An example: the cartridges that came with a subscription
Fictional example: Clara in Brussels asks an AI agent to buy printer cartridges for under 40 euros. The agent puts a pack for 31.90 euros in the basket and asks her to approve payment. Clara checks the shop page herself: that price only applies to a ‘subscribe and save’ option with a new pack every two months.
She switches to a one-off purchase at 36.50 euros, approves it in her banking app and signs the agent out. The agent did what it was told; ‘no subscription’ was a condition Clara never wrote down.
What does an AI agent actually do, and where is the risk?
An AI agent does more than answer questions: it pursues a goal, plans intermediate steps and accesses other systems on its own to get there. When shopping, it operates websites, for example in a virtual browser run by the provider, fills in forms and can sign in to your accounts if you let it.
The risky part is the combination: the agent reads web pages it does not control while having access to your data. Instructions planted on a page can try to steer it; this is known as indirect prompt injection. OpenAI says it tests for risks such as prompt injection and phishing, but that its safeguards do not eliminate every risk.
Which tasks can the agent handle on its own?
Decide before the first task where the agent has to stop. A suggestion:
| Task | Rule | Reason |
|---|---|---|
| Searching, comparing prices and reviews | Agent may do this alone | No contract is made. |
| Preparing a basket or reservation | Agent may do this alone, stops before checkout | You see the total and terms first. |
| Placing the order and paying | Only after your confirmation | The order goes through your account. |
| Plane and train tickets, concert tickets, hotels, car hire | Complete it yourself | The EU right of withdrawal does not apply. |
| Subscriptions and free trials | Complete it yourself | Later payments may go through without a new approval. |
| Entering passwords or card details | Only you | They do not belong in a chat. |
| Online banking and banking app approvals | Never hand over | Keep your security credentials to yourself. |
Build the stop into the instruction: ‘Find three offers, put the cheapest in the basket and stop before payment.’ OpenAI advises describing the outcome you want and including the website, relevant details and any constraints.
Tip: Add your must-haves: maximum price including delivery, delivery date, ‘free cancellation’, ‘no subscription’.
How do you cap payments before the agent starts?
The most effective brake is your payment method, not the AI.
- No card details in the chat: if a page asks for payment details, take over or stop.
- Check stored cards: with one-click buying or a saved card, a signed-in agent may need no further input. Remove those details or keep the agent out of that account.
- Ask about limits: ask your bank about a low online spending limit or a separate card.
- Read every approval: compare amount and payee with the basket, as explained in Banking app approvals.
Do not rely on the banking app alone: banks may skip strong customer authentication, for example for online payments of up to 30 euros within certain limits and for later payments in a series with the same amount and payee (Delegated Regulation (EU) 2018/389, Articles 14 and 16).
Your bank must refund an unauthorised payment immediately, even if it accuses you of gross negligence; the Court of Justice of the EU confirmed this on 15 October 2026 (C-70/25). Who finally bears the loss depends on whether the bank can prove that you acted intentionally or with gross negligence. Seek individual advice in a dispute.
How do you give account access without leaving it open?
If the agent needs to sign in, type the username and password yourself, never as a chat message. OpenAI, for example, offers a secure sign-in form; it says details entered there go straight to the agent's browser and are not visible to the AI model. The sign-in then persists for future tasks until it expires; clearing a site's data signs you out.
- Check the order in the shop's customer account yourself.
- Sign the agent out of the shop and clear browser data in the AI service.
- Disconnect email, calendar and other linked services.
- Review permissions regularly, see Review connected apps.
To control what the chatbot remembers, see Chatbot privacy settings.
What if the agent orders the wrong thing?
Treat it like any purchase you regret. In the EU you can cancel an online purchase within 14 days without giving a reason (Consumer Rights Directive 2011/83/EU). Your Europe lists exceptions such as plane and train tickets, concert tickets, hotel bookings, car hire and catering for specific dates; goods bought from private individuals are not covered at all. See also The withdrawal button.
