What Happens When AI Agents Can Spend Your Money?
- In the last three months, agents jumped from “spectators to actors” because payment credentials are their “arms and legs.” Terry Angelos, VGS chief strategy officer, says access to payment credentials makes agents much more useful. His example: an agent didn’t just recommend piano teachers; it checked schedules and booked the first lesson, “infinitely more useful than dumping yet another task on my doorstep.”
- That shift has “kicked off what I call the wallet wars”—every wallet racing to connect to agents. Agents want a wallet with many consumers who already have credentials stored and broad merchant reach: Stripe Link has about 300M consumers and 1M merchants; Shop Pay has similar consumer reach and probably about 1.7M merchants; PayPal has over 400M accounts, depending on measurement, and around 30M merchants.
- Terry’s sharpest frame: “Stripe in many ways is like the AOL of agentic commerce”—a walled garden that works until its limits get in the way. When Link lacked a Walmart connection, Stripe bought Terry’s outdoor lights with a one-time Visa virtual card and charged him separately. But Walmart’s follow-on Walmart+ offer failed because that one-time-use card couldn’t support the new transaction. In a test, AmEx sent someone seeking help with the transaction to a phone number that went straight to a Stripe engineer—not a chargeback process.
- The open-standards answer—network “agentic tokens”—went from zero to “a few million of these tokens per week” in three months, with VGS “by far the largest provider.” A registered, verified agent gets a new 16-digit token with transaction context; the merchant charges the consumer’s real card, preserving network chargeback rules and follow-on transactions. Agent-error liability remains unresolved.
- VGS’s position is built on scale and neutrality: it secures credentials for “about a third of all e-commerce by GMV,” holds 10 billion credentials, and serves the largest merchants, neobanks, and frontier labs. Terry’s thesis: vaults are going “from single-player to multiplayer”—for example, a frontier lab’s subscription vault can now make credentials available to agents—and “any business going from single-player to multiplayer inherently becomes more interesting.”
- Merchant responses may split three ways: “fear on the Amazon side, greed on the Walmart side, and no choice on the SMB side.” Alex Rampell says Amazon has rational reasons to resist agents: “you can’t monetize an agent’s eyeballs because the agent doesn’t have eyeballs.” Terry sees an open-banking parallel: negotiated access through APIs that may limit data and may carry fees.
- Agent liability is unresolved—and could become a competitive differentiator. Terry says that if an agent makes a mistake despite the network validating the agent and instruction, the dispute mechanism is “sort of unresolved”; he thinks agents may have to take responsibility. Overhyped: a bank run from yield-maximizing agents. Underhyped: unmonetized demand—“human desires and needs are infinite”—while rewards and other breakage models may be disrupted.
1. VGS is the boring, neutral vault behind a third of online commerce
- Terry’s description: VGS captures, vaults, and retrieves payment credentials so “the online ordering company never actually has to touch the payment information.” It secures about a third of all e-commerce by GMV, serves the largest online merchants, neobanks, and frontier labs, and stores 10 billion credentials. Rampell says he almost guarantees listeners have a credential stored at VGS through a merchant that uses it. He also describes VGS as taking PCI compliance out of scope.
- Why merchants can’t easily do this themselves: a merchant doing about $1B in GMV typically uses three to five processors for differences in costs, approval rates, and regions—“you want to shard.” Each processor multiplies the vaulting and update burden. About a third of cards turn over each year; network tokens are domain-bound to a merchant, and networks have their own standards for updating credentials.
- Rampell’s example of the failure mode: his Capital One Visa became a Discover card after the acquisition, and “every week I get notifications from very sad merchants—we are unable to process your card.” One merchant cannot map the old card to the new one; a large vault can use network account-updating tools to get those updates. VGS acts as an independent vault for merchants using multiple processors.
2. Agents got arms and legs—and the wallet wars began
- The episode’s central claim, in Terry’s words: “in the last 3 months we’ve had this huge leap from agents being what I would call spectators to agents being actors... they effectively have arms and legs, which are payment credentials.” His piano-teacher story carries it: an earlier ChatGPT query produced recommendations, but an agent later asked questions, checked schedules around his son’s activities, and booked the first lesson.
- The structural consequence: “we’ve kicked off what I call the wallet wars where every wallet is now rushing to connect to the agents.” An agent wants two things from a wallet: many consumers with stored credentials and broad merchant reach. Terry sizes the field: Stripe Link has about 300M consumers and 1M merchants; Shop Pay has similar consumer reach and probably about 1.7M merchants; PayPal has over 400M accounts, depending on measurement, and on the order of 30M merchants.
- Rampell’s historical rhyme: wallet wars are old—from “dead-cow wallets” and Capital One paying Samuel L. Jackson to the NASCAR-like checkout page, with issuers such as Chase and AmEx paying tens of millions of dollars to get their cards preferred at Uber and Airbnb. The 2 a.m.-flowers problem that helped motivate consumer wallets is also an agent friction problem.
- Terry distinguishes wallets that store a credential and hand it to a merchant from transaction wallets such as Shop Pay, Link, or PayPal, which collect money from the consumer and remit it to the merchant. Agentic commerce is becoming a blend of the two.
3. Stripe is the AOL of agentic commerce—and the walled garden can break trust and merchant relationships
- Terry’s chandelier story, told as a compliment: “Stripe in many ways is like the AOL of agentic commerce.” An agent found outdoor lights at Walmart, but Link had no Walmart connection. Stripe bought the item on Terry’s behalf with a one-time Visa virtual card, then charged him in a second transaction, DoorDash-style. The purchase worked, but the arrangement created problems.
- Disputes: if Terry calls his bank about a Walmart purchase, “we don’t see a Walmart transaction here—we just see a Stripe transaction.” In a test, someone used an AmEx card and called AmEx about a transaction with the merchant; AmEx only saw Stripe and provided a phone number for the Link merchant. The call went straight to a Stripe engineer, because Stripe wasn’t set up to run a chargeback.
- Follow-on merchant relationships: Walmart emailed Terry about crediting his $6.99 delivery charge toward Walmart+ if he subscribed. The subscription transaction failed because the card Walmart had was the Stripe one-time-use card. Terry frames this as a break with e-commerce norms: merchants spend money to acquire customers and want the chance to build a relationship and upsell them.
- Rampell’s underlying point about why Visa and Mastercard are “impregnable”: chargebacks are a trust mechanism that makes both sides willing to transact. Crypto, by contrast, is a bearer instrument: “I pay you with crypto, I’m never getting that back,” which can be a bug or a feature.
4. Agentic tokens went from zero to millions per week, and vaults turned multiplayer
- The open-standards approach: card networks’ agentic tokens let wallets hand credentials to agents safely. The agent must be registered with the network, and the transaction can carry context—for example, “I’m about to make a transaction. I’m a verified agent. I’m going to spend no more than $100.” The agent passes a new 16-digit number to the merchant, which charges the consumer’s card, preserving chargeback rules and the possibility of follow-on transactions.
- The growth number worth remembering: “3 months ago, this was at zero. It did not exist... now we’re doing a few million of these tokens per week,” with VGS “by far the largest provider.” VGS supplies them for agents, wallets, and some merchants.
- Terry’s generalization: vaults are going “from single-player to multiplayer.” A frontier lab that vaulted cards to bill subscriptions can now make that credential available to its agent under open standards—much as a personal vault can be shared with others. “Any business that is going from single-player to multiplayer inherently becomes more interesting.”
5. Valid card, valid owner, sound mind—agent liability is the open question
- Rampell’s three-step framework: is the card valid (a checksum can establish that it is in the valid universe of numbers, and the bank can confirm it is an actual card); is the person interacting with the merchant the valid owner; and, in his Vegas example, is the buyer of sound mind? The internet made the second question hard to answer; agents make it harder still.
- The networks’ standards address agent identity: the agent must be registered with Visa, Mastercard, or AmEx, and the transaction can include context about what it is authorized to do. But Terry says the standards do not yet resolve what happens if an agent gets the details wrong—such as booking the wrong hotel dates even though the network validated the agent and instruction. That dispute mechanism is “sort of unresolved”; he thinks agents may have to take some responsibility.
- Rampell’s delegated-authority concern: merchants have dealt with “friendly fraud,” such as a consumer disavowing a purchase they did make; for small transactions, banks may refund consumers rather than fight. He says that creates moral hazard, and suggests an agent’s willingness to take liability could become a value-add in competition for users.
6. Amazon’s incentives to resist, Walmart’s possible opening, and SMBs’ limited choice
- Amazon recently blocked Muse. Rampell says the antagonism is rational, not simply laggard behavior: Amazon is an advertising company, and “you can’t monetize an agent’s eyeballs because the agent doesn’t have eyeballs.” He argues that selling attention can be more valuable than selling the product.
- Terry’s tentative taxonomy: “maybe there’s fear on the Amazon side, maybe there’s greed on the Walmart side”—a major retailer with strong last-mile delivery might see agents as an opportunity—“and maybe there’s no choice on the SMB side,” where merchants under Shopify may see a vital new channel. His open-banking analogy is the Plaid-and-banks experience: negotiations could result in access through APIs that limit what data is shared; account tokenization and possible fees were also raised.
- Terry also imagines merchants having their own agents, like a Best Buy salesperson who helps a customer but earns a commission. Amazon might function as an “opinionated API” with its own view of what a customer should buy, in conversation with the customer’s agent. “In the end, I think consumers probably win, but we don’t know what that’s going to look like.”
- Rampell warns that early consumer wins depend on asymmetry: a small number of consumers have tools that counterparties may not detect. Terry’s restaurant-reservation example is that the first few people with a tool to call at 7 a.m. benefit, but if everyone uses it, the venue gets too crowded. Rampell says Comcast appears to block some agent logins, possibly based on IP addresses; he says he has ChatGPT, Codex, and Astra log in on his computer to do tasks. He expects counterparties eventually to recognize agents and demand to speak to the person instead.
7. Overhyped, underhyped, and VGS’s three compounding eras
- Overhyped, per Terry: “I don’t think we’re going to get a bank run on savings deposits” from agents moving money to maximize yield. He contrasts a Mercury personal account with Chase: even if Mercury offers a good savings rate, Chase’s bill pay and integrations work better for him, and that friction limits the prospect of extreme volatility.
- Underhyped: unmonetized demand. Terry’s cycling WhatsApp group has a member who periodically recommends tires based on rolling resistance; Terry says he would buy them more often if his agent acted on those recommendations. Agents may also save money by finding forgotten subscriptions or trials that are hard to cancel. “As far as I can tell, human desires and needs are infinite.”
- Another potential disruption: if agents intermediate transactions and route spending to the card that earns points, the card-rewards ecosystem—and other models built on breakage—may have to change.
- Where VGS goes: Terry describes three overlapping eras—the vault, built over a decade into a trusted store for credentials; information going into and out of the vault, including updates and network tokens; and the “network era,” brokering credentials among parties according to the rules. VGS is also working with banks on tokenization. As it adds services for more merchants and issuers, Terry expects network effects; “agentic commerce is just fuel into that ecosystem.”
Full transcript
In the last 3 months, we’ve had this huge leap from agents being what I would call spectators to agents being actors, because they effectively have arms and legs, which are payment credentials.
Amazon recently blocked Muse, and there are many reasons for this. You can either be antagonistic to agent commerce or highly receptive.
1. The wallet wars
What’s happened with the rise of Muse and Instinct is that once they have access to payment credentials, their utility increases. We’ve kicked off what I call the wallet wars, where every wallet is now rushing to connect to the agents.
Everybody listening to this podcast, I almost guarantee, has a credential stored at VGS.
The largest online merchants, the largest neobanks, and the largest frontier labs all use VGS to secure payment credentials. It’s a really formidable position to be in.
Where do you think VGS is going to go?
I think we are.
2. What a payment credential actually is
Hi, everyone. I’m Alex Rampell, a partner at Andreessen Horowitz, and I’m here with Terry Angelos. I’m very excited to be joined by Terry because he and I started a company called TrialPay in 2006. A long, long time ago—20 years ago.
20 years ago. Alex looked very different.
Yes. You look the same. I think you’re insulting me and I’m complimenting you, and hopefully not the other way around. But today, this is the really cool part: one of my first investments here was a company called VGS, which stands for Very Good Security. Some people might not get that it’s actually a pun or a joke, because one of the most famous cryptography companies was called PGP, which is Pretty Good Privacy. Obviously, it’s Very Good Privacy. It’s not just Pretty Good Privacy; it’s incredible privacy. It’s unbreakable privacy, because that’s how you know it’s very hard to factor very large composite numbers into their primes. Pretty Good Privacy is actually very good, so that was kind of the original name for Very Good Security.
I led this investment a long time ago. TrialPay got bought by Visa. Visa, under your leadership, invested in VGS, and now you’re back as the chief strategy officer and a board member alongside me at VGS.
Yeah, it’s been a very fun and incredible journey. If you look at VGS today, it’s a payment infrastructure business. We secure credentials for about a third of all e-commerce by GMV. The largest online merchants, the largest neobanks, and the largest frontier labs all use VGS to secure payment credentials.
Part of the reason we want to talk about agentic commerce is that VGS is involved in helping agents get those credentials, helping wallets hand those credentials to agents, and also helping merchants receive them. We’re in the middle of these really interesting conversations and handovers between credentials.
Maybe we should dig into what a credential is. For most laypeople, a credential is a fancy way of saying a credit card. It gets a little more complicated than that when you really dig into it. I don’t know which merchants I’m allowed to say you work with. You work with all the big ones, but why don’t we take an example merchant you work with, from before AI and agentic commerce, and explain what you do? Why do they use VGS? What do they use you for, and how pervasive is it?
Let’s assume we’re working with a very large online ordering platform. Every time a new customer comes onto that site and hands over a credit card, the company doesn’t necessarily want to be exposed to that card number. VGS is involved in capturing that card, securely vaulting it, and storing it. Every time the online ordering service wants to transact with one of its processors, it goes to the vault and retrieves the information in such a way that the online ordering company never actually has to touch the payment information.
One thing that’s made VGS a lot more interesting since the days you first invested is that, over a decade, it’s become the most trusted vault online. The card networks have also introduced a form of tokenization. Back in our days at TrialPay, we would store a 16-digit PAN and encrypt it and vault it.
A PAN is a primary account number.
A PAN is a primary account number.
A credit card number. It’s the 16-digit number you have on your card.
We would encrypt it and vault it, and then, when it came time to charge someone, we might decrypt it and give it to Chase Paymentech, I think, back in those days. Today, that doesn’t happen. Instead of storing that 16-digit card number and using it, you actually go to the network that issued it—Visa, Mastercard, Amex, Discover—and say, “I would like another version of this card that’s domain-bound just to my merchant domain.” That’s safer, because if there’s ever a problem, the only number I have only works on my merchant domain. I’m going to use this when I send it to Chase Paymentech.
VGS vaults all these credentials on behalf of the merchant and also gets all the network tokens, which are the primary way these credentials are passed to the payment processor and the network. That’s what we do today. Because of the complexity of interacting with the card networks and doing this across multiple processors, here’s a question for you, Alex: If you’re a merchant with over a billion dollars in GMV, how many payment processors do you have on the back end?
Well, it depends. There are plenty that just have one, but you’re right. This goes to the use case for VGS: rather than being locked into one payment processor, you’d rather unbundle that and pick and choose which payment processor you use. But if you have shared infrastructure that is storing credentials, what if one credential goes bad? What if my—I just had a Capital One card. Great example. Capital One bought Discover, or the Discover Network, and then my fancy Capital One cashback rewards 1.5% Visa card became a Discover card.
Every week, I get notifications from very sad merchants: “We are unable to process your card.” Why are they unable to process my card? Because that old card number doesn’t exist anymore, even though I still have a relationship with Capital One. I just got a new card number from them.
Granted, it’s a little bit complicated. It’s on a new network. There’s also the possibility that merchants can’t just say, “Oh, we’ve seen that this card became that card.” One merchant cannot do that.
Yeah. But a large vault can do that. The networks themselves—Visa, Mastercard, and Discover—have these account-updating tools. You could say, “Hey, I’m a merchant. I have all of these card numbers.” What is it, every year, like 10% of cards expire?
Yeah. About a third of all cards get turned over every single year.
No, even more—like 25% mathematically, because it’s a four-year expiration.
And another 5% due to, in this case, Capital One buying Discover, or fraud, or something else. Back to that question: for a merchant doing about a billion dollars, it’s about 3 to 5 processors.
They don’t have to.
They don’t have to, but they should. That’s the average we see across the board.
There’s a reason for them to do that: different costs, different approval rates, different regions. You want to shard.
Correct.
In computer science terms, you want to have all of your cards, and if you just say, “I use the same processor every single time,” that’s not as good an idea as having multiple processors. But to do that, I have to be able to securely send the card number to the processor I’ve chosen.
Yeah, that’s right. Once you have multiple processors, the job of vaulting and getting updates is multiplied by the number of processors. Maybe I have 100 million cards as a merchant, but I have to store 100 million with Chase, 100 million with Stripe, and 100 million with Braintree. Each of those vaults has to be updated at its networks.
