
#64: eBay bans AI "buy for me" agents, Shopify merchants pay 4% ChatGPT fee, 73 Scam Suspects Repatriated
Agentic commerce is no longer theoretical and platforms are starting to draw lines. This week’s stories show three different ways the ecosystem is reacting to the same pressure: AI agents moving money, representing users, and scaling fraud faster than existing guardrails were built to handle.
Let's get into it.
NATE'S TAKE - JANUARY 27, 2026
Top Three This Week
- eBay Draws a Hard Line on “Buy For Me” Agents
- Shopify Puts a Price on AI Checkout
- Enforcement Still Matters, Even at Scale
1. eBay Draws a Hard Line on “Buy For Me” Agents

eBay has explicitly banned AI “buy for me” agents and LLM-driven bots from interacting with its platform without permission, updating its User Agreement effective February 20, 2026.
The language is unusually specific: no automated flows that attempt to place orders without human review. This isn’t about scraping anymore. It’s about who’s allowed to act inside the marketplace.
This move follows quiet changes to eBay’s robots.txt file and comes amid broader tension around agentic commerce, especially after Amazon’s “Buy For Me” test raised concerns about consent, listing control, and brand representation.
Marketplaces are realizing that autonomous agents don’t just change UX, they change liability, dispute resolution, and trust boundaries. When an agent buys something, who’s accountable? The user? The platform? The model?
eBay’s answer, for now, is to say no and tighten the rules everywhere else, including arbitration and class action waivers. It’s a reminder that when technical controls lag, legal ones tend to move first.
2. Shopify Puts a Price on AI Checkout

Shopify is taking a different approach. Rather than block agentic checkout, it’s monetizing it.
Merchants will pay a 4% fee on sales completed through ChatGPT checkout, on top of Shopify’s existing fees. Other AI platforms like Google and Microsoft aren’t charging yet, but Shopify is giving merchants opt-in control over where transactions actually happen.
The interesting part isn’t the fee. It’s the strategy.
Shopify is trying to preserve visibility and control by routing AI-driven purchases back through its own checkout infrastructure. If AI agents are going to sit between shoppers and merchants, Shopify wants to be the system of record.
For fraud teams, this raises familiar questions:
- Who owns the transaction context?
- Who sees intent versus execution?
- And what happens when an agent completes a purchase and disappears?
Agentic commerce doesn’t just compress the funnel. It compresses oversight. Fees are one way platforms are pricing in that risk.
3. Enforcement Still Matters, Even at Scale

Photo: Reuters
South Korea repatriated 73 scam suspects from Cambodia this week in a probe tied to $33 million in online fraud. Investigators uncovered seven scam centers, including cases involving deepfake-powered romance scams and suspects who allegedly underwent plastic surgery to avoid identification.
This was the largest group returned so far, and officials made it clear they intend to keep cooperating across borders.
For fraud fighters, this story reinforces two truths. First, deepfakes aren’t just online theater. They’re being operationalized in real scams, against real victims. Second, takedowns matter, but they’re reactive.
By the time people are being flown home in handcuffs, the systems that enabled the fraud have already done their damage.
===
That’s all for this week! For more insights, follow us on LinkedIn or X, and if you want to learn more about what we do, visit www.specprotected.com.
Ready to get started with Spec?
Nate Kharrl, CEO and co-founder at Spec, has built leading solutions for application security and fraud challenges since the early days of the cloud era. Drawing from his cyber experience at Akamai, ThreatMetrix, and eBay, Nate helped found Spec to focus on the needs of businesses operating in a landscape of increasing AI risks. Under Nate’s leadership, Spec grew from its mid-pandemic founding to raise $30M in venture-backed funding to build solutions used by Fortune 500 companies transacting billions in online commerce. Spec’s service offerings today include protective measures for websites and APIs that specialize in defending against attacks designed to bypass bot defenses and risk assessment platforms.



