Kush_EXE

Musk Said Send Grok a Photo of Your Card. Would You Do It?

· Runs 2:35

On October 10th, Elon Musk told people to take a picture of their credit card and drop it into the Grok Bot chat so it could find a deal and order it. His proof the next day was a $241.34 Lego Star Wars order, and the screenshot showed two addresses, an email, an order number and the last digits of his Amex. Nobody has shown whether that order actually used a card photo, or whether he approved the charge.

Grok Bot's own shopping feature doesn't need a photo at all. It pays through Stripe's Link wallet: you approve each purchase, and the bot gets a one-time card or token instead of your real card. We also cover the xAI privacy-policy line that disappeared the day after his post, Visa's warning about fake stores built to fool AI shoppers, and the simple rule for letting an AI shop for you.

Watch on YouTube Subscribe

In this video

  1. Musk's credit card photo pitch
  2. The Lego order screenshot
  3. How Grok Bot is actually built to pay
  4. What we don't know, and the fine print
  5. The privacy policy line that vanished
  6. Visa's warning: bots and fake stores
  7. A real shopping test
  8. The safe way to let AI pay

Musk's credit card photo pitch 0:00

Would you send a chatbot a photo of your credit card? On October 10th, Elon Musk told people to do exactly that. His words: "take a picture of your credit card, drop it in the chat," and Grok Bot finds the deal and orders it. Is that safe? And what's the safe way to let an AI pay? Straight answer coming.

The Lego order screenshot 0:19

Next day, the proof: Grok Bot picked Lego Star Wars kits for young kids and ordered them. "As easy as that." Five sets, 241 dollars, done. Then he posted it to more than 240 million followers, says the site Ynet. Look closer: two addresses, an email, an order number, and his Amex, last digits showing. He replied that it's where he gets his mail, not where he lives. Fair enough. He says a security team gets his mail. Yours goes to your door.

How Grok Bot is actually built to pay 0:48

Here's the twist: Grok Bot's official shopping feature, launched in August for US users, pays through Stripe's Link wallet. No photo needed. You approve each purchase, and the bot gets a one-time card or token, never your real card. Grok Bot's own docs point the other way: for payment steps, it hands the computer back to you. Passwords and codes don't belong in chat.

What we don't know, and the fine print 1:10

To be fair, nobody has shown whether his order used a card photo, or whether he approved the charge. Grok Bot's terms also say it may keep credentials in the cloud, and deleting the bot may not delete them.

The privacy policy line that vanished 1:22

And a policy change. A Community Note on his post reportedly pointed to xAI's policy: don't put personal information in prompts. The day after his post, that line was gone. xAI hasn't explained why. Now it says you're responsible for every action, payment details included, as if you'd taken it yourself.

Visa's warning: bots and fake stores 1:41

Visa saw malicious bot-initiated transactions, not necessarily AI shoppers, jump 25 percent in six months last year. In the US, 40 percent. Visa also warns of fake stores built to fool AI shoppers: real-looking, dirt cheap, and once the agent pays, they harvest the card data. As BCG's Matt Kropp told CBS News, an agent "could potentially go buy a car, but I wouldn't say, 'Here's my credit card.'"

A real shopping test 2:07

Can these agents shop? In one small YouTuber's Walmart test, Grok Bot filled the cart, then said it won't pay until he approves each order's total. If that holds, it isn't a flaw. It's exactly what you want.

The safe way to let AI pay 2:19

Visa and Mastercard announced the same idea last year: tokens that stand in for your card. Mastercard's build on tap-to-pay tech. So let the bot hunt the deal and fill the cart. But approve every charge yourself, and never, ever photograph your card.

What the sources say

  • On 10 October 2026 Elon Musk posted on X: "To buy stuff, you can just take a picture of your credit card, drop it in the chat and Grok @Bot will scour the Internet for the best deal on the item you want and order it." X, IBTimes UK
  • On 11 October 2026 Elon Musk posted a screenshot of a Lego.com order, writing that he had asked Grok Bot to research Lego Star Wars kits for young kids and order them. Ynet News reported that the image showed shipping and billing addresses, an email address, an order number and the last digits of a payment card. X, Ynet News
  • Elon Musk replied to criticism of his Lego order screenshot that the address shown was where he receives mail, not where he lives, Ynet News reported. Ynet News, Moneywise via Yahoo Finance
  • Ynet News reported that the screenshot of Elon Musk's Lego order did not establish whether Grok Bot finished the order on its own or whether Musk had to approve the payment himself. Ynet News
  • Grok Bot's official account announced on 28 August 2026 that it could buy things online through Stripe's Link wallet. Stripe wrote on 29 April 2026 that an agent using Link gets a one-time-use card or a Shared Payment Token after the person approves each spend request, and does not get the real card details. X, Stripe
  • As of 14 October 2026, Grok Bot's own security documentation said the bot hