Visa Lets AI Agents Pay Supplier Invoices, No Login Needed

Somewhere in a finance department right now, an AI agent is logging — well, not logging, that's the point — into a supplier portal and paying a real invoice with real money. No human typed the card number. No human ticked a CAPTCHA. No human even clicked "submit". Visa, BILL and Billtrust announced it on October 20, and they are calling it the first live pilot of its kind: AI agents that initiate and complete approved buyer invoice payments end-to-end through supplier portals.

Update, Oct. 21: Visa's controls sequel and the context Bloomberg added

Visa followed its own announcement within 24 hours. A second Oct. 21 release added Visa Commercial Virtual Authentication — 3-D Secure verification for commercial virtual-card users — and Visa Commercial Payment Controls, letting businesses set transaction-level parameters for spend, merchant category, location and timing, available to eligible issuing financial institutions in supported countries (Business Wire). Both are in pilot now and reach general availability in 2027; the release also re-confirms the BILL/Billtrust agent pilot is live and processing end-to-end transactions. The Bloomberg wire (Paige Smith) added two pieces of context the announcement skipped: Visa struck an OpenAI partnership earlier this year to have AI agents make purchases online with user permission, and Visa earlier this year cut about 7% of its workforce, with CEO Ryan McInerney saying AI is accelerating how work gets done (Business Standard). Still undisclosed: transaction volumes, measured efficiency gains, the first fraud incident, and any graduation date for the pilot.

This is the moment agentic commerce stops being a demo and starts being a wire transfer. Whether "trusted" survives contact with the first fraud incident is the real story.

Visa's global headquarters in San Francisco. The October 20 pilot puts the company's Trusted Agent Protocol — launched a year ago — to work in live B2B payments. Photo: Sarah Stierch, CC0 (Wikimedia Commons).

The part nobody has actually done before

AI agents paying for things is not new. Chatbots have been booking travel and ordering office supplies for a while. But those are consumer checkouts — relatively simple, one-shot transactions on public storefronts. What Visa, BILL and Billtrust announced from Las Vegas is structurally harder: B2B supplier portals.

These portals are where invoices go to die slowly. A finance team approves an invoice, and then — this is the bit everyone recognises — somebody still has to open the supplier's portal, log in, and manually key in payment details for an invoice that was already approved three signatures ago. It is the last manual step in the accounts-payable workflow, and until now it was untouchable, because supplier portals demand human authentication: logins, CAPTCHAs, bot-blockers. You cannot script your way past them, and sharing portal credentials with an automated agent is the kind of thing that keeps compliance officers awake at night.

The pilot claims to have solved exactly that. The companies describe it, in their own announcement, as the first live pilot of its kind — a claim we are attributing to them, since nobody else has had time to audit it yet.

How the agent actually moves the money

The mechanics, per the joint release, work like this. The flow starts with BILL's Payment Agent — an authorised AI agent registered using Visa's Trusted Agent Protocol and its Agentic Directory. The agent carries tokenised payment credentials and payment controls aligned with the buyer's approved payment instructions, and it issues card payments on behalf of BILL's customers. That is the buyer side.

On the supplier side, Billtrust uses the same Trusted Agent Protocol to recognise, authenticate, and grant access to the authorised agent, letting BILL complete the invoice payment. Here is the genuinely surprising detail: this agent authentication, according to the companies, can satisfy the site protections historically provided by CAPTCHA and other bot-blocking mechanisms — without an additional agent login. The CAPTCHA, in other words, gets replaced by cryptography.

Five things are supposed to happen at once: a recognised and authenticated AI agent acts on behalf of an identified buyer; tokenised credentials replace shared supplier-portal logins; payment controls stay tied to the customer's approved instruction; the payment path is purpose-built for the specific invoice; and there is full visibility into authorisation and completion. No shared logins. No portal passwords floating around in a finance team's spreadsheet.

Who decides, and who doesn't

This is the sentence the lawyers wrote, and it matters more than anything else in the release: "The agent only executes eligible payments that have already been approved by the buyer." We read the full release and its FAQ, and the companies are emphatic — the buyer decides which invoices get paid and sets the payment instructions and controls. The agent does not select invoices. It does not haggle. It executes.

Suppliers, meanwhile, keep their payment acceptance policy and their visibility. Billtrust customers receive portal payments under their own rules, with the reconciliation data they need to process them — the release argues this can accelerate cash flow, which for accounts receivable teams translates to days sales outstanding dropping and trapped cash getting released faster.

The scale of the two platforms involved is worth noting. BILL says nearly 500,000 businesses use its platform, which processes roughly 1% of US GDP annually, with a member network above 9 million. Billtrust claims the industry's largest B2B buyer network — more than 20 million buyers and $1 trillion in annual trade credit volume. Those are the companies' own figures, but they tell you this is not a sandbox toy: it is running on infrastructure that touches a serious slice of American business payments.

What the executives are actually saying

"Businesses should not have to choose between automation and control when making payments," said Mark Nelsen, SVP and Head of Product for Commercial and Money Movement Solutions at Visa. "This pilot applies agentic commerce to a real B2B-payment problem, by having trusted agents complete payments across platforms. Working with BILL and Billtrust, we are testing how identity, payment controls and transaction visibility can make that model work."

Note the careful verb: testing. For all the confident branding around "trusted agents," Visa's own product chief frames this as an experiment in whether identity plus controls plus visibility is enough to make the model work. That honesty is refreshing, and it quietly acknowledges the stakes: if an agent can pay an invoice, it can, in principle, pay the wrong invoice.

Archana Prasad, SVP of Payments and Financial Services at BILL, took the blunter route: "For too long, supplier portals have been friction points, requiring a person to manually complete what should be an automated step," she said. "With Visa and Billtrust, BILL's AI-powered payments technology is closing that gap: the payment gets done, the supplier gets paid faster, and finance teams get their time back."

And Kunal Patel, SVP of Payments at Billtrust, put the supplier-side case with unusual directness for a press release: "Agentic commerce will only move forward if businesses can trust agents to operate across systems with the same clarity and accountability they expect from people," he said. "By connecting buyer-side invoice approval with supplier-side payment acceptance, this pilot shows how authorized agents can complete business transactions, releasing trapped cash faster while adhering to a complex acceptance policy and preserving visibility and control for both sides."

Illustrative: the itemised paperwork of business purchasing. In the pilot, registered AI agents can complete approved invoice payments without a human logging into the supplier's portal. Photo: Kxtar, CC BY-SA 4.0 (Wikimedia Commons).

Why B2B first, and why Visa's plumbing matters

The release's FAQ contains the shrewdest observation in the whole announcement: B2B payments are a good use case for agentic commerce precisely because they already operate inside established approvals, controls and buyer rules. Consumer agent payments are the Wild West — agents buying on a whim, ambiguous authorisation, endless chargeback disputes. B2B has paperwork, sign-offs and audit trails. It is, counterintuitively, the safer place to let an AI touch money first.

The plumbing is Visa's Intelligent Commerce portfolio — the company's agentic-commerce platform, whose Trusted Agent Protocol launched in October 2025 (we cross-checked the date against Visa's own announcements and multiple industry sources; it was co-developed with Cloudflare, and launch partners included Stripe, Shopify and Adyen). A year later, this pilot is one of the protocol's first production-scale applications: the Agentic Directory is essentially a phone book of verified agents that a portal can consult before deciding to let a bot through the front door.

There is history here, too. Visa and Billtrust's relationship dates to October 2017, when they announced a strategic partnership around virtual card acceptance and Visa made a strategic investment in Billtrust. Nine years of plumbing work is now being pointed at AI agents. That is how enterprise payments move: in decade-long arcs, not launch-day pivots.

The uncomfortable question: who pays when the agent gets it wrong?

Now the part the press release does not say. An AI agent executing payments is a new attack surface, and a serious one. What happens when a prompt-injection attack convinces the BILL Payment Agent to approve an invoice it shouldn't? What happens when a compromised supplier portal feeds the agent falsified invoice data? The release lists its controls — tokenised credentials, buyer-set controls, purpose-built payment paths, visibility — but these are preventative, and payment fraud has a long history of eating preventative controls for breakfast.

This is where the "trusted" branding will be tested hardest. Visa's own Nelsen says they are "testing how identity, payment controls and transaction visibility can make that model work" — and the honest reading is that nobody yet knows whether that trio survives contact with an adversary. Agentic commerce inherits all the risks of AI agents acting on their own and compounds them with money movement, which is the one thing attackers actually care about.

The honest position — and ours — is this: the controls described are the right ones, and executing only buyer-approved payments is the right constraint. But "trusted" is a verdict, not a feature, and it will be earned or lost in the first real fraud incident, not in a press release. Watch for the first reported case of an agent-initiated B2B payment gone wrong. How the three companies respond to it will matter more than anything announced on October 20.

