monetize these users. For all the reasons mentioned above, unless the entire business ecosystem has the motivation to make it work, users will not adopt it on a large scale.

Only benefiting users without benefiting merchants won't lead to growth. Only benefiting merchants without benefiting issuers won't lead to growth. Only benefiting issuers without benefiting proxy companies also won't lead to growth.