Mastercard adds AI-agent risk score to Agent Pay
Mastercard said Wednesday it is expanding Agent Pay with trust and intelligence services — including a U.S. test of a probability score that estimates whether a transaction was started by an AI agent — so issuers and merchants can approve legitimate agent-led buys with less friction.
When an AI assistant books a flight, hotel, and ride in one go, the card network sees a burst of merchants that can look like fraud. Mastercard’s Agent Pay intelligence layer is an attempt to give banks a shared signal that an agent is in the loop, so legitimate agent shopping clears and real abuse still gets stopped.
On Wednesday, 30 September 2026, Mastercard announced an expansion of Agent Pay, the company’s program for payments an AI agent starts. Agentic, in that name, means an assistant takes the next step, such as booking a flight, instead of only answering a question. The new trust and intelligence services are meant to give a bank and a merchant more context when the charge was started by AI. Mastercard says the services bring together identity, intent, behavioral, and fraud insights, so those two sides share a clearer picture of the activity. The stated aim is a smarter yes or no on the charge, less friction when the buy is legitimate, and a smoother path for the person whose card is used. A yes or no from the bank is an authorization. Business Wire carries the release. Financial Content reprints it and stamps the item September 30, 2026, at 9:00 a.m. Eastern. Those lines are Mastercard’s.
Mastercard says the new services are the intelligence layer of its Agent Pay Trust Framework. The framework brings together five pieces: identity, intent, controls, execution, and intelligence. In plain words, that is who is paying, what the agent was asked to do, what limits apply, how the payment is carried out, and a shared read of the risk. Mastercard says that set is how it wants trust to work when an agent is the one shopping. The five names are Mastercard’s.
The first of the new services is a probability score, rolling out for testing in the United States. A probability score, here, is a number that estimates how likely it is that an AI agent started the transaction. Mastercard says the score is there so an issuer can approve a legitimate agent-led purchase with more confidence. An issuer is the bank that put the card out. Those lines are Mastercard’s. The release places the score in U.S. testing.
Mastercard said it will strengthen that score over time. The extra intelligence it names is behavior, merchant risk, transaction patterns, credential risk, and consumer propensity. Behavior is how this kind of spending usually looks. Merchant risk is whether the store itself looks risky. Transaction patterns are the shape of the charges. A credential, here, is the card number or the stand-in token used to pay. Consumer propensity is how likely that person is to shop this way. Mastercard says those additions would give a clearer picture of AI-driven activity across the life of a transaction, from the first ask through the charge. Those lines are Mastercard’s.
Past the score, Mastercard says the new signals give the companies in the payment a shared set of questions. Is the activity consistent with the behavior or the patterns they expect? Does the agent, the merchant, the credential, or the transaction show anything unusual that needs a closer look? Should the charge be approved, or are extra checks needed? Those three questions are the ones in the release.
The release uses a trip as the example. A person asks a new AI assistant to plan and book the next trip. The assistant finds a flight, a hotel, and a ride, then completes the bookings with one approval. Several purchases at different merchants can look unusual if a bank sees them as a burst. Mastercard says its insights give banks and merchants the context to approve the legitimate ones, so the person can move from planning to a booked trip. If something looks risky, the transaction can be flagged for an extra check before the person finishes the purchase. That example is Mastercard’s.
Mastercard says trust in this kind of commerce is a shared job, and that it is working with partners on it. One partner is Cloudflare. The companies are building privacy-preserving environments so they can better understand AI-driven payment activity. Privacy-preserving, in that phrase, means the work is set up to study the activity while protecting the private details. Together they are exploring how a signal from the web and a signal from the payment network can give financial institutions, merchants, and platforms a clearer view of an AI-powered transaction. A platform, here, is a company that sits between the shopper and the store, such as the assistant the person already uses. Those lines are Mastercard’s. Stephanie Cohen, chief strategy officer at Cloudflare, said trust is the foundation that will determine how far agentic commerce goes. She said Cloudflare’s network shows how AI agents interact with the web, and that combining that view with Mastercard’s payment intelligence, in those privacy-preserving environments, can give financial institutions and merchants the context to approve legitimate AI-driven transactions with confidence. That quotation is hers, in Mastercard’s release.
Mastercard is also working with Skyfire. Mastercard calls Skyfire a provider of Know Your Agent technology, shortened to KYA, for an AI agent’s identity, for checking that identity, and for payments. Know Your Agent means recognizing an agent as a known one, the way a bank recognizes a known customer. The aim, as Mastercard states it, is to help financial institutions and merchants recognize trusted agents, make a more informed yes or no, and give the shopper a smoother experience. Those lines are Mastercard’s. Amir Sarhangi, chief executive and co-founder of Skyfire, said every AI agent that pays on someone’s behalf should be identifiable, accountable, and auditable. He called that the foundation of Know Your Agent. He said extending KYA into Mastercard Agent Pay gives financial institutions and merchants a trusted way to recognize and verify agents, so this kind of commerce can scale with confidence. That quotation is his, in the release.
Ann Johnson, executive vice president of Security Solutions at Mastercard, said AI agents will make commerce more intuitive, efficient, and personal, but only if people and businesses can trust the systems acting on their behalf. She said that by adding new agentic intelligence and risk insights to each transaction, Mastercard is giving people the confidence to say yes, however they choose to pay. That quotation is hers, in the release.
On how common this becomes, the release says agentic commerce is moving into the mainstream, and that one in 10 consumers is projected to routinely use agents to make purchases by 2030. One in 10 is 10 percent. From September 2026, 2030 is a little more than three years away. That projection is Mastercard’s. The release does not name a survey behind the 10 percent.
Three more quotations sit on the release’s quote sheet, beside Johnson’s and the Cloudflare and Skyfire lines. Todd Kennedy, executive vice president of Payments Strategy at Capital One, said that as AI agents take a larger role in commerce, greater visibility into how a transaction is started, authorized, and carried out will be critical to the experience consumers expect. He said Capital One is excited to keep collaborating across the industry while safeguarding consumers and merchants. Suzanne Sando, lead analyst of fraud management at Javelin Strategy & Research, said that as agents act for consumers, fraud and identity systems need to know more than who is paying. They need to know whether an agent is trusted, properly authorized, and acting inside what the person asked for. She said the goal is to tell a legitimate, authorized action apart from automation built to deceive and steal. Those quotations are theirs, in Mastercard’s release. They are the speakers’ words as Mastercard printed them. They are not a separate count of how many agent payments are already happening.
The about box describes the company. It says Mastercard powers economies and empowers people in more than 200 countries and territories, and that with its customers it is building an economy where people can prosper. It says the company supports a wide range of digital payments, and that its technology, partnerships, and networks deliver products for people, businesses, and governments. It points readers to www.mastercard.com. The media contact is Jen Langione at Mastercard, jen.langione@mastercard.com. Those lines are Mastercard’s. The probability score in this announcement is the one rolling out for testing in the United States.
PYMNTS reported the same services the same day, from a Mastercard release it says was emailed to the newsroom. Its account matches the wire: identity, intent, behavioral, and fraud insights; the intelligence layer of the Agent Pay Trust Framework; a probability score for whether an AI agent started the transaction; and further signals about whether the activity looks unusual and whether it needs another look. PYMNTS prints Johnson’s quotation. It also writes that Mastercard launched Agent Pay in April 2025, and that the company described the program then as a way to open agent-led commerce for consumers and businesses. That April line is PYMNTS’s background. It is not a sentence in Wednesday’s wire.
PYMNTS points to an interview it posted on 17 September 2026 with Chiro Aikat, Mastercard’s U.S. co-president. In that account, Aikat said an agent can take what a customer needs, find suitable products and the stores that sell them, and, depending on the merchant, move the person into the merchant’s own checkout to pay with a card already on file. PYMNTS writes that Mastercard has developed agentic tokens and standards for transactions an agent starts, and that the company is working with merchants on those standards while the consumer stays in control of the decision. A token, here, is a stand-in for the card number. Those lines are PYMNTS’s account of the September 17 interview. The same article cites a PYMNTS Intelligence report, “Global Digital Shopping Index: The AI-Powered Shopper Has Arrived.” It says the report found that 56 percent of consumers will let an AI shopping agent compare products, and that 35 percent will let an agent use a saved payment method. Fifty-six percent is a bit more than half. Thirty-five percent is about one person in three. Those two figures are PYMNTS Intelligence’s. They are not a count of Agent Pay users, and they are not in Wednesday’s Business Wire release.
In plain terms, Mastercard said on Wednesday that Agent Pay is gaining a trust and intelligence layer for purchases an AI agent starts. The first piece, in testing in the United States, is a score for how likely it is that an agent began the charge, so a bank can approve a real agent purchase with less friction and still stop one that looks wrong. Mastercard says it will add more signals over time, and that it is working with Cloudflare and with Skyfire, a Know Your Agent company, on the shared picture. The one-in-10 line for 2030 is Mastercard’s projection. The 56 percent and 35 percent lines are PYMNTS Intelligence’s.
The picture is a diagram of the Agent Pay Trust Framework. Five blocks read Identity, Intent, Controls, Execution, and Intelligence. A callout marks the first service, in U.S. testing: a probability score for how likely it is that an AI agent started the purchase. It is a diagram of that framework. It is not a photograph of a shopper, and it is not a wire dateline.