Switzerland is different: according to the Stiftung für Konsumentenschutz, there is no right of withdrawal for contracts concluded online. With Swiss shops, let the agent stop at the basket.
If you see a charge you did not approve, tell your bank at once and change any passwords the agent used.
Where can you get help in your country?
| Country | First step | Advice and reporting | Good to know |
|---|---|---|---|
| Germany | Bank; block cards and online access via the Sperr-Notruf 116 116 | Verbraucherzentrale; police for fraud | From abroad, the Sperr-Notruf is on +49 116 116 |
| Austria | Bank or card provider | Watchlist Internet, Internet Ombudsstelle, Arbeiterkammer; police | The 14-day EU right of withdrawal applies, with exceptions |
| Switzerland | Bank or card issuer; block accounts and cards | Police for fraud; ‘eBanking – aber sicher!’ | No statutory right of withdrawal online |
| France | Block your card via your bank or 0 892 705 705 (premium rate, 24/7) | Perceval for card fraud; Info Escroqueries 0 805 805 817 (free) | Reporting on Perceval does not replace a police complaint |
| Italy | Report it to your bank and ask for a refund | Complaint to the bank, then Arbitro Bancario Finanziario; complaint to the Banca d’Italia | ABF if the bank refuses or is silent for 15 working days |
| Spain | Complaint to your bank's customer service | INCIBE cybersecurity helpline; then Banco de España | Banks have 15 working days to answer payment complaints |
Common mistakes
- Setting only a maximum price and leaving out cancellation, delivery date or ‘no subscription’.
- Typing a password or card number into the chat.
- Letting the agent work in a shop account with one-click buying.
- Staying signed in and connected after the task.
- Trusting the agent's success message instead of your customer account.
Your checklist
The checkboxes are for your own reference. No entries are sent to us. To keep a copy, print the page or save it as a PDF using your browser menu.
Common questions
Should I give an AI agent my password?
Better not. Type sign-in details yourself when the agent asks, never as a chat message; OpenAI explicitly advises never to paste passwords, security codes or payment details into the conversation. The same goes for banking: the Banca d’Italia stresses that your bank will never ask for the details you use for online payments or online banking. Keep banking out of the agent's reach.
Can I withdraw from a purchase the agent made?
Check the order as you would any online purchase. With shops in the EU you generally have 14 days to withdraw, except for items such as plane and train tickets, concert tickets, hotel bookings and car hire. Switzerland has no statutory right of withdrawal for online purchases, so the shop's return policy decides.
How can I tell if an agent has been manipulated?
Often you cannot tell for certain. Warning signs are steps you did not ask for: a different delivery address, an unfamiliar shop, a higher amount or a request for codes from your inbox. OpenAI advises checking website addresses, sign-in previews, screenshots and confirmation requests. If something looks wrong, stop the task at once.
Sources and further information
Primary sources from public authorities, consumer organisations and providers. A source may be in another language; follow the guidance that applies to your service and where you live.
- Your Europe: Returns and the right of withdrawalSource review date:
- OpenAI Help Center: Using cloud browser in ChatGPT – sign-in, browser data and confirmationsSource review date:
- EUR-Lex: Delegated Regulation (EU) 2018/389 on strong customer authentication, Articles 14 and 16Source review date:
- Stiftung für Konsumentenschutz (Switzerland): returns and the right of withdrawal (in German)Source review date:
- Sperr-Notruf 116 116 (Germany): blocking cards and online banking access (in German)Source review date:
- Cybermalveillance.gouv.fr (France): bank fraud – card blocking, Perceval and Info Escroqueries (in French)Source review date:
- Banca d’Italia (Italy): payment fraud, refunds and the ABF (in Italian)Source review date:
- Banco de España (Spain): how to file a complaint about your bank (in Spanish)Source review date:
- Agence Europe: Bank must immediately reimburse customer for an unauthorised payment, even in cases of gross negligence (CJEU, C-70/25)Source review date:
