AI agents are starting to plan, price, and pay for trips on a traveler's behalf. Here's what's actually live today, and where the payments infrastructure, the fraud risk, and the law still don't agree.
"Agentic commerce" means an AI assistant that does more than answer questions - it compares prices, builds an itinerary, and in a growing number of cases, completes the purchase. The planning half of that shift is already normal. The paying half is still the sticking point.
An AI agent can't hand a merchant a physical card. Instead, the card networks built a new credential: a token tied to one agent, one merchant, and a spend limit the cardholder set in advance. Five major players - Visa, Mastercard, American Express, Google, and Stripe/OpenAI - have each shipped a competing version of this within about a year of each other.
"Token" actually covers two different jobs here, worth separating. Visa's Trusted Agent Protocol is a recognition layer - a cryptographic signature that tells a merchant "this is a real, sanctioned agent, not a bot," built on standard HTTP message signatures. It doesn't move money. The actual spending credential is a separate, scoped payment token - issued through Mastercard Agent Pay, Visa Intelligent Commerce, or American Express's own ACE developer kit - that caps what the agent can spend, where, and for how long.
Neither the card network nor the agent invents the spending rules - a human always sets them. But where that consent gets captured differs by network, and that detail carries more weight for adoption than the specifications make it sound.
Mark Nelsen, Visa's global head of consumer products, described the model to PYMNTS using a travel example directly: a cardholder can set "a $500 ceiling for a hotel or an airline ticket," and the agent works within that constraint automatically.10
Recognition is the solved half of this problem - a merchant can now cryptographically confirm an agent is legitimate rather than a bot. Liability is the unsolved half: who's on the hook when a properly recognized agent still gets the transaction wrong depends on which rail it ran on, and today's default fraud rules were largely written for a human at a keyboard.
Zero: the number of federal exemptions carving AI-driven transactions out of existing consumer-protection law. The CFPB has stated that AI-driven financial tools remain fully subject to existing law, with no exception for new technology.12 13
In practice: a merchant that accepts agent-initiated payments is bound by the same consumer-protection and UDAAP obligations as any other checkout. "The AI did it" isn't a liability shield - if a booking is completed incorrectly, standard remedies still apply, and the burden of proving proper authorization still runs through the merchant's own systems.
The "is this the same everywhere" question isn't just about which network carried the transaction - it's also about which jurisdiction the transaction happened in. The US and EU are heading toward genuinely different liability models, on genuinely different timelines.
The instinct is to assume agents flatten the whole industry evenly. What's actually showing up is a split: the most commoditized bookings automate fastest, while both the most human-dependent and the most loyalty-anchored segments hold their ground.
Whoever owns the trust layer - the token, the identity check, the liability chain - owns the booking. Owning the inventory is no longer enough.
Every one of these depends on whether a brand exposes clean, structured data for an agent to reason over - or leaves an agent guessing.
IDC projects that by 2030, 30% of travel bookings will be executed directly by AI agents - which only works if brands expose accurate guest data for an agent to act on, not just for a human to browse.18
Business travelers surveyed for Direct Travel's 2026 forecast describe loyalty as less about points and more about experiences that fit how they actually travel - a harder thing for an agent to shop around on price alone.17
33% of travelers already expect individually tailored communication, and brands that deliver it can command up to a 20% price premium.19
More than 60% of travel businesses are already experimenting with or scaling AI-driven dynamic pricing, per Phocuswright - raising the stakes on pricing transparency once an agent, not a person, is the one comparing rates.20
Open to conversations about VP and Director roles in loyalty, travel, and payments - and to advisory conversations on where agentic commerce is headed next.
Industry analysis; not legal or compliance advice. August 2026