ChatGPT Wallet: How Agentic Payments Work and Where They Break

The short version

On November 13, 2026, OpenAI launched ChatGPT Wallet, which lets its "dots" agents complete purchases on a user's behalf. It was built with American Express, Mastercard, and Visa. At launch it is available only to ChatGPT Pro subscribers in the United States, aged 18 or older, holding eligible US-issued cards. No date has been announced for any other market.

The interesting part is not that an AI can check out. Shopping agents already existed. The interesting part is how OpenAI structured trust — and what that structure tells merchants, fraud teams, and anyone building on agentic payments about where the remaining weaknesses are.

How a purchase actually works

Everything below comes from OpenAI's launch post, its Commerce Partner Playbook, and the ChatGPT Wallet help center article, cross-checked against CNBC and TechCrunch reporting.

Enroll a card once. Card number, expiry, and security code go into a secure form — not into the chat. US banks may require separate verification, and Chase cards must be approved inside the Chase mobile app by the primary cardholder.

Ask the dot to buy something. "Help me find a new sweater." "Book me a hotel for my trip to Chicago next weekend."

Review the request. The merchant, items, total, selected card, and any recurring-payment terms are displayed.

Approve with a biometric check. Face ID, Touch ID, or a fingerprint scan. Biometric verification is mandatory on supported devices; if you are on a laptop with the lid closed, you open it or continue on a phone signed into the same account.

The network issues a payment token. A substitute card number, security code, and expiry, scoped to that one transaction.

The dot finishes checkout and reports the result.

Neither the agent nor the merchant ever sees the real card details. Merchants receive a network token and can use Payment Account Reference (PAR) to associate it with the underlying payment account. Consent is limited to the specific transaction: a merchant may not reuse or store the credential for another purchase — unless the customer explicitly agreed to a recurring or continuous payment plan, in which case the merchant can charge that credential again under the agreed terms.

Existing card rewards and protections for eligible disputes survive. OpenAI is explicit that the merchant remains the merchant: pricing, fulfillment, returns, and customer service stay with the business, and chargebacks or unrecognized charges go to the card issuer.

The numbers behind the launch

OpenAI says 1.2 billion people use ChatGPT each week. CNBC reported roughly 100 million paying users at the end of Q3. So this is a very small slice of a very large base — US Pro subscribers only.

OpenAI is not taking a cut of transactions at launch. That matters because its previous attempt, Instant Checkout, used a commission model and was pivoted away from in March 2026. Wallet rides existing card rails instead of asking merchants to integrate a new checkout, which lowers the adoption cost but also postpones revenue.

Why merchants cannot ignore this — even outside the US

This is the part worth reading if you run an e-commerce business in Japan, the UK, or anywhere Wallet does not yet ship. OpenAI published a Commerce Partner Playbook alongside the launch, and its four items are things any site can act on today:

Keep product information accurate. Claim your business in ChatGPT, get verified, then update business details and upload a product feed with current pricing and availability.
Make sure agents can reach you. Configure your CDN or firewall to recognize signed requests using Web Bot Auth. Browser access requires no plugin and no product feed, so a WAF tuned purely for bot blocking may be quietly rejecting legitimate agent traffic.
Coordinate with your payments and risk providers. Wallet's tokens work with existing checkout flows, but risk systems may still flag agent-initiated purchases, causing declines or cancellations. OpenAI says it is working with fraud-prevention partners Forter, Riskified, Sardine, and Signifyd and PSPs Adyen, Checkout.com, and Stripe so their systems recognize these transactions as legitimate.
Give agents more surface area. Build a plugin so agents can check availability and manage carts, or add WebMCP tools to your site.

The counterweight is that the industry is split. United Airlines said on November 11 that it will block AI agents from booking tickets. Amazon secured a court order blocking Perplexity's shopping agent from purchasing on its platform. OpenAI itself concedes some sites will block agent purchases without meaning to.

So the November 2026 decision for a merchant is not "should I support AI agents" in the abstract. It is: do I want my products bought through an agent, refused, or permitted under conditions? Refusing costs you the demand. Permitting costs you a risk-management design. The middle path — verifying Web Bot Auth signatures and tightening terms specifically for agent-originated orders — is where most serious teams will land.

The real weakness: approval and acceptance are separate

This is the design flaw worth understanding. The flow guarantees the user authorized a purchase. It does not guarantee the merchant accepted it. OpenAI's help center is blunt:

Ready to check out means your approval is complete. It does not confirm that the merchant has placed your order.

Two failure modes follow. First, a checkout can fail on the merchant side while a pending charge appears on the card — OpenAI's own guidance is to look for a merchant confirmation before retrying, precisely to avoid duplicate orders. Second, Ready to check out is a status the user can misread as success.

The second weakness is structural and harder to patch: the agent reads untrusted content to decide what to buy. Product pages, reviews, and marketplace listings are attacker-controllable text. Per-purchase biometric approval is the backstop — but it only works if a human actually reads the merchant, item, and total on the approval screen. OpenAI's stated roadmap is to let users delegate purchases entirely by setting spending limits, categories, and time periods, pre-approving within those bounds. That roadmap removes exactly the backstop that currently makes the system defensible. Which is why OpenAI couples it with the phrase "enhanced safeguards."

Launch limitations, precisely

US Pro subscribers only, 18+, with US-issued credit cards from Amex, Visa, Mastercard, or Chase (Chase requires the primary cardholder).
No debit cards. No virtual cards at enrollment — the virtual number Wallet generates internally for an approved purchase is a different thing.
Works only in conversations with a dot. Not in regular Chat, not in Chat Work, not in standalone Codex threads.
Biometric verification required for every approval.
Cards saved in Wallet are separate from payment methods saved on a merchant's site. Check which card is selected on every purchase.
Some stores simply will not work. The merchant or issuer can decline.

What to do this week

If you sell online, the action items do not depend on Wallet reaching your market:

Audit your bot defenses. Find out whether your CDN or WAF would pass a Web Bot Auth–signed request. Most bot rules were not written with agent traffic in mind.

Check your product data. Claimed, verified, machine-readable pricing and availability is now a distribution channel, not a nicety.

Ask your PSP a direct question: how does your risk engine classify an agent-initiated card-not-present transaction with a network token? If the answer is "as elevated risk," you will be declining legitimate revenue.

Write the terms before the traffic arrives. Who is the purchaser when an agent buys? Who owns returns? How is consent to recurring charges recorded? OpenAI has stated the merchant keeps the customer relationship, pricing, fulfillment, and returns. If your terms do not actually support that split, the disputes land on you.

Wallet is a US beta for a subset of Pro users built on existing card rails. The reason to read the announcement carefully anyway is that it is the clearest public blueprint yet for how agentic payments will be wired — and the blueprint shows that the hard problem was never letting an AI spend money. It was deciding who is responsible when the AI spends it wrong.