If an AI Agent Spends Your Money by Mistake, Who Pays? Probably You

AI tools that book flights, reorder groceries, and pay bills for you are no longer a demo. They’re showing up in apps people already use. The pitch is simple: tell it what you want, and it handles the clicking.

The part nobody puts in the ad is what happens when it clicks wrong. You said “book me a cheap flight to Denver next week” and it booked a nonrefundable $1,240 ticket for the wrong Saturday. Who eats that?

Right now, the answer is mostly you. Let’s walk through why, and what to do about it.

Consumer protections for payments were written for two situations: someone stole your card, or a merchant cheated you. An AI agent that you authorized is neither.

Take credit cards first. Under federal law (Regulation Z), your liability for unauthorized charges on a stolen card is capped at $50, and most issuers waive even that. But “unauthorized” is the key word. When you voluntarily hand someone access to your card, you’re generally on the hook for what they charge, even if they go beyond your instructions. An AI agent you set up and connected yourself looks a lot like that person.

Debit cards and bank transfers fall under Regulation E, which has a stricter clock. If your debit card is lost or stolen and you report it within two business days of finding out, you’re liable for up to $50. Wait longer and it goes up to $500. Miss the 60-day window after your statement, and you could lose everything taken after that point. That’s a real risk for a debit card, because the money leaves your checking account immediately.

Here’s the gap, though. A purchase the agent made at your request, just with the wrong details, probably isn’t “unauthorized” under either rule. Regulation E says so directly: a transfer made by someone you gave your card or login to doesn’t count as unauthorized until you tell your bank that person’s access is cut off. The official commentary to Regulation Z takes the same line for credit cards when someone you authorized goes beyond what you allowed. That cuts both ways, though. Once you notify your bank or card issuer that the agent is no longer allowed to use your account, charges it makes after that are treated as unauthorized. NerdWallet, citing a January 2026 Consumer Bankers Association report, notes that federal rules haven’t been updated to assign liability when you hand an AI agent your accounts, and one payments CEO put it bluntly: there’s no mechanism for that today. Some AI platforms put the blame on the user in their terms of service. Others offer limited purchase protection, with dollar caps.

Let’s put numbers on it. Say you let an agent handle small errands on a debit card tied to your main checking account, which holds $3,800 until your next paycheck.

Add those up and you’re at $2,808, most of it on a card with weaker protection and money you needed for other things. That’s not a hypothetical to fear. It’s a reason to set this up carefully.

Credit cards beat debit here, and it isn’t close. A disputed charge on a credit card is the issuer’s problem until it’s resolved. A disputed charge on a debit card is your rent money gone while the bank investigates. For the billing error dispute process, you generally have 60 days from the date the charge shows up on your statement to notify the card issuer.

Use a credit card, ideally a separate one with a low limit. If your card issuer lets you create virtual cards, make one for the agent with a limit like $200. The worst day then costs $200, not $2,800. Some issuers also let you freeze a virtual card in one tap.

Turn on approval for every purchase over a small amount, say $25. Yes, that defeats some of the convenience. Good. The convenience is exactly where the risk lives. One of the fixes experts are pushing is a human checkpoint before money moves, and you can build that yourself today.

“Find me a cheap flight” is how you end up in the wrong city. “Book the 7:05 a.m. nonstop on Saturday, October 17, under $300, refundable fare only” leaves little room for guessing. A related tip: save the instructions you gave. If you ever need to dispute something, a record of what you actually asked for helps your case.

You don’t need to read the whole agreement. Search it for the words “liability,” “refund,” and “authorized.” If it says you’re responsible for everything the agent does, believe it.

Not monthly. Weekly. A 60-day dispute window sounds generous until a charge from week one is buried in a long statement. A five-minute Sunday check keeps small mistakes from becoming big ones.

Regulators and card networks are working on this. Ideas on the table include recording your intent as part of the dispute process, requiring agents to get your approval at certain transaction checkpoints, and creating agent-specific wallets with built-in spending limits. None of that is law yet, so don’t count on it protecting you today.

My take: use these tools for small, repeatable, low-stakes tasks. Don’t hand one the keys to your checking account and walk away.

If you connect your accounts in the SuperMoney app, you can see every charge across your cards and banks in one feed and spot an odd one fast. It also helps to set a monthly budget for the agent’s card, so a runaway purchase stands out immediately.