Grok Bot Wants a Photo of Your Credit Card. Who Pays If It Goes Wrong?

What happened

Elon Musk says you can take a photo of your credit card, drop it in a chat, and Grok Bot will go shopping for you. And if anything goes wrong, SpaceX will make you whole.

I’m an auditor, so I did what auditors do. I read the fine print. It says almost the exact opposite.

The timeline moved fast. On October 10, Musk posted the credit card idea. Within hours, X attached a Community Note pointing to xAI’s own privacy policy, which asks you not to put personal information in your prompts.

On October 11, he showed it working. He asked Grok Bot to find Lego Star Wars kits for kids and order them, then posted the screenshot uncensored: order number, email, last four digits of his card. Within hours, a user called Enderman posted screenshots claiming he talked Lego’s support bot into cancelling the order. Musk replied that it wasn’t cancelled. I can’t verify either side. But look at the chain: an AI agent placed the order, a human posted the details, and another AI bot was, allegedly, tricked with them.

Then on Thursday, someone posted that Grok Bot booked his flight from a photo of his card. Musk replied that it works well, and that if Grok Bot makes a mistake with a purchase or leaks your card (“never happened yet”), SpaceX will make you whole.

So we have a product claim, a live demo and a guarantee. I audited all three.

Where the control failed

Control bypass. Grok Bot actually has a decent safety feature. When a bot wants to buy something, it shows you a card with the amount. You tap Allow or Deny. Then Stripe’s Link wallet completes the payment. If you decline, it stays declined. If you ignore it, it expires. That’s a good design: a wallet, an amount on screen, and a human tap before money moves.

A card photo hands over the raw number instead, and Musk’s post doesn’t say whether any approval step still kicks in on that path. Think of an office with a proper badge gate at the front, and the CEO props open the fire exit because it’s faster. The gate still works. Nobody’s using it. The wallet also passes a token instead of your real card number. In India, since 2022, merchants can’t store your actual card number. So the photo trick takes us back to a pre-2022 habit.

Governing document. Grok Bot’s terms, section 2.4, say the customer is solely responsible for charges and consequences of what the bot does, and agent actions come “as is,” with no warranty. The approval controls are described as aids only. They may not catch every unauthorised action, and they don’t reverse completed ones. The company accepts liability only where its gross negligence or wilful misconduct directly caused the loss. When two documents disagree, I test against the signed policy, not the town hall speech. I’m not a lawyer, and I won’t guess how a court would read a tweet against written terms.

If you’re in India, there’s more. RBI has a rule on who bears the loss in unauthorised card transactions: if the loss comes from the customer’s negligence, like sharing payment credentials, the customer carries the entire loss until they report it to the bank. And if your agent buys the wrong thing, you authorised the agent, so it may not be fraud at all. It may just be a dispute with the merchant, which is a much weaker position. Most domestic online card payments here also need an OTP, so either the agent gets stuck at checkout or you hand it your OTP too.

Data retention. A refund gives you your money back. It doesn’t un-leak your card. The terms say the bot may retain your data, files, browser sessions, credentials, memory and routines in a persistent cloud environment. Bots belonging to the same user may share that environment and are not to be treated as separate security boundaries. Deleting a bot may not delete the shared credentials. A card photo carries your name, full number, expiry and, on a lot of cards, the CVV. PCI DSS says merchants shouldn’t keep that CVV after a payment is authorised. A chat history isn’t bound by that the same way.

Segregation of duties. In any company, the person who chooses a supplier is not the person who pays the supplier. In Musk’s flow, Grok Bot searches, picks the seller, enters the card and pays. One actor, four jobs. Futurism notes scammers are already targeting AI chatbots with fake storefronts. Amazon is reportedly blocking Grok Bot’s agents, and Musk’s answer was that Grok Bot will find another way to buy stuff. The trusted store said no, so the agent goes looking somewhere less trusted. Your Allow tap is the second person in the process.

The evidence an auditor should ask for

Before I relied on the SpaceX promise, I’d want answers to three questions:

1. Scope. What counts as a “mistake”? Wrong size? Wrong seller? A scam site?
2. Process. Who do you claim from? Is there a form? A deadline?
3. Proof. If your card leaks, how do you prove it leaked from Grok Bot and not somewhere else?

Right now there are no public answers. Business Insider reported that Musk didn’t spell out the scope and SpaceX didn’t respond when asked. They also noted that Grok Bot, Meta and OpenAI’s terms generally put responsibility for agent actions on the user.

Then the line “never happened yet.” In audit, “no reported incidents” is not the same as “no incidents.” The first question is always: who’s counting? Is there a public incident log, a claim process, a number? Until there is, “never happened yet” is an assertion, not evidence. And in the same week, Musk’s own order details did leak. Not through Grok Bot. Through the human who posted the screenshot.

The test to run this week

My auditor’s take, in three lines:

1. Use the approval flow. Never the photo.
2. Put a virtual card with a low limit behind any agent. Many Indian banks let you create one in their app.
3. Treat “SpaceX will make you whole” as a tweet until it becomes a clause.

AI agents that shop for you are coming. Musk proved the agent can buy things. The question was never whether it works. It’s who carries the risk when it doesn’t. A tweet is not a control, and on paper, today, the person who carries the risk is you.