I’ve been reading a lot lately about card issuers and merchants struggling with AI agents that shop on someone’s behalf. Personal agents like Meta’s Muse now browse stores, compare prices and check out for their owners. Fraud systems trained on human behaviour often can’t tell that kind of agent from a bot that is up to no good, so some of these purchases get flagged or declined.
That got me thinking about referral programs, because they sit right in the middle of this. A referral is a small promise: “my friend sent me, so we both get something.” That promise only works if the code, the person and the purchase stay connected all the way to the till. Put an agent in the loop and that connection starts to fall apart in ways nobody sees.
This post covers five ways agentic shopping breaks referral programs, why the in-person scan LeadBounty is built around still holds, where our consumer app fits, and the problem we haven’t solved yet: promo codes for online stores.
Five ways agents break referral programs
1. The referral quietly disappears
Your customer does everything right. They text a friend their referral link, and the friend asks their agent to “go buy that thing Sam recommended.” The agent searches, finds the product page and checks out. It never opened the link, so the tracking in the URL never came along. Or it did open the link, but a redirect stripped the referral details on the way.
Nothing errors. The friend pays full price, and the customer who made the referral sees nothing. The human carried the referral faithfully, and the agent simply didn’t carry it the last few steps.
2. The store can’t tell a helpful agent from a scraper
Most agents don’t say who they are. Arkose Labs looked at the agent sessions it classified as legitimate across its customers’ sites from July to September 2026, and found that 97.7% of them carried no verified identity at all. Only 2.3% presented a signature proving which agent product sent them. Arkose also notes that personal agents like Muse identify themselves less than 3% of the time, even while handling payments and sign-ins.
From the store’s side, an unnamed agent at checkout looks a lot like the bots that test stolen cards. So the store or the card issuer may decline the payment outright. When that happens, the sale is gone before any referral logic gets a chance to run.
3. Promo codes depend on a landing page the agent never visits
A lot of referral rewards live on a special page: “Welcome! Sam sent you, here’s 15% off.” That works when a person clicks the link and lands on the page. An agent that arrives from a search result skips the page entirely, so the code never appears and never gets applied.
The result looks just like the first problem. A full-price order, no error, and a referrer who assumes their link is broken and stops sharing it.
4. Volume gaming loses its natural ceiling
Human referrals have always had a built-in speed limit. Telling friends about a place takes time and social effort, and there’s a point where it gets embarrassing. Nobody sends four hundred referral texts in one night.
An agent can. It doesn’t get tired or embarrassed, and it can create sign-ups and referral events around the clock. Leaderboards, tier bonuses and “refer five friends this month” challenges were all sized for people. Without that ceiling, the business ends up paying rewards for activity that never involved a real customer.
5. Chargebacks lose their story
I have worked with chargebacks, and the one thing every dispute needs is a story: who bought this, and why. The rules banks use to settle disputes assume that a person tapped “approve.”
When an agent buys something and the cardholder later disputes it, that first fact gets murky. Did the owner ask for it? Did the agent misread an instruction? Was the agent hijacked? None of the existing rules were written for “the AI did it.”
Referral programs feel this twice. The merchant often pays the referral reward right after the sale, and the dispute arrives weeks later, after the money has already moved. This is also why the identity problem and the chargeback problem are really the same problem. If nobody can say who was behind the purchase, nobody can say who is responsible for it either.
The moat: a QR code you have to be there to scan
LeadBounty started with businesses that have a front door: cafés, salons, barbershops, gyms. For them, the strongest part of the program is a QR code that only lives in the store. It sits by the till or on a table card, and it is not meant to be posted on a website.
Claiming a reward that way needs a person, standing in the shop, holding a phone. An agent can do plenty of things online, but it can’t walk into a café.
The obvious limit
Okay, but what if someone in Toronto takes a picture of that QR code and texts it to a friend in New York? The friend never set foot in the store, yet they can scan the photo from their couch.
Location is the answer. When someone scans, the phone’s location can be compared with the business’s registered address, and the claim only counts if both are inside a small radius. The friend in New York can still scan the photo, but their phone is in the wrong city, so the claim doesn’t count.
There are ways around that, but we won’t get into them here.
LootSquad: keeping the trust graph human
We’re also building LootSquad, a consumer app on top of LeadBounty. It isn’t live yet. The idea is collective taste: people recommending the businesses they actually trust, in crews with friends, with each person’s reputation built on verified in-person scans.
Agents fit into this in a useful way. Through the Model Context Protocol (MCP), the standard way for AI assistants to connect to outside tools, an agent could ask LootSquad what its owner’s friends recommend nearby. “Where do my friends get their hair cut?” is a great question for an agent to answer.
The risk is the opposite case. If an agent runs the account and starts adding other agents to its crews, the trust graph turns into a bot farm. So the rule is that reputation only moves when someone completes a verified scan in person. Joining a crew earns nothing on its own. Agents can still pass recommendations along to each other, but the scan at the door keeps the signal human.
That works for businesses people walk into. It doesn’t work for online stores and delivery. An agent’s shipping address is just wherever it was told to send the package, and there’s no physical presence to check. That’s the gap the last section of this post comes back to.
The open question: promo codes for online stores
This is the wall we haven’t climbed yet, and we have to, because online shopping is where the volume is. I don’t have a finished answer, but I have three directions I think are worth following.
Mint the code at the moment of purchase. Most businesses generate promo codes in big batches ahead of time. That’s work to manage, and a stockpile of valid codes is exactly what leaks onto coupon sites. A better pattern is for the code to be created only when someone is ready to buy, tied to that one checkout, and expired when the checkout closes. There’s no stockpile to leak, and a code that only works once, for one session, is useless to anyone who copies it. This applies to anyone who issues promo codes, not just us.
A trusted signature for agents. Websites prove who they are with certificates signed by a trusted authority, which is what the padlock in your browser means. Agents could work the same way. The card issuer would sign a credential saying “this agent acts for this specific cardholder,” and the store could check that signature without ever knowing the person behind it. That would give disputes their story back, because there would be a named human behind every signed purchase. The catch is that the card networks have to lead. Visa has started down this road with its Trusted Agent Protocol, but it needs to become the normal way agents pay before stores can rely on it.
A vault the agent can ask. This is where LootSquad comes in. Every reward and promo code your friends have sent you would live in one place, your LootSquad account, and your agent could ask it for the right one when it’s time to check out. Today, a referral code has to survive a chain of links and redirects to reach the checkout, and that’s exactly where it gets lost. In a vault, the code doesn’t have to survive the journey. The agent goes and gets it.
The canary in the coal mine
Referral programs are an early warning for agentic commerce, because they put a price on trust at exactly the point agents can’t fake: a real person vouching for a place they’ve actually been. When that breaks, it breaks silently, in full-price orders and referrers who quietly give up.
LeadBounty assumes the bots are already here, and builds around them. The in-store scan keeps the referral tied to a real visit. The rewards only move when a real person shows up. And for the part we haven’t solved yet, we’d rather say so out loud than pretend.
If you run a business with a front door, you can start a referral program built around the in-store scan today. And if you’re thinking about the online side of this problem too, I’d genuinely like to hear from you.