AI agents may soon be buying your stuff for you. The FIDO Alliance has teamed up

The progression here has a quiet logic to it. AI assistants spent the last two years learning to converse; commerce was always the next frontier. The question was never whether AI agents would start making purchases on our behalf — it was who would build the guardrails before that happened at scale, and whether anyone would bother. As of late April, somebody is bothering. The FIDO Alliance — the standards body that spent years convincing the industry to abandon passwords in favour of biometric and device-based authentication — has teamed up with Google and Mastercard to do something genuinely interesting: establish a trust framework for AI-initiated transactions. The idea is that when your AI agent goes to buy something on your behalf, the merchant on the other side needs a reliable way to confirm that a legitimate, user-authorised system is doing the purchasing, and not a rogue process, a badly prompted model, or something considerably worse. FIDO's existing credential infrastructure, already baked into billions of devices, is the obvious scaffold to build that on. Google brings the AI surface area. Mastercard brings the payment rails and, crucially, the liability experience that comes from two decades of card fraud. This is not a startup moonshot — these are three institutions that have collectively shaped how the internet handles identity and money, sitting down to figure out the next version of both.

If confirmed, here is what this means. The architecture of online commerce is about to shift in ways that most retailers, fraud teams, and consumers have not fully priced in. When AI agents become authorised purchasing actors — not just helpers who surface options, but entities that complete transactions — the entire assumption set of e-commerce changes. Checkout flows designed for human attention spans become irrelevant. Loyalty programmes built around repeated human engagement lose their friction advantage. Fraud detection systems trained to spot anomalous human behaviour will need to distinguish between a compromised account and a legitimately delegated AI, which is a categorically different problem. For consumers, the convenience is real and the risk is equally real: an agent with payment authority is an agent that can be manipulated, misconfigured, or simply wrong in expensive ways. What FIDO, Google, and Mastercard are attempting to establish is essentially a new class of digital identity — not for a person, not for a device, but for an authorised AI acting on behalf of a person. If that standard takes hold, it becomes the plumbing that every agentic commerce experience runs through. If it doesn't, the alternative is a fragmented mess of proprietary implementations, each with its own security assumptions and failure modes.

Watch for formal specification releases from the FIDO Alliance or public commitments from additional payment networks and major retailers — those signals would confirm this is moving from coalition-building to actual standardisation, which is where these things either become infrastructure or become history.

NewsHive monitors these sources continuously. All signal titles above link to the original reporting.

Intelligence by NewsHive. Need help navigating what this means for your business? Contact GeekyBee →