Mastercard published a major report on the future of AI shopping agents on 8 September, forecasting that 300 million shoppers will use AI agents on a routine basis by 2030, mainly in the US, UK, the Netherlands, China and South Korea. The 46-page report, “A Short History of the Future of Shopping and Payments,” pulls together three chapters on shopping, retail and payments, written with outside futurists rather than Mastercard staff alone.
Read past the headline number, and the report is really an argument about infrastructure that doesn’t exist yet. Greg Ulrich, Mastercard’s chief AI and data officer, frames it in the foreword: “Who can be trusted? Who is authorized to act? How do people stay in control?” That’s the question the rest of the document tries to answer, not a footnote to it.
The clearest evidence for why Mastercard leads with trust rather than capability sits in its own fraud warning. The report notes that if the world’s annual criminal revenue from cyberattacks were measured as a country’s economic output, it would rank as the third largest on earth. Agentic commerce, it argues, strips out safeguards people currently take for granted, from two-factor prompts to a human glancing at a receipt before it’s paid.
That warning lines up with independent evidence Mastercard didn’t produce itself. A landmark review the FCA published on 6 July, drawn from a survey of more than 5,000 UK consumers, found that a fifth of people, equivalent to 11 million UK adults, are likely to use AI that can act autonomously within pre-set goals.
The regulator’s own conclusion: what holds people back is trust and control, the same two words Ulrich uses to open Mastercard’s report. It’s a domestic UK finding, but Mastercard’s own forecast leans on the US, China and South Korea moving at similar or faster speed, so the FCA number reads as one data point in a wider pattern rather than the whole picture.
Mastercard’s own executives spend more of the report on what earning that trust actually requires than on the shopping experience itself. Pablo Fourez, the company’s chief digital officer, tells cardholders to set spending limits and decide which retailers or categories an agent can act in without asking first, arguing that “the clearer your instructions, the more confidently your agent can act within the boundaries you’ve set.”
The report says an agent can use a tokenised stand-in rather than exposing the shopper’s underlying card details, which can be cancelled without changing the underlying account.
Theodora Lau and Sherri Haymond, who write the payments chapter and its closing advice section, go further into the plumbing. They predict that “Know Your Agent” will become a compliance requirement, with at least three G20 regulators issuing formal guidance on registering and authorising AI agents by 2030.
Consent, they argue, needs to become something a bank can show a customer in real time, not a box ticked once at sign-up. Every agentic transaction should eventually carry a machine-readable liability warranty stating who is on the hook if a payment goes wrong, whether the customer is in London, Lagos or Los Angeles.
None of this is framed as settled. The report’s introduction asks readers not to treat its five sets of predictions “as stone tablets or immutable forecasts”, but as “invitations to experiment”. The caution matters, given how prominently the report presents its 300 million figure.
The report says around 90% of corporations have seen no financial return on AI investment in the past three years despite spending over $4 trillion over the past four years.
The consumer data already in hand isn’t hedged in the same way. Mastercard’s research, run with Opinium across 13,000 parent-teen pairs in markets from the UK to Poland and Israel, found 79% of teenagers and 70% of parents have used AI to research a product in the past year.
A further 61% of teenagers say they would be at least somewhat likely to use a full AI shopping assistant, and 51% have already used AI to complete a purchase at least once, the highest-friction step in the process. None of that is a 2030 forecast; it’s already happening, largely among a generation too young to be the “shoppers” most retailers still build for.
The infrastructure side isn’t purely theoretical either. Mastercard, Worldline and ING say they completed Europe’s first end-to-end agentic payment transaction this year at Money20/20.
That single transaction is a smaller, earlier proof point than 300 million routine users, but it’s the one figure in the report that has already happened rather than been forecast.
Scott Dawson, CEO of DECTA UK, offered an industry view on how reliably any of this can be forecast. “I’ve been doing this long enough to know that what consumers will tell pollsters and what they end up doing is often very different,” he said.
“Tap to pay is the key data point here: when it was first introduced there was a wave of press around how consumers were worried about security and therefore the whole enterprise was bound to fail. What actually happened is that people found it was easy to just tap their cards and now it’s ubiquitous. I can foresee the same thing happening with Agentic Shopping.”
He was careful to size the shift correctly rather than oversell it: “Agentic Shopping does not mean that an AI agent will suddenly decide that you need a new TV; it will be licensed to perform a few basic tasks autonomously but for the most part will work collaboratively with users, asking them what kind of TV they are looking for and how much they are willing to spend then bringing them options to pick from before being authorized to make the purchase.”
Whether the rest of the timeline holds now depends on the parts of the report that read like homework rather than headlines: whether regulators from Washington to Brussels to Seoul actually publish “Know Your Agent” guidance by 2028, whether banks build the consent and liability tools Lau and Haymond describe, and whether the trust gap the FCA has already measured in the UK closes faster than the fraud risk Mastercard itself is warning about.
