The Inevitable: JPMorgan Blocks the Card Number. Not the Spend Rule.

JPMorgan Chase is blocking AI agents from shopping with its customers' card numbers, the Wall Street Journal reported Friday, November 13. Cards from Bank of America, Capital One and Citigroup are already used by agents when the customer allows it. The harder question sits behind both policies. Six months after an agent buys something and the customer disputes it, what can anyone check to see what the customer authorized at the time? JPMorgan's debit and credit card volume was $539.5 billion last quarter, up 10% from a year earlier. On the bank's October 13 earnings call, CEO Jamie Dimon said of outside agents: "You don't want rogue agents, and there could be thousands of them."

A Bank Draws a Line at the Card Number

Here is the shape of the rule. If a customer gives an agent a Chase card number, Chase blocks the charge. If the customer gives an agent a Bank of America, Capital One or Citigroup card number, the charge can go through with the customer's permission. The agent is identical. The merchant is identical. What changes is the bank that issued the card.

Stripe built a workaround and it is popular. Link has more than 300 million users and is accepted at more than a million businesses, PYMNTS reported in September. At merchants that accept Link, an agent like Meta's Muse pays with the shopper's saved method. (Amazon blocked Muse in September for a different reason: it logged in as the customer.) Everywhere else, Link issues a single-use virtual card for the amount the shopper approved, Stripe bills the shopper's own card separately, and the agent never sees the real number. Anthropic's Claude Duet buys business supplies the same way.

Merchants are not thrilled. They told the Journal the virtual card is classified as a commercial card, which costs more on average to accept than a consumer card, and that temporary cards make returns harder to process. On Mastercard's Q3 earnings call, CEO Michael Miebach called the virtual card number "a bridge to get ready for a fully tokenized transaction." The tokens he means are in the market today. Visa and Mastercard's agentic tokens hide the card number and carry the shopper's spending limits, and Link supports them. JPMorgan has been slow to adopt them, according to people familiar with the matter.

The Decision Inside the Block

The controls are real. Shoppers approve amounts. Tokens carry limits. Banks set policy. What the bank, the merchant and the dispute reviewer still need is one answer each of them can check later: did this customer authorize this agent, within what limits, and was that authority still in force at the moment of the charge. JPMorgan's rule does not ask. An agent holding a Chase card number is refused, however narrow or reasonable the purchase. Several other banks plan to go the other way and treat a charge from an agent holding the card as the cardholder's own, like a card handed to a family member. Both policies turn on who holds the number. Neither records what the customer agreed to.

Coinbase moved closer to the real question on November 11, announcing a dollar cap per trade, a 24-hour trading cap and an auto-stop that pauses an agent once a portfolio falls past a set percentage. The limits run on Coinbase's servers, where the agent cannot change them. That placement matters: when Cornell Tech and Yale researchers gave models a capped wallet and the inbox holding its one-time codes, nine of ten raised their own cap in at least one run. Coinbase's limits are also Coinbase's alone. A merchant, a card network or a dispute analyst six months later cannot check that limit independently. They would have to ask Coinbase.

United Airlines took the other path the same day, barring unauthorized third-party AI agents from completing bookings while its fares stay searchable through the large aggregators. The instinct matches JPMorgan's: close the door when there is nothing at the door to check. We covered a related gap last week in Who Authorized This Agent's Transfer?, where a bank could spot that an agent was acting and had no gate for the moment that mattered. This week the gate exists. It asks who holds the number.

Why Handing Software the Number Fails

A card number is a bearer secret. Anyone who gets the number can attempt a charge, which is why JPMorgan refuses to see one in an agent's hands. Software that acts for a user copies, logs and stores what it is given, so a secret handed to an agent is a secret with more places to leak.

Stripe's single-use virtual card is an improvement: it is short-lived and scoped to one approved amount. A network token goes further, because the limit rides with the payment. Both answer the question at checkout. A dispute asks it again months later, and the reviewer then needs the specific authorization and its scope in a form that can be verified without relying on any one company's account of what happened. That is the record worth designing for.

The Check and the Record

Cards are secrets. Spend limits should be signed. Part of the dispute question is an on-chain fact, and an on-chain fact can be checked without handing anyone a number. An agent's authority can be written as an ERC-7710 delegation: the customer's wallet signs it, naming the agent's wallet and the limits. POST /v1/attest evaluates that delegation on Base. The agent's wallet is the delegate, the customer's wallet is the delegator, the signature verifies, and the delegation is not revoked as of block N. The limits the customer signed come back decoded inside the signed result. A ratio condition can run beside it, such as a wallet holding at least ten times the purchase amount, a rule that needs no retuning as purchase sizes change. The caller gets a signed yes or no. Boolean, not balance: nobody downstream learns what the wallet holds.

Here is what the reviewer would have. The merchant keeps four things together. Its own payment record, showing the order, the merchant, the amount, the time of the payment decision and the ID of the attestation checkout relied on. The delegation the agent presented. The signed result, which names both wallets, the delegation hash, the limits the customer signed, the block number and the time. And a copy of the published keys, so both signatures can still be checked years later.

A delegation result is good for a decision for five minutes, because revocation is one transaction away. As evidence, the result lasts as long as the merchant keeps it. What revocation evidence looks like is the subject of Wells Fargo Wants Proof You Revoked Your AI Agent. Every result is signed twice: ES256 and a post-quantum ML-DSA-65 signature, so the record stays checkable for as long as it must be kept, the durability we wrote about in Tokenized Stock Trading Starts Now. Its Records Must Outlive the Signature. The reviewer does not call InsumerAPI for a verdict. The open-source insumer-verify library checks the signature and the condition hash against those keys, offline. The signed result shows what the delegation said at that block. The payment record is what ties it to this charge: the attestation ID stored there picks out the exact signed result, even when the same delegation was checked for several orders.

The standards work is moving toward this record. Verifiable Intent, the open specification for agent payment authorization that Mastercard introduced in March 2026, is designed to keep a tamper-evident record of what a user authorized when an agent acts for them, one the parties can use to resolve a dispute. Our proposal there adds one narrower thing: a mandate could also require fresh, signed evidence that a wallet condition held before the agent acted, verified against the issuer's published keys. It is in review, not merged.

On the Ethereum side, ERC-8478, a draft for x402 payee verification, was revised after our review proposed making the seller's published payee list binding. A seller can now remove one receiving address on a given network without invalidating delegations for other payees. The alternative was resetting the agent wallet, which voids every other delegation at once. The longest a delegation can run also fell from 365 days to 90.

For a merchant whose own API takes agent traffic, Skye Meta builds on InsumerAPI. Skye Meta's @skyemeta/access is free MIT-licensed middleware for Node that lets existing API-key customers pass through unchanged while agents authenticate by signing with their wallet instead of presenting a key string.

The Counterfactual

What if the rule at the card had been a condition instead of a block? Each party would have a job. The customer's wallet signs a delegation to the agent's wallet, capped at an amount and open until the customer revokes it. The agent never receives a card number, real or disposable. At the moment of purchase the merchant's payment flow calls /v1/attest and gets a signed yes: this delegation, from this customer's wallet to this agent's wallet, unrevoked as of this block. InsumerAPI's part ends there. The payment flow still has to tie that evidence to the customer, the agent and the specific order, enforce the amount and merchant limits, and submit the charge through a credential the issuer supports. How the charge is priced depends on how it is routed and classified, and a signed result does not decide that.

What the signed result changes is the dispute. WilmerHale's November 10 client alert put the open questions for financial institutions as consent, authority and responsibility for transactions an agent initiates. Six months later, a reviewer can verify what InsumerAPI attested about the delegation and check the payment record to see which order, merchant and amount the checkout applied it to. The attestation half of that does not depend on Stripe, the bank or the agent's builder still being around to vouch for it. A block can stop the charge today. A record lets a reviewer reconstruct the decision six months later.

What to Do Next

If you are building the agent side, give your payment flow a condition it can check before the charge. The agent verification guide documents it, and a free key is at /developers/quickstart/. If your agent pays per call with no account, x402 covers that at /pricing/#x402, and The Five-Cent Standing Check walks through a delegation check paid that way. If you are the bank or the merchant in this story, the choice is wider than block or allow. A signed condition checked per purchase, and kept, answers the question a blanket rule leaves open.