Last Saturday, a post with 8 million views explained how to shop with AI: "take a picture of your credit card, drop it in the chat," and the bot will find the best deal and order it.
That advice might be the simplest way anyone has described agent payments. The same advice also puts back together what the payments industry has spent nearly thirty years keeping apart.
For decades, the long number on your card was embossed, and a machine pressed it onto carbon paper at the register. You read it out over the phone. You handed it to a waiter who walked away with it.
So as new hands started handling cards, the industry kept hiding pieces of the card from them.
1997: three digits printed flat
Mastercard started issuing a three-digit security code in 1997, and Visa followed in the US by 2001. The code is printed flat on purpose. Imprint machines copy raised characters, so a carbon slip never captured it.
Stores aren't allowed to keep it after a sale, either. Its job is to show that whoever is paying has the card in their hands.
2006: the receipt forgets your number
Receipts used to print the full card number. Since December 2006, a receipt printed by a US register can show no more than the last five digits, and never the expiry date. The rule was written to stop identity thieves from picking card numbers off receipts.
2014: your phone gets its own number
When Apple Pay launched in 2014, it didn't send your card number at all. Your phone keeps a stand-in number made for that device, and every purchase sends it with a code that only works once. The store never sees your real card number, and if you lose your phone you can switch Apple Pay off instead of cancelling your card.
2026: Agents are the newest pair of hands
Imprint machines, receipts and phones each ended up with less of your card than the one before. Agents should get the same treatment.
An agent doesn't need your card to shop. The agent needs to find the thing, fill in the checkout and get an approval, from you or from the rules you set.
How we built it
At Agentcard, your card is encrypted on your device when you add it. We never see the card, and neither does your agent.
When your agent reaches a checkout, it fills in a placeholder card and the purchase waits for you. You approve it with Face ID, or with your voice and a passphrase if you're talking to a voice assistant. You can also set auto-approval rules ahead of time, like anything under $50, and only purchases at or above your limit come back to you. Once a purchase is approved, your real card is added at the very last step, on its way to the store.
The agent did the shopping. The agent just never held the card.
You add your card once, on your device. After that, each purchase is a quick approval, or nothing at all if it fits the rules you set.
If you're building an agent that buys things, your users' cards never have to go near it. Here's how the Vault works: agentcard.com/vault