ChatGPT Wallet lets agents pay without seeing your card number
OpenAI began rolling out ChatGPT Wallet, which lets ChatGPT agents pay for purchases with a stand-in card number, so the user’s card details are not shared with the agent or the merchant. OpenAI built it with American Express, Mastercard, and Visa. It runs inside dots, where a user’s dot completes the purchase on their behalf.
Merchants will have to do most of the adjusting. OpenAI says some websites may block agent purchases without meaning to, and fraud systems may flag legitimate ones, which ends in declines or cancellations. A retailer that tuned its defenses to stop automated checkout now has to tell wanted bots from unwanted ones.
How a purchase goes through
A user adds a card once. Before each purchase, the user reviews the items, the total, and the chosen card, then approves with Face ID, a fingerprint, or a similar check. The payment network then issues a token, which is a substitute card number with its own security code and expiration date, and the charge lands on the real card behind it. The card keeps its rewards and its protections for eligible disputes.
What sites need to fix
OpenAI published a Commerce Partner Playbook alongside the launch. It asks sites to set their CDN or firewall to recognize Web Bot Auth, a method for verifying signed requests from bots. It also asks them to work with their payment and risk providers on spotting agent purchases. OpenAI is working with the fraud vendors Forter, Riskified, Sardine, and Signifyd, and with the payment providers Adyen, Checkout.com, and Stripe. The tokens work with existing checkout flows. The risk engines sitting in front of those flows may still say no.
Luke Gebb, who heads global innovation at American Express, called the wallet the company’s “first American Express Agentic Commerce Experiences integration.” For now, access is limited to ChatGPT Pro subscribers in the US who are 18 or older and hold eligible US-issued cards.
Download: The IT and security field guide to AI adoption
