Six major banks warn AI shopping agents raise scam, fraud and privacy risks

Six major banks warned in a joint report published on Tuesday that using AI agents for online shopping could increase the risk of scams, fraud and data-privacy breaches. The report was signed by NatWest, Bank of America, ING, New Zealand's ASB Bank, Capital One and Commonwealth Bank of Australia.

What the report says

"Consumers are unclear if AI will act in their interests," the report said. "They are concerned that AI agents may buy the wrong thing or spend too much – or even worse, lose their money to scams and fraud. They are not sure whether they will be protected or who they will need to go to if things go wrong."

Where the risks come from

The report highlights scenarios in which an AI agent asks for a customer's card details and enters them directly into websites, or steers users towards payment methods that offer weaker protections. Agents may also favour certain products or payment options because of incentives such as higher commissions or lower token costs, rather than because they are best for the customer. A data breach, meanwhile, would put sensitive information belonging to both shoppers and merchants at risk.

Why now

Technology companies including OpenAI, Anthropic, Google and Meta are promoting AI chatbots as shopping tools, while retailers are racing to influence their recommendations. British retailer John Lewis said in September that searches originating from AI agents had risen to 2.5% from 0.3% a year earlier. The banks said customers were enthusiastic about agentic commerce and keen to enable it, but the technology is advancing faster than industry standards and consumer protections.

What the banks propose

The banks plan to discuss a series of proposals with policymakers: requiring disclosure when an AI agent is involved in a transaction, greater transparency over how agents make decisions, and safeguards to protect customer data. Consumers and merchants should also be free to choose which AI-powered e-commerce services they use, and different systems should be interoperable, the report said.