VGS serves as an independent, neutral vault infrastructure on behalf of merchants for vaulting and updates, so the merchant can then send a Visa token to the merchant via Stripe.
Right?
Back to your annoying Capital One issue: if you’re a VGS merchant, that should not happen. There are mechanisms to get those updates when Capital One is switching from Visa to Discover, and certainly if there’s fraud or something else. That’s the role VGS is playing.
3. When agentic commerce changed the game
Yep. Exactly. Hopefully, everybody has a good understanding now of what Very Good Security—VGS—does. This was a good business years ago. I’ve been a believer for a long time, and then this whole thing called agentic commerce showed up.
How does the world change? You guys are at the center of this because a lot of AI companies have decided to work with VGS. I don’t know which companies I’m allowed to name, so let’s just say that. If I go into my little chat tool and say, “I’d like to buy flowers for my wife. It’s Mother’s Day,” she’ll be mad if I don’t buy them and happy if I do. Please buy them. Maybe I want to give my credit card number to a chat app, but they don’t want to store it. And even if they do store it, they have to communicate it to the merchant. How do they do that? The better option is to have a third party that already knows how to do this.
Yeah.
So you take PCI compliance out of scope. It’s interesting: I don’t know if most of our audience knows what the PCI DSS rules are. That’s the payment card initiative digital security system, if I remember correctly. Did I get that right? If you’ve heard of PCI compliance, it says that if you’re going to be a merchant and accept credit cards, there’s a document—I think the last time I read it, it was over 100 pages—of all the rules you have to follow and maintain to be PCI compliant.
Why is being PCI compliant so important? Because every bank demands it. You can’t process credit cards unless you’re PCI compliant. You can’t issue credit cards unless you’re PCI compliant. That’s why it’s the Payment Card Industry: Visa and Mastercard might be enemies, but on this they agree—you have to be PCI compliant.
One of the nice things VGS does is take PCI compliance out of scope. You can basically say, “I can just run my business like a normal business. I don’t have to follow these 100 pages of rules.” VGS just focuses on that, right? Which goes back to wanting my chat application to buy flowers for my beloved wife. VGS is pretty well positioned here just by being the backend infrastructure, but now it can take a pretty vital role in this whole process.
Yeah. I think in the last 3 months we’ve had this huge leap from agents being what I would call spectators to agents being actors. How do they act on my behalf? If you give them a payment credential in a safe way—
Right.
—I can go from recommending flowers for your wife to buying them. I’ll give you an example. Just last night, my wife and I were talking about getting a piano teacher for our 7-year-old son. It’s complicated because we have to know our schedule—he has soccer 3 days a week—and we want someone who can come to the house. We also have to know the piano teacher’s schedule.
I asked ChatGPT about this a while ago and got some recommendations, but just last night I asked an agent, and it did the entire transaction for me. It found a bunch of people, asked me a few questions, checked the schedule, and booked someone for the very first lesson. That’s infinitely more useful than dumping yet another task on my doorstep.
Agents have suddenly become significantly more helpful and useful because they effectively have arms and legs, which are payment credentials. With the rise of Muse, Instinct, and Town and other AI agents, once they have access to payment credentials, their utility increases. We’ve kicked off what I call the wallet wars, where every wallet is now rushing to connect to the agents.
As an agent, I want a wallet that has two things: the most consumers who already have a credential at that wallet, and broad merchant reach. Right now, that means companies like Stripe Link. About 300 million consumers have an account at Link, and about 1 million merchants use it. Then you have Shopify with Shop Pay: similar consumer reach, probably more like 1.7 million merchants. Then you have PayPal, with over 400 million accounts—it depends on how that’s measured—and on the order of 30 million merchants. These wallets are connecting to the agents and providing a lot more utility.
It’s interesting, though, because wallet wars have been around for a while. Remember—not to speak ill of our old employer—V.me?
Yes.
Right, V.me. It was something else before that; I forgot. They changed the name to V.me. There have been many attempts. Why were there wallet wars 10 or 15 years ago? Because it turns out that being the default stored credential for a consumer matters. If I can get trained in a Pavlovian way so that when I see flowers, I use PayPal, PayPal is better off.
That’s correct.
One of the things we worked on at TrialPay was making it very good for Visa and its issuing banks if a Visa card was the default card in your Uber wallet.
Yeah.
You can store 8 different cards or credentials within Uber. Being top of wallet is very, very important. Before digital wallets, you had what I like to call a dead-cow wallet. I think I have one here. I’ll give our audience a demo: this is called a dead-cow wallet. It has lots of credentials in there.
Before Capital One would pay Samuel L. Jackson to say, “What’s in your wallet?” why would they do that? Because when you go to Chipotle, they want you to pull out your dead-cow wallet and say, “I’m going to pay with my Capital One card.”
Yeah.
Right. That was it. Whereas when digital wallets emerged, it was, “I’m Shop Pay. I’m PayPal. I want to be your default.” The interesting thing is that within those wallets, there were other credentials, and those guys were competing to be number one. If you recall, at Visa, when we were dealing with Uber and Airbnb, tens of millions of dollars were paid by issuers like Chase and Amex to prefer their cards on those platforms. So that’s one war: “This is my card. I want to promote it to the top of wallet.”
You’re talking about the actual network war, where Visa—and we helped Visa become a default card at Uber—and now you have this other layer, an abstraction layer of wallets: the Shop Pays, the Links, and the PayPals. We talked about how a checkout looks a bit like NASCAR because you have multiple different buttons.
“Pay with PayPal,” “Pay with Google Checkout.” Remember Google Checkout came out—
They were yet another option. But there are consumer wallets and merchant wallets. The interesting thing is that I think of VGS as a merchant wallet, to an extent. It’s a strange metaphor because a merchant isn’t paying for things; a merchant is receiving payments. But once I receive a payment, where do I put it, especially if I’m billing this customer again and again? For PCI reasons and whatnot, I don’t want to store scraps of paper with your CVV—that supposedly secret 3-digit code that isn’t secret because it’s on the back of your card—but I need it to process the payment. I don’t want to store your 16-digit credential in scraps of paper or in my original cash register. I need something to receive that for me.
