Your agent can get scammed, too.

Your agent followed every instruction. It paid the wrong business.

Imagine a legitimate supplier's invoice is replaced with a convincing fake. The amount and the equipment are correct. The payment instructions point somewhere else. With an AI agent, a photo or PDF of an invoice becomes an instruction to make a payment.

An agent acting on that invoice may stay within its spending limit and still help an attacker get paid.

Most conversations about agentic commerce ask whether merchants can trust agents. Customers need the reverse question answered, too: can my agent trust this merchant?

And the question extends beyond merchants. A lender requesting records, a service accepting a signature, and a business asking for payment instructions are all parties someone has to trust.

Before I show you my ID, show me yours.

x401 lets any online service ask an agent for proof of the owner's identity. That's how a business can establish who's behind a request before accepting it.

But turn the exchange around. A website tells your agent, "Send your owner's identity information to continue."

Who is asking? Who verified that business? Why should your agent hand over anything?

The ability to request identification cannot become permission to collect it. A business asking for identity data needs to be prepared to provide proof of its own.

Imagine your agent applies to a mortgage company impersonating a real lender. Or your agent responds to an email claiming to be your bank, and sends personal details through a fraudulent form. Your agent could submit your income, address, and identity information, exactly as you authorized it to do, except the data’s being sent to a bad actor unbeknownst to you. The agent may understand your instructions perfectly and still deliver your information to an impostor. Verifying the agent’s human owner doesn't solve that. Verifying the business on the other end is part of the same job.

The content can be the trap.

Agents act on what they read. A bill in your inbox can become a payment. An invoice can become a transfer. A request for documents can become a disclosure of your financial life.

That makes the origin of the content consequential. Who issued this invoice? Did this bank request these records? Does the payment instruction actually come from the business you intended to pay?

A logo won't answer those questions because it’s trivial to add a logo to documents with Photoshop or AI. Neither will a plausible email or a professional-looking application form. Your agent needs evidence it can verify.

The business identity must be bound to the specific invoice, payment request, etc.). Verified businesses need a way to sign what they send.

Proof verifies both sides of an agentic transaction. Alongside our consumer identity capabilities, we use KYB verification with Enigma to establish business identity and issue an organization certificate bound to the verified legal entity.

That gives the business a cryptographic identity it can use to sign and seal content. An invoice, agreement, or instruction can carry evidence of the organization behind it and the authority of the person or system acting for that organization.

The seal connects the content to the verified business and makes subsequent changes detectable. Replace payment details covered by the signature, and the altered invoice won't verify against that signature. Sign it with an impostor's credential, and the identity won't match the intended supplier.

The same approach can sign and seal a request for ID. Before sharing information, the owner's agent should be able to verify which organization is asking, what information it requested, and where the response will go. x401 supports signed identity requests; the business credential supplies the verified organization behind the signature.

A valid seal establishes origin and integrity. The agent must still check that this is the business the owner intended to deal with, and that the requested action falls within the owner's permission.

Who is responsible for checking the other side?

Businesses will ask which consumer credentials they can trust. Consumers should ask these sorts of questions to identity platforms and networks:

• Which credential provider is vetting the businesses before helping share my information with them? How is a company verified before allowing them to do business on your platform?
• What evidence connects a request to an admitted business?
• What must the wallet or agent verify before releasing the owner's information?

Those responsibilities belong in the identity network's operating rules. A company should verify its business and signs its request. The owner's wallet or agent verifies the requester and checks the disclosure against the owner's permission. The business then verifies the owner's response. Both sides retain evidence of the exchange.

That's the ecosystem Proof is building: verified people and verified organizations coming together on one platform, with credentials and records each side can check.

A business should know whose instructions it is accepting. A person should know who is receiving their money and information. A credential that travels in only one direction leaves half of that relationship unresolved.

That's why agentic commerce needs a network, not just a credential. Both sides need to show up verified.