JPMorgan blocks some AI agent purchases on Chase cards as merchants raise concerns
JPMorgan Chase is blocking some purchases made by AI agents, treating the virtual cards they use as commercial cards.
JPMorgan Chase is blocking some purchases made by AI agents, treating the virtual cards they use as commercial cards.
The card-level friction lands alongside a broader stance from the top of the bank. JPMorgan has also shut external AI agents out of retail customer accounts entirely.
Merchants and payment networks are now raising concerns about where that leaves AI-driven commerce.
How JPMorgan is blocking agents
The issue starts with how many AI agents pay for things. Rather than handing a bot a customer’s real card number, the tools often generate a virtual or single-use card for the transaction.
The problem is categorization. JPMorgan treats those virtual cards as commercial cards, and some purchases made through them are being stopped as a result.
Separately, CEO Jamie Dimon spelled out the bank’s broader position on AI agents during JPMorgan’s third-quarter earnings call on October 13, 2026.
He said the bank would not let external agents into customer accounts, citing the danger of what he called rogue agents.
Dimon framed the risk in terms of scale, warning about the possibility of thousands of rogue agents gaining access to customer accounts.
In practice, that means AI agents cannot log in to Chase accounts using a customer’s credentials.
The door is not fully bolted, though. JPMorgan still allows controlled, read-only access through approved third-party providers such as Plaid.
Banks and networks respond
JPMorgan is not acting alone. Between October 13 and October 20, 2026, several major US banks put restrictions on third-party AI agents.
- Charles Schwab
- Citigroup
- Wells Fargo
The payment networks, meanwhile, are not fans of the virtual card approach either.
Mastercard CEO Michael Miebach went further, arguing that the single-use model damages the transaction itself.
Mastercard’s preferred route is tokenized payments built specifically for AI interactions. Tokenization swaps a real card number for a substitute credential, so the underlying account details are never exposed to the agent or the merchant.
Card networks and banks, however, built their fraud and risk systems around a person holding a card, not software acting on someone’s behalf.
When a bot shows up with a freshly minted card number, those systems do what they were designed to do. They get suspicious.
Impact on merchants and developers
For merchants, the immediate cost is friction. A blocked AI-agent purchase is a lost sale that never shows up as a declined customer, just an abandoned bot.
Those friction points have prompted concerns among both merchants and payment networks. The networks are now exploring controlled ways to let AI commerce happen safely, rather than leaving every bank to draw its own line.
For AI developers, the message from the largest US bank is fairly direct. Credential-based logins are off the table, read-only access through approved aggregators is the sanctioned path, and virtual card workarounds may not clear at checkout.
Related