On the consumer side, the original purpose of a consumer wallet was that it’s 2:00 in the morning, I want to buy flowers for my wife, my wallet’s downstairs, and I don’t know where it is. I want to go pay on 1-800-Flowers right now. If I enter my PayPal credentials, they were a wrapper that linked to all the credentials in my dead-cow wallet. That was the purpose back then.
What I find interesting about agentic commerce is that it’s kind of the same thing. It’s still 2:00 in the morning. You still want to buy flowers for your wife, or for Mother’s Day, or whatever.
Something good, Alex.
Something good, right? It’s always time to buy flowers. Your agent doesn’t have access to your credit card. It’s the same problem: the agent could say, “Hey, Terry, where’s your credit card number?” That’s more work and more friction, versus having access to it in the same way you gave access to all your cards and bank accounts through PayPal to reduce friction when you were doing things manually 15 years ago.
Yeah. I think the word wallet is a bit overused. There are different versions of it. One is the digital version of your dead-cow wallet, which just stores the payment credential. When you go to a merchant, you hand that credential to the merchant. That’s kind of what Apple Pay does, right? When I shop at a store with Apple Pay, Apple is effectively giving my Capital One Visa card, tokenized in the wallet, to the merchant.
4. Stripe as the AOL of agentic commerce
The merchant receives this credential and decides whether to process it through Chase, Adyen, Stripe, or Braintree. Then you have wallets that actually take care of the transaction for you. Think about Shop Pay, Link, or PayPal, where the wallet transacts with me, collects the money from me, and remits it to the merchant.
What’s happening with agentic commerce is that we’re getting a blend of the two. It’s such a new ecosystem that, for me, it has parallels with the early days of the internet. For those who were around in the AOL era, Stripe is, in many ways, like the AOL of agentic commerce. I mean that as a compliment: they’ve figured out how to make agentic commerce just work through a very walled-garden approach.
For example, Link is only available at a million merchants. That’s great if the item I want is available at one of those merchants, but often it’s available somewhere without a Stripe Link connection. Two weeks ago, I had an event at my house and wanted to buy some outdoor lights. I asked an agent to help me find them, and it found them at Walmart, which makes a lot of sense because Walmart has lots of inventory.
The agent loaded the cart, but when it came time to pay, Link didn’t have a connection to Walmart. Link has my card, but it can’t just give my card to the agent and Walmart. So Stripe did something pretty interesting: it purchased the chandeliers on my behalf, issued its own Visa virtual card—a one-time-use card—and made the purchase. Then it charged me, Terry, in a second transaction. It’s a little bit like how DoorDash works today: you spend $100 at DoorDash, and then the Dasher pays the restaurant.
In the case of this Walmart transaction, it worked just great. The item showed up, the transaction went through, and I was charged the right amount. But if there’s a problem with the chandelier, I typically call my bank, Capital One, and say, “Hey, I had this transaction with Walmart, and something went wrong.” They say, “We don’t see a Walmart transaction here. We just see a Stripe transaction.”
You’ll find this pretty funny: I know someone who, during the testing phase, did this exact flow on their Amex card. They called Amex and said, “This transaction with the merchant didn’t go through,” but Amex only saw Stripe. So they gave them a phone number to call for this Link merchant. The person called, and it went straight to the cell phone of a Stripe engineer, because Stripe isn’t set up to run a chargeback.
Well, this is one of the main reasons Visa and Mastercard have such impregnable positions: they intermediate everything, set the rules, and handle chargebacks, which are very important.
Yeah.
Right. What if I paid for something? It’s a trust mechanism. I pay you for lights, and you don’t deliver them. I think, “Oh, shoot, I don’t have my money anymore. What do I do?” No, you actually have rules that let me lodge a complaint, and then there’s a central intermediary that helps adjudicate those complaints in a way that’s more or less fair and that both parties agree on.
I mean, that’s part of the problem. This is why crypto is cool, but it’s kind of a bearer instrument. I pay you with crypto, and I’m never getting that back. That can be a bug or a feature, but in your lights example, what if the lights don’t work? You want Visa and Mastercard in the middle. That’s high utility, even for the merchant, because I’m much more willing to buy from a merchant knowing that if they don’t deliver a product that works, I can get my money back.
Yeah.
5. The new agentic token standard
That trust mechanism is very important, but if you add all these interesting and very clever engineering steps, it just doesn’t work as well.
Yeah. So, in fact, I think this is the right direction of travel, from the AOL ecosystem to the open-standards ecosystem. The card networks have come out with a new type of standard called agentic tokens. They’ll allow a wallet like Stripe Link, Shop Pay, or PayPal to hand a credential to the agent safely, and then have the agent hand it to the merchant.
Here’s one addendum to the Walmart transaction. After I bought the chandelier, everything was fine, and I got an email from Walmart saying, “Hey, Terry, you paid for delivery. It was $6.99. Why don’t you sign up for Walmart+? If you sign up today, we’ll credit the delivery toward your Walmart+ subscription.” I said, “Great,” and hit the button. Of course, the transaction failed because the card they had was the Stripe one-time-use card.
Part of the norms of e-commerce is that Walmart spends a lot of money to get me as a customer, and then has the right to try to build a relationship with me, upsell me, and cross-sell me. In this case, because we were using the AOL version, Walmart couldn’t easily let me subscribe to the new service.
With the new agentic standards, if a wallet doesn’t have a relationship with the merchant but has my Capital One Visa card on file, that card should be tokenized for the agent. There’s a process where the agent says, “I’m about to make a transaction. I’m a verified agent, and I’m going to spend no more than $100.” The token is just a new 16-digit number. We safely give it to the agent, the agent gives it to Walmart, and Walmart runs the transaction. It’s my card that’s charged, which preserves the ability to have a follow-on transaction and all the rules around chargebacks.
Three months ago, this was at zero; it didn’t exist. VGS is by far the largest provider of these agentic tokens. We do it for agents, for wallets, and for some merchants. Three months ago, this was at zero. Now we’re doing a few million of these tokens per week. As we make the transition from the walled garden to open standards, I expect this will be how agentic commerce evolves.
Yeah. I mean, one of the reasons—and I mean this as a positive—that VGS has a very boring business is that you have a vault. Anybody in the vaulting business has a job that isn’t exciting: to be safe and secure. Things go into the vault, and every now and then things go out. It’s not a one-way door.
The way I’ve always thought about VGS is that there are credentials you store. You get 15-digit Amex numbers or 16-digit Visa, Mastercard, and Discover numbers, store them, and give back a token. This isn’t a crypto token; it’s just something you can use. Then there are verbs that can be performed on those credentials.
Right.
If I’m a big burger chain or something—we don’t know which one, but you work with a big burger chain—I have a consumer app with tens of millions of users. Whenever a user says, “I want to buy a hamburger,” VGS plays a key role. It’s a very boring role, but I retrieve and charge. I retrieve the credential to send it to a payment processor and say, “Charge Terry $9 right now,” but I never have to touch that credential again. It’s a very boring business.
What percentage of cards do you think you’ve seen, touched, or stored? Is it probably 80% of cards in America?
We have 10 billion credentials. It’s a lot of credentials. I think you’re touching on something really interesting: vaults are going from single-player to multiplayer, and that makes them a lot more valuable.
Put aside agents for a moment. The fact that merchants have multiple processors means the vault at VGS is effectively the vault for each of those processors, because the network tokens stored in that vault now have to be sent to Chase, Stripe, Adyen, Braintree, and Razorpay.
Right?
That’s multiplayer. With agents, if you have a vault—let’s assume you’re a large frontier model—here’s a good example. Your large frontier model is vaulting cards to charge for a subscription, but now the agent wants to use that same credential to make a payment. The vault used to be single-player: it was just to make sure you could pay for the subscription. Now you can effectively give that credential to the agent according to these open standards. It’s multiplayer.
Right?
I think any business that’s going from single-player to multiplayer inherently becomes more interesting.
I mean, even 1Password, right? It used to be a single-player vault.
Maybe I share my credentials with my wife on a few things, but now it’s multiplayer because I’m trying to give access to multiple different parties.
6. The three checks behind every transaction
Well, this is a really complicated thing, going back to the rules and procedures of what Visa and Mastercard have done. Normally, there are almost 3 steps to a transaction. I think of number 1 as: Is this identity real? In general, is this a real card number?
Right? That’s important. But wait a minute: I can have a real card number and you’re a thief. It’s still a real card number.
So, kind of step 2 is once I validate it. There are actually 2 ways of validating a card number. There’s a Luhn check—you add up the digits. It’s a checksum, right? It’s a mod 10 check of the credit card number. Is it valid? That doesn’t mean it’s a real card, but it means it’s in the valid universe of cards. I can also check with the bank: Is this an actual card? That’s step 1.
Step 2 is: Is the person I’m interacting with the valid owner of this card? If you went to a jewelry store 25 years ago and wanted to buy something for $15,000, they’d take your credit card, your piece of plastic, but they’d do 2 things as well. You used to have to sign the back of the card. I thought the first card I ever saw that got rid of that altogether was Apple. With the Apple Card, even though they want you to use Apple Pay, if you get the physical metal card, there’s no place to sign on the back. None.
But they’d also say, “Can I see your ID?” I remember I bought something very expensive one time. It might have been jewelry for my wife, who I sometimes buy flowers for as well. This was probably 25 years ago, and they wanted to see my ID. They checked the signature. Why? Because they knew the card was valid, but they wanted to make sure I was the actual owner of the card.
Then number 3—and you probably only see this in Vegas—is: Are you of sound mind to make this transaction? If you went to a casino in Vegas and passed number 1—the card’s valid—and number 2—here’s your ID, your signature matches entirely—there’s still step 3. If you’ve had 15 drinks and can’t even speak properly, they’re probably not going to let you pay, right?
That was kind of the old world. If you bring that metaphor to the new world, well, is the card valid? Yeah. Does the person—
Agent?
Well, but this is tricky, right? The card is going to be valid. That part’s a solved problem.
But the second part is, what does that mean? Is the person I’m interacting with—my interlocutor—the valid owner of this card? That was always a hard problem to figure out on the internet because I can’t see your signature. What does that mean? You’re an IP address, and maybe I’ve seen you before and checked your login, but now I have an agent.
Well, this is exactly what these open standards are solving for.
So let’s take an example where I instruct my agent. In fact, this is a real example. I was looking for a hotel for a trip we’re making for my daughter’s gymnastics tournament, and I said, “Go and find a hotel in San Diego, and don’t spend more than $500.” The first question, when that agent is provisioned, is: Is this a real card? That’s a solved problem. The second one is: Is the request for the agent a valid request? The way this works with the networks is that the agent actually has to be registered with Visa, Mastercard, or Amex. There’s a whole mechanism there.
The third question is: Is the agent of sound mind? Did it get it right?
Right.
And was it drunk? Exactly. Did it hallucinate?
That part I don’t think we fully understand yet. If there’s a mistake the agent makes, and the card network did everything right—they validated that this is your agent and your instruction—part of the way these new standards work is that you give it context. You say, “I’m buying a hotel reservation at this amount.” It’s hard for me to know if it got the actual dates right. If there’s an error there, that dispute mechanism is sort of unresolved. But I think we’ll get to that point, and probably the agents will have to take on some responsibility.
Well, it’s this idea of delegated authority.
Yeah.
But how do you figure out who’s liable? How does this change? If 2 agents are competing for your business—“Hey, Terry, please use me. I’m Muse,” or “Please use me. I’m Instinct”—what’s one of the value adds I’m going to give you? I’ll take on the liability, because if merchants are smart, they’re not going to say, “I don’t give a crap that you got the wrong hotel room or did this.” You gave your card and delegated authority to an AI agent, your human assistant, your wife, or whoever. I need to know, if I’m accepting payments for something, that there’s no excuse at the end.
This was called friendly fraud, for those who know the term. Once upon a time, there was this concept—we used to see this at TrialPay.
All right.
I spent $10,000 on virtual gems for some stupid game. My wife and I share the—just for disclosure, I didn’t actually do this, but let’s just say I did. I spent $10,000 on virtual gems for some stupid game. The credit card bill comes due at the end of the month, and I’m like, “Honey, I never spent $10,000 on that. It wasn’t me. I don’t know.” You refuse the transaction, not because you didn’t get the service that was offered, but because it’s embarrassingly terrible.
And merchants had to deal with this all the time.
Yeah.
In many cases, the banks would say, “If it’s a $10 transaction, it’s not even worth fighting. We’ll just give it to the consumer every time.”
7. Why Amazon blocked Muse
Which created moral hazard. But delegated authority gets really tricky here. Maybe I can ask a different question, because this is probably the more important one. You saw that Amazon recently blocked Muse, and there are many reasons for this. It’s mainly that Amazon is an advertising company, and they want you and your eyeballs going to their website. They don’t want your agent, because you can’t monetize an agent’s eyeballs; the agent doesn’t have eyeballs.
I think it’s an oversimplification to say anybody who’s antagonistic to agentic commerce is a laggard and they’re gone. Amazon has a real financial reason to be antagonistic, because advertising is so much more lucrative for them than just selling things. The highest-value SKU is when they get your eyeballs and sell the eyeballs. How do you think this is going to play out? Being enabling technology for merchants to be receptive to AI commerce is highly, highly, highly valuable. At the same time, helping the antagonistic ones filter out agentic commerce is also highly valuable, because sometimes they have a reason to do that.
If I can make it so that ChatGPT says, “Yeah, you should buy here,” and make that as simple as possible, it goes without saying that I’m probably going to get a lot more transactions than somebody who inserts 15 CAPTCHAs and says, “In order to proceed with this…” Then Muse is going to say, “Hey, interrupt your nap. You’ve got to go do these 15 things.” No, no, no—you’re going to go with the one that’s receptive to AI commerce.
Yeah, I think this is one of the most fun fronts to watch in agentic commerce, and I think we’re going to get multiple different versions of this. We have Amazon, which has many reasons to block agents, as you said. They’re effectively in the advertising business. You have Walmart, which is very similar but hasn’t taken that step. In fact, you might argue that if you’re one of the largest retailers on Earth, with the best last-mile delivery, this is all good for you. Then you have the series of merchants under the Shopify umbrella, a lot of small businesses, for whom this is probably a new, vital channel.
Maybe there’s fear on the Amazon side, greed on the Walmart side, and no choice on the SMB side. Each of these merchants is going to experiment with how they deal with agents. I think this reminds me a little of how open banking was rolled out, though I know we have a different view on this. Do I have the right, as an Amazon customer, to delegate my login to an agent? Does Amazon have the right to say no?
This is what happened with Plaid and Chase and the banks. In the end, what tended to happen was a long, negotiated settlement where the likes of Chase said, “You can access this information. You do have the right to it, but only through my APIs, and my APIs limit what information I give you.”
They tokenize the bank accounts.
And I might charge a lot.
And I might charge you some money for it. So actually, I think the interesting question is that we may have plenty of opportunities, or plenty of merchants, who just welcome agents. We may also have merchants who have their own agents. In fact, this is what happens if I go to a Best Buy and want to buy a flat-screen TV. I assume there’ll be a salesperson there with an agenda, and he or she will say, “Let me show you some flat-screen TVs.” Their job is to help me, but their job is also to get a commission, right?
8. Over-hyped vs under-hyped
In the case of Chase and open banking, it was much more about security and control. In the case of Amazon, it might be, “I am an opinionated API. I have an opinion on what you should buy, Alex, based on many different data points about you.” And then my agent may have an opinion about what I want. That’s going to be a fascinating battle or communication. In the end, I think consumers probably win, but we don’t know what that’s going to look like going forward.
Right? Well, maybe on that, what do you think is overhyped versus underhyped in terms of everything that’s happening? In general, my rule of thumb is that Silicon Valley overhypes things, but the rest of the world underhypes things. Every conversation here is about AI, and it feels like you go to Iowa and nobody’s talking about AI. But then you show it to them and they’re like, “Holy, how is this real?” because they tried it 3 years ago.
I just bought a new Tesla, and I remember I had an old Model 3 in 2017 with self-driving. It didn’t work at all. It was a joke. Eventually I got a different car, and now it actually works. But I was skeptical because I was used to the 2017 thing. I feel like a lot of that is playing out with AI right now. If you had tried ChatGPT with all the hallucinations and everything in 2022, you’d think, “Oh, it’s a cute toy for writing poems or doing my homework in English class. This is not going to actually buy things for me. This is not going to write code.” It does all these things right now. So, what do you think is underhyped versus overhyped in terms of everything that’s going on?
Yeah. Maybe I’ll start with overhyped. I don’t think we’re going to get a bank run on savings deposits where agents maximize yield and move my money around between different accounts. I’m a very happy Mercury personal account customer. I’m also a Chase customer, and ideally I should put all my savings in Mercury, where I get a very good savings rate, and then, at the last moment when I have to pay bills, move the cash over to my existing bank, Chase. But their bill pay just works better, has more integrations, and I have more set up. I think there’s enough friction in the world that we won’t see some of the crazy volatility in financial services.
I think maybe what’s underhyped is a lot of demand that is unmonetized, and this is both in the part of the world where you could expect more GDP. An example of this is that we have a group cycling WhatsApp group, and there’s a person in that group who, every 6 months or so, comes up with a new recommendation for what tires to get because he looks at rolling resistance. Every time he does this, I think, “Oh, I should remember to buy those tires because they’re safer,” but I only buy them every 2 years. If my agent were in that group chat, I would buy tires every time he makes a new recommendation. You’re dramatically undermonetized on your bike equipment, Alex. If the agent could find things that could help you with cycling and just bought them for you, there’s more GDP coming out of Alex on cycling.
Right?
That is underhyped. At the same time, agents are going to save us money. There are probably many places where I have a subscription and it’s been a hassle to cancel, or I did a trial and forgot about it. I think agents will simultaneously save us money and maybe use those savings to help us buy new items. I think we have yet to experience the always-on nature of these agents. As far as I can tell, human desires and needs are infinite, so there’s always something else that I will want. I think that’s—
Maybe on this kind of antagonistic versus conciliatory—or whatever the opposite of antagonistic would be here—a lot of what people are very excited about with agents is that they get something for you that is intentionally hard and not really subject to the laws of economics. The laws of economics are like, “The cure for high prices is high prices.”
If it’s really hard to get a restaurant reservation because you have to call at 7 a.m., well, now everybody has a tool that calls at 7 a.m. The first 5 people who have the tool have an amazing tool; the last 5 people are like, “No, no, no,” because it’s so crowded that nobody goes there anymore. So how do you think the world changes? It feels like right now this is the weird position we’re in: a lot of the early wins, if you will, the consumer successes, are around, “Oh, it saved me money,” because of the asymmetry. Yeah.
Right. A very small number of people have the tool. The merchant or the counterparty has no idea what’s going on. I can’t wait. As a consumer, I’ve been trained to say, “No, no, I want to talk to an agent,” or press zero. You can look up how to get out of the stupid phone tree. I can’t wait for the other side to say, “No, I have to talk to Terry. I ain’t talking to Manus.” Wouldn’t that be funny? You call Comcast and say, “I hate you. You suck. Your service is terrible. You went down 10 times.” I do this all the time. I actually do this with Codex because it turned out Comcast is blocking—
Muse.
They know the IP addresses or something, so it won’t let you log in. I just have ChatGPT, Codex, and Astra log in on my computer and do everything. But I’m waiting for the day when Comcast says, “We know this ain’t you, right? Put Alex on the line, because I’m not giving something to his agent.” That’s going to happen because, again, that’s what I mean by the asymmetry. A small number of insiders have this tool. But you know what? You can’t scale that infinitely because the world is going to adapt.
Although I do have news for Comcast: GPT, Astra, and Alex are about the same sort of foe. So be careful if you get them on the phone.
Yeah, I think you’re pointing out something that we have yet to appreciate, which is—
What happens when you actually read the terms and conditions and go to the edge of what is allowed and disallowed. The other day I was looking at flights. I wanted to buy a flight that was right at the price I could pay to get an upgrade. That’s a hard thing to do. Sometimes I overshoot it, but my agent did it perfectly.
Or consider any case where it’s very difficult to uncover the terms and conditions. A good example might be rewards. Rewards on cards are only there because I get you a big headline reward on dining, but then you also spend on fuel. If agents are intermediating all of our transactions and I’m only using the card that gets me points, the whole points reward ecosystem falls apart. Many of these things could start to fall apart—anything with a breakage model—and then we’ll have to have new terms and conditions. Maybe that’s better, maybe that’s worse. I don’t know, but it’ll certainly be different.
9. Where VGS goes next
And maybe, with all of these themes, where do you think VGS is going to go? I find it so interesting because it’s the world’s most boring business: it’s this giant vault that stores the payment credentials for almost everybody. I almost guarantee that everybody listening to this podcast has a credential stored at VGS because they interact with a merchant that uses VGS to store credentials. That’s a really formidable position to be in, and it’s been growing remarkably because every merchant needs to store the credentials of the consumers they work with. Where do you think the most exciting opportunity is for VGS’s future?
I think there are 3 eras of VGS that overlap and compound. You talked about the first era, which is the vault. This has been 10 years of becoming the most trusted store for credentials across the internet. It’s a very hard business to execute, but that’s the privileged position the company is in.
The second era has been what you talked about: information going into and out of that vault. One-third of those credentials have to be updated. That’s become very interesting and complicated because each network has its own standard for how you update its credentials, and each network has created multiple network tokens that represent the vault.
If you were just storing the information, it’d be one thing, but you have to store it and get a series of tokens from the networks so that the data is effectively refreshed.
Right. The third era is what we call the network era, which is this role of brokering the credentials among multiple parties in a way that makes sense according to the rules and adds value to all of the ecosystem players. We’re starting to do that now with agentic commerce. There are other cases where VGS is actually working with the banks on the tokenization front.
If you’re tokenizing the cards and storing them, you’re on both sides of this ecosystem, which allows you to do some of the information swaps you talked about earlier. All of these combined will continue to be a vault. We’ll continue to add services, and as we add more services on more merchants and more issuers, we continue to get this network effect where you can broker credentials among the parties. I think agentic commerce is just fuel into that ecosystem.
Well, Terry, this has been fun down memory lane. One of these days we should do—did we ever? I think we actually did a history of TrialPay one a long time ago.
Yeah, I think we should redo it. It was one of the first podcasts that we did. The studio wasn’t as nice. But I think what’s consistent between that first podcast and this one is you should be buying more flowers for your wife.
Yes. I think that’s a great idea. All right. Well, thank you very much.
Thank you for having me.