Fake AI shopping agents: how to tell a real one from a scam

A real AI shopping agent lives inside a platform you already use, such as ChatGPT, Google Search or the Amazon Shopping app, and it pays with a payment method you saved there earlier. A fake AI shopping agent usually arrives as a download, an ad or a link, and sooner or later it asks you to type in your card number, a wallet password or a one-time code. That request is the clearest tell.

How we checked this

We read the official product pages for OpenAI’s Instant Checkout, Google’s agentic checkout (Google Blog and Google Pay Help) and Amazon’s Buy for Me, Visa’s Trusted Agent Protocol announcement, Mastercard’s Agent Pay announcement and a published explainer on World’s AgentKit. We also read a September 2026 security report on a fake “AI agent” download, the FTC’s business-impersonator alerts and September 2026 coverage of UK and US bank warnings about shopping bots. Facts checked on September 24, 2026.

Where do real AI agent purchases happen today?

The honest short answer: in a small number of places, all of them run by large companies you already have an account with. That’s useful, because anything outside that short list deserves extra suspicion.

ChatGPT Instant Checkout. OpenAI launched Instant Checkout on September 29, 2025 for US ChatGPT Plus, Pro and Free users. You buy inside the chat, without leaving ChatGPT. Existing subscribers can use the card they already have on file or other card and express payment options, and OpenAI says the payment token is authorized only for a specific amount and a specific merchant. The merchant stays the merchant of record and handles fulfillment, returns and support. At launch it covered single-item purchases from Etsy sellers, with Shopify merchants listed as coming soon. OpenAI’s wording is that users “explicitly confirm each step before any action is taken.”

Google agentic checkout. Google announced agentic checkout on November 13, 2025, rolling out on Search, including AI Mode, for US users. You track an item with a target price, and when the price drops Google can buy it on the merchant’s site through Google Pay, but only after you give permission and confirm purchase and shipping details. Launch merchants included Wayfair, Chewy, Quince and select Shopify stores. The Google Pay Help page adds the details that matter for spotting fakes. You need a payment method and a US or Australia address already saved in Google Wallet. You tap a button labeled “Buy for me with GPay.” You don’t enter card details again, because your saved method is used. If the final price is higher than the total you confirmed, the purchase doesn’t go through and you aren’t charged. For returns and wrong items, Google sends you to the merchant.

Amazon Buy for Me. Amazon started a beta on April 3, 2025 in the Amazon Shopping app on iOS and Android, for a subset of US customers. Products from other brands’ websites appear under “Shop brand sites directly.” You tap Buy for Me, land on Amazon’s own checkout page, and confirm the delivery address, taxes, shipping fees and payment method. Amazon then passes your encrypted name, address and payment details to the brand’s site. The brand handles delivery, returns and customer service. We cover the details in Amazon “Buy for Me”: how it works, what it can spend, how to cancel.

The pattern across all three is the same. The agent sits inside an app you already trust, the payment method was saved there beforehand, and there’s a confirmation screen from that platform before money moves. None of them ask you to install a separate “agent” or paste card numbers into a chat. For the wider picture of who’s building what, see Agentic payments, explained: how AI agents pay and who is behind it.

What does a fake AI shopping agent look like?

We are not going to describe how these scams are built. What helps you is knowing their shape, and there are three shapes we see in published warnings.

A downloadable “agent” that is really malware. In a campaign documented by HP security researchers between April and June 2026 and reported by Help Net Security on September 17, 2026, a website promoted through search results and ads offered “an agent that trades crypto around the clock,” styled to look like a well-known AI assistant. The download installed malware that swapped seven browser wallet extensions, including MetaMask, Coinbase Wallet and Phantom, for fake copies that captured passwords as people typed them. That one was a trading bot, not a shopping bot, but the trick carries over: a brand-new “agent” you have to install from a site you found through an ad.

Impersonated brands and spoofed stores. The FTC’s business impersonator alerts list spoofed dealership websites where buyers paid for orders the real business had no record of, and fake social media ads that slipped past platform vetting. An “AI checkout” page is an easy new costume for the same scam: a page that borrows the look of a known assistant or payment brand and asks for your card.

Agents pushed toward weaker payment methods. On September 22, 2026, NatWest and Bank of America were among banks warning that AI shopping bots raise scam, fraud and data-privacy risks. Two of the named concerns: agents typing card details straight into websites, and people being steered toward payment methods with weaker fraud protection. A fake agent is exactly the kind of tool that would do both.

What will a scammer ask for that a real agent never does?

