On October 10th, Elon Musk told people to take a picture of their credit card and drop it into the Grok Bot chat so it could find a deal and order it. His proof the next day was a $241.34 Lego Star Wars order, and the screenshot showed two addresses, an email, an order number and the last digits of his Amex. Nobody has shown whether that order actually used a card photo, or whether he approved the charge.

Grok Bot's own shopping feature doesn't need a photo at all. It pays through Stripe's Link wallet: you approve each purchase, and the bot gets a one-time card or token instead of your real card. We also cover the xAI privacy-policy line that disappeared the day after his post, Visa's warning about fake stores built to fool AI shoppers, and the simple rule for letting an AI shop for you.

Musk's credit card photo pitch

Would you send a chatbot a photo of your credit card? On October 10th, Elon Musk told people to do exactly that. His words: "take a picture of your credit card, drop it in the chat," and Grok Bot finds the deal and orders it. Is that safe? And what's the safe way to let an AI pay? Straight answer coming.

The Lego order screenshot

Next day, the proof: Grok Bot picked Lego Star Wars kits for young kids and ordered them. "As easy as that." Five sets, 241 dollars, done. Then he posted it to more than 240 million followers, says the site Ynet. Look closer: two addresses, an email, an order number, and his Amex, last digits showing. He replied that it's where he gets his mail, not where he lives. Fair enough. He says a security team gets his mail. Yours goes to your door.

How Grok Bot is actually built to pay

Here's the twist: Grok Bot's official shopping feature, launched in August for US users, pays through Stripe's Link wallet. No photo needed. You approve each purchase, and the bot gets a one-time card or token, never your real card. Grok Bot's own docs point the other way: for payment steps, it hands the computer back to you. Passwords and codes don't belong in chat.

What we don't know, and the fine print

To be fair, nobody has shown whether his order used a card photo, or whether he approved the charge. Grok Bot's terms also say it may keep credentials in the cloud, and deleting the bot may not delete them.

The privacy policy line that vanished

And a policy change. A Community Note on his post reportedly pointed to xAI's policy: don't put personal information in prompts. The day after his post, that line was gone. xAI hasn't explained why. Now it says you're responsible for every action, payment details included, as if you'd taken it yourself.

Visa's warning: bots and fake stores

Visa saw malicious bot-initiated transactions, not necessarily AI shoppers, jump 25 percent in six months last year. In the US, 40 percent. Visa also warns of fake stores built to fool AI shoppers: real-looking, dirt cheap, and once the agent pays, they harvest the card data. As BCG's Matt Kropp told CBS News, an agent "could potentially go buy a car, but I wouldn't say, 'Here's my credit card.'"

A real shopping test

Can these agents shop? In one small YouTuber's Walmart test, Grok Bot filled the cart, then said it won't pay until he approves each order's total. If that holds, it isn't a flaw. It's exactly what you want.

The safe way to let AI pay

Visa and Mastercard announced the same idea last year: tokens that stand in for your card. Mastercard's build on tap-to-pay tech. So let the bot hunt the deal and fill the cart. But approve every charge yourself, and never, ever photograph your card.

Sources

Read the full transcript, with every source, on the page for this video. More explainers like this one are on the Kush_EXE YouTube channel.

This article is built from the video's script and published sources. The video uses AI illustrations.