There is precedent for optimism, cautiously. The agentic-payments race is crowded — Mastercard's Agent Pay, Stripe and OpenAI's Agentic Commerce Protocol, Google's Agent Payments Protocol — and Visa has moved to plant its flag on the identity layer, the piece everyone else needs. But a crowded race also means a fragmented one: Cloudflare's move to block AI agents by default shows how much of the web still treats agents as hostile traffic, and Cisco's agent-building agents show how fast the capability side is moving. Visa is betting that the trust layer, not the agent layer, is where the durable advantage sits.

What to watch

The pilot is, per the announcement, already live and processing end-to-end transactions with participating BILL buyers and Billtrust suppliers — not "will pilot," but live. That verb tense is doing a lot of work, and it is the detail we verified most carefully across four sources: Visa's newsroom, PYMNTS, Fintech Singapore and TokenPost all carry it verbatim.

What none of them says: how many transactions, what dollar volumes, or when this graduates from pilot to product. The three companies say they will "continue exploring opportunities in agentic payments" as the pilot progresses, which is corporate for "we'll tell you when there's more to tell." Watch for three things: volume figures (the first hard number ends the "pilot" framing), a fraud or mis-payment incident (the first real test of the controls), and whether other portals adopt the Trusted Agent Protocol beyond Billtrust's network. The third one decides whether this becomes infrastructure or a one-off.

The direction, though, is unmistakable. AI agents are moving from answering questions to moving money, and the first place they are doing it is not consumer shopping — it is the unglamorous, invoice-shaped heart of business payments. The CAPTCHA is dead. Long live the cryptographic handshake.

Is the AI agent deciding which invoices to pay?

No. Per the release's FAQ, the buyer decides which invoices to pay and sets the payment instructions and controls; the agent only executes eligible payments that have already been approved. It does not select invoices.

Do buyers have to share their supplier-portal logins with the agent?

No. The pilot is designed to eliminate the need to share supplier-portal logins. The agent is authenticated through Visa's Trusted Agent Protocol instead of a human credential.

How does the agent get past CAPTCHAs and bot blockers?

Billtrust uses Visa's Trusted Agent Protocol to recognise and authenticate the authorised agent. According to the companies, this authentication can satisfy the protections historically provided by CAPTCHA and other bot-blocking mechanisms, without an additional agent login.

What is Visa's Trusted Agent Protocol?

An identity layer Visa launched in October 2025, co-developed with Cloudflare, that lets websites verify the identity of authorised AI agents via cryptographically signed requests checked against Visa's Agentic Directory — effectively a verified-agent phone book.

Is this a live product or a test?

A live pilot. The companies say it is currently processing end-to-end transactions with participating BILL buyers and Billtrust suppliers, and they will expand exploration as it progresses. No volume figures or graduation timeline have been disclosed.

What cryptographic standard does the Trusted Agent Protocol use?

Per Visa (via webpronews), the protocol's cryptographic standards are based on RFC 9421 — the HTTP message-signatures standard behind verifiable signed web requests. That is what lets a portal treat the agent's request as identity proof instead of running a CAPTCHA.

Is this Visa's first agentic-payments move?

No. Visa struck an OpenAI partnership earlier in 2026 to let agents make purchases online with user permission, and launched the Trusted Agent Protocol itself in October 2025 (Bloomberg via Business Standard; Visa's own releases). The BILL/Billtrust pilot is its first live B2B application. Context: Visa also cut roughly 7% of its workforce earlier this year, with CEO Ryan McInerney saying AI is accelerating how work gets done (Bloomberg/Business Standard).

Sources: Visa newsroom release via Business Wire (Oct. 20, 2026); PYMNTS (Oct. 20, 2026); Fintech Singapore (Oct. 20, 2026); TokenPost (Oct. 20, 2026); Visa–Billtrust 2017 partnership per Billtrust/PYMNTS (Oct. 17, 2017). Quotes attributed verbatim to named executives in the body. The "first live pilot" framing is the companies' claim. Trusted Agent Protocol's October 2025 launch date cross-checked against Visa announcements and industry coverage (eco.com, Forkast, Inc.).

Daniel Rao covers AI, cybersecurity and US tech policy for TechPulse USA. He writes about the intersection of artificial intelligence and national security.