What happened
On 21 September 2026, Mastercard and Danske Bank completed Denmark's first payment made by an AI agent. A customer asked an agent to book a coffee tasting on Priceless.com, Mastercard's experiences platform. The agent made the booking and paid with a Mastercard from Danske Bank. It ran on Mastercard Agent Pay, and PayOS handled the transaction from start to finish.
The four safety layers
| Layer | What it does |
|---|---|
| Agentic token | The agent never uses your card number. Mastercard swaps it for a cryptographically secured token. |
| Know Your Agent | Agents have to be registered before they can get tokens. Mastercard calls this its "Know Your Agent" process. |
| Explicit consent | Your consent is collected explicitly before the agent can buy. |
| Payment Passkey | The purchase is confirmed securely with Mastercard Payment Passkeys, which are built on the FIDO2/WebAuthn standard. |
Limits you can set
TechTimes says you set the boundaries once, during setup:
- a spending limit
- the merchant categories the agent is allowed to use
- an expiry window
- optional step-up authentication for bigger purchases
Five questions to ask first
- How much can it spend? Set a spending limit you'd be fine losing.
- Where can it spend? Allow only the merchant categories you need.
- When does its permission end? Pick a short expiry window.
- When does it have to ask you again? Turn on step-up authentication for larger purchases.
- Who pays if it books the wrong thing? This is still an open question for banks. Ask your bank before you rely on an agent.
Where Agent Pay has been tested
- March 2026: Santander ran what Mastercard called Europe's first live AI-agent payment.
- France: Worldline and Crédit Agricole followed.
- September 2026: Danske Bank in Denmark.
The bottom line
The agent handles the searching, booking and checkout. The token, the registration, your consent and the passkey mean the permission still comes from you.
Sources: Mastercard Newsroom (Denmark), Crowdfund Insider, TechTimes, Checkout.com.