PYMNTS Report: As AI Agent Shopping Rises, Issuers Eye Payment Tokens to Limit Authorization Scope
Tokenization could let issuers constrain AI-agent purchases by merchant, category, or amount—protections that persist even if a token is stolen, according to PYMNTS Intelligence.

PYMNTS Intelligence's September 2026 Payment Innovation Tracker report notes that as AI agents begin shopping on behalf of consumers, issuers can use digital tokens as a substitute for card numbers to limit the specific scope of purchases a customer authorizes. According to the report, tokens can be restricted to specific merchants, specific categories, or specific amounts; these restrictions remain in effect even if a token is stolen, and a thief cannot obtain the underlying card number.
Fraud and false declines weigh on issuers
Survey data shows that among issuers with high customer lifetime value, 68% believe AI agents shopping on customers' behalf require stronger security and anti-fraud measures; 42% of surveyed issuers cite fraud and disputes as one of the two biggest costs of operating a card platform. The report also cites a FICO survey finding that one-third of institutions say their fraud systems frequently flag legitimate transactions as fraudulent.
Loyalty and reputation at stake
The report also notes that half of financial institutions say fraud has damaged customer loyalty, and 44% report brand or reputational damage. Issuers can combine identity verification within the banking app with tokens that carry spending instructions, supporting agent-initiated shopping while preserving customer control over transactions.
Source: https://www.pymnts.com/cybersecurity/fraud-prevention/2026/fraud-costs-financial-institutions-more-than-money/
Provenance & status
- Byline
- OceanAlt Editorial
- First published
- 2026-11-08
- Last updated
- 2026-11-08
- Content type
- Newsflash
- Source material
- View original ↗
Related reading
Paste a payee address before you pay and see whether it's on a sanctions list, through a mixer, or tagged for fraud.
This judgement can sit inside your own product
One line of code; it touches neither your CSS nor your JS. The same pre-settlement judgement can appear in your articles, on your wallet's confirmation screen, or as an endpoint your agent calls before it pays.