This is the most useful section to remember. Based on how the three official checkouts above work, a legitimate agent does not need any of the following from you inside a chat or a pop-up:

1. Your full card number, expiry date and security code. Google’s Help page says you don’t provide card details again at agentic checkout. OpenAI and Amazon use a payment method already on your account. If an “agent” wants all 16 digits typed into a chat window, stop.
2. A one-time passcode sent to your phone. Codes from your bank are for you to type into your bank’s or the platform’s own screen. Anyone asking you to read one out, or paste it into an agent, is trying to get past your bank’s check.
3. A wallet seed phrase or wallet password. No shopping checkout needs these. The HP case above was built around stealing exactly this.
4. An install from an ad or a link. Real agent checkouts ship inside apps you already have: ChatGPT, Google Search and Google Wallet, the Amazon Shopping app. A separate installer, especially one found through a sponsored search result, is a warning sign.
5. Payment by gift card, crypto transfer or wire “to activate the agent.” A real checkout charges the merchant’s price through your saved method. Nothing needs activating.
6. A rush. “Price locked for 5 minutes, confirm now” is pressure. Google’s own design does the opposite: if the price goes up, the purchase simply doesn’t happen.

A short habit covers most of this. Start from the app you already use, not from a link someone sent you. If a checkout screen appears, check that it’s the platform’s own confirmation screen, with the merchant name and the total, before you approve. For more account-level defenses, our 12-point checklist for protecting accounts from AI-powered attacks goes further.

How do the card networks verify an agent?

Behind the scenes, the payment networks are building ways for merchants to tell a registered agent from a random bot. You won’t usually see these systems, but knowing they exist explains why “just give me your card number” is the wrong design.

Visa Trusted Agent Protocol. Visa announced it on October 14, 2025, developed with Cloudflare. In plain terms, approved agents sign their requests so a merchant can recognize them and separate them from “malicious automation and rogue bots.” The signal carries three things: the agent’s intent (browsing or buying), whether you already have a relationship with that merchant, and optionally payment information. Visa named early feedback from companies including Adyen, Checkout.com, Coinbase, Microsoft, Shopify, Stripe and Worldpay.

Mastercard Agent Pay. Mastercard announced Agent Pay on April 29, 2025. Agents have to be “registered and verified” before they can pay, and they pay with Agentic Tokens, which are built on the same tokenization used for phone wallets and saved cards. A token stands in for your card number, so the agent doesn’t need the real one. Mastercard also lists biometric authentication and clear labeling of agent-made transactions so you can spot ones you don’t recognize.

World ID and AgentKit. A different approach proves there’s a human behind the agent. According to a March 19, 2026 explainer from Sherlock, World launched AgentKit in March 2026, using World ID “to prove there is a real person behind every AI transaction,” and tying it to the x402 payment standard used for stablecoin payments. We describe it here as one of several identity efforts, not as something you need. For how x402 works, see x402 in plain language.

What this means for you: in the real systems, the agent carries a token or a signature, not your raw card number. An app that needs you to hand over the actual number is working outside that design. Our companion piece, Visa Trusted Agent and Mastercard Agent Pay: what changes for cardholders, covers the cardholder side in more depth.

What to do if you gave details to a fake agent

Speed matters more than anything else here. Our step-by-step guide, Your money was stolen: what to do in the first hour, is written for exactly this moment. The short version:

• Call your card issuer using the number on the back of your card or in your banking app, not a number the “agent” gave you. Ask them to block the card and issue a new number, and tell them which charges you don’t recognize.
• If you entered a wallet password or seed phrase, assume that wallet is exposed. Crypto transfers generally can’t be reversed the way card charges can.
• If you installed something, uninstall it, run your device’s security scan, and change passwords for email and financial accounts from a different, clean device.
• Change any password you typed into the fake page, and turn on two-step verification where you haven’t.
• Report it at reportfraud.ftc.gov if you’re in the US, as the FTC’s business impersonator page directs.

Whether a charge can be reversed depends on your card, your issuer and how the payment was made. If a large amount is involved or the bank refuses, a consumer-protection attorney or your local consumer agency can tell you what applies in your case. For how disputes work with legitimate agents, see An AI agent bought the wrong thing. Who pays?.

What to watch out for

• Look-alike branding. A page that uses a familiar assistant’s colors or name isn’t that assistant. Get to ChatGPT, Google or Amazon by typing the address or opening the app you already have.
• Sponsored results for “AI agent” downloads. The HP-documented campaign was spread through search results and ads.
• “Agent” browser extensions that ask for broad permissions. None of the three official checkouts above needs one.
• Coverage gaps. Official features are limited by country and by merchant. If something claims to be “Google’s agent” in a country Google’s Help page doesn’t list, treat that as a red flag. Check availability on the company’s own page.
• Your own agent on a fake store. Even a legitimate agent can land on a spoofed shop. The platform’s confirmation screen, with the merchant’s name, is your last check. Our guide to spending limits for AI agents shows how to cap the damage.

More patterns like these are collected in AI scams that steal money in 2026: the catalog, with what to do and across our Scams and safety section.

Go deeper

• Agentic payments, explained: how AI agents pay and who is behind it
• AI scams that steal money in 2026: the catalog, with what to do
• Your money was stolen: what to do in the first hour
• Visa Trusted Agent and Mastercard Agent Pay: what changes for cardholders
• Protecting your accounts from AI-powered attacks: the 12-point checklist