Who pays when an AI agent buys or books something in my name?
In short
Who pays when an AI agent buys or books something in your name? Usually you. The agent is not a person; what it orders within the authority you gave it counts as your order. A payment you authorised does not have to be refunded by your bank. For online purchases the 14 day right of withdrawal often helps, and private cyber insurance in Germany costs about 7 to 212 euros a year.
Published prices of private cyber insurance in Germany that helps with online fraud and disputes, from a test of 20 policies.
Example
Typical range
Private cyber insurance, single person, all tested policies
about 7 to 212 euros a year
Assistance only cover for fraud, phishing and data loss, rated suitable
about 60 euros a year
Cyber insurance with legal expenses, single or family, rated suitable
about 127 to 149 euros a year
Your share if a card is misused without gross negligence
at most 50 euros
Prices from a German consumer test of April 2024, benefits vary widely.
Wrong purchases made by your AI agent with your permission are not fraud;
whether a policy pays depends on its terms.
Worked example
AI agent books a hotel in Hamburg and picks the expensive rate
Assumed figures: how the loss is shared when the agent gets it wrong within your instructions.
Expected price for two nights
240 euros
Booked by the agent, non refundable
390 euros
Right of withdrawal
none, fixed dates
Refund from the bank
none, payment was authorised
You bear the extra 150 euros. Whether the agent's provider steps in depends only on its terms of use.
Why you answer for what your AI agent buys
An AI agent is software that carries out tasks online on its own: searching flights, booking a hotel, reordering printer ink. Legally it is not a person and can neither sign contracts itself nor be liable. The German Civil Code has no special rules for AI agents, so the general rules apply.
The closest comparison is representation: what a representative declares in your name within their authority binds you directly (§ 164 BGB). If you let an AI agent shop for you, you use it much like a messenger with a shopping list. To the shop the order looks like yours, and the shop may generally rely on it.
When your bank refunds a payment made by an AI agent
Under German law a payment only binds you if you consented to it, which the law calls authorisation (§ 675j BGB). If you stored your card with the AI agent and allowed it to pay, there is a strong argument that its payments count as authorised by you. The bank's duty to refund unauthorised payments (§ 675u BGB) then does not apply.
It is different if a fraudster hijacks the agent or steals your card details. That is misuse you did not allow. The bank must then generally refund you, and you bear at most 50 euros, or the full loss if you were grossly negligent (§ 675v BGB).
Situation
Who bears the loss
What helps
Agent buys the wrong item within your instructions
you
withdrawal within 14 days where possible
Agent books a hotel for fixed dates at too high a price
you
no withdrawal, only the rate's cancellation terms
Agent exceeds a limit agreed with the agent provider
unclear, check your contract with the provider
complaint to the provider, proof of the limit
Fraudster misuses card or access
bank, you at most 50 euros
block immediately and report
Withdrawal: the key protection against AI agent mistakes
Consumers in Germany can withdraw from online purchases within 14 days (§ 312g and § 355 BGB). This also applies when your AI agent placed the order, because the contract is yours. If the agent orders ten packs instead of one, you can usually withdraw and send them back, though you often pay the return postage.
There is no right of withdrawal for, among others, accommodation other than for living, car hire and leisure services when the contract sets a specific date or period (§ 312g (2) no. 9 BGB). So where AI agents are most popular, travel bookings, a mistake usually stays with you.
Which insurance helps when an AI agent makes mistakes
Private cyber insurance helps with online fraud, data misuse and disputes over online purchases, often with legal expenses cover. A purchase your agent makes with your permission is not fraud, though, it is your own contract. Whether a policy pays for it depends only on its terms.
Before buying a separate cyber policy, check your household contents insurance (Hausratversicherung) and personal liability insurance (Privathaftpflicht): some contents policies cover phishing, many liability policies cover viruses you pass on by accident. Norman Nammert arranges such policies as an insurance broker; the insurer pays the commission, so the advice is free for you.
When an AI agent is not a worry
If your AI agent only makes suggestions and you confirm every purchase yourself, the risk is small because you decide. It gets expensive once the agent may pay without asking. A card with a low limit, approval above a set amount and a notification for every payment keep the possible loss small.
Step by step
Give the AI agent only a card or account with a low limit.
Require app approval for every payment or above a set amount.
Turn on notifications for every debit.
Read the agent provider's terms: who is liable for mistakes?
If an online purchase goes wrong, withdraw within 14 days.
If you suspect misuse, block the card and tell your bank.
Checklist
Spending limit set for the AI agent
No bookings with fixed dates without your confirmation
Payment notifications switched on
Provider's liability terms read
Contents and liability insurance checked for cyber cover
Common mistakes
Storing your main card without a limit in the agent
Believing the bank refunds every payment the agent triggered
Missing the 14 day withdrawal period
Assuming without checking the terms that cyber insurance pays for your own agent's wrong purchases
Questions and answers
Frequently asked
Can I cancel a purchase an AI agent made in my name?
For online purchases from a business, usually yes,
by withdrawing within 14 days without giving a reason.
Hotels, car hire and events with fixed dates are excluded.
Is the provider of the AI agent liable?
Only if its contract with you says so or it breached a duty towards you.
Many providers largely exclude liability for wrong purchases in their terms.
Will my bank refund a payment my AI agent made?
Only if the payment was unauthorised, for example misuse by a third party.
If the agent paid with your permission, the payment generally counts as authorised.
What if a fraudster takes over my AI agent?
Then an unauthorised payment is likely.
The bank must refund you and you bear at most 50 euros, unless you were grossly negligent,
for example by sharing login details openly.
Does private cyber insurance help with agent mistakes?
Often yes with fraud, phishing and disputes with online shops,
but with a purchase you allowed the agent to make only if the terms say so.
Can an AI agent sign up for subscriptions?
Technically often yes, so exclude subscriptions and fixed term contracts in the settings or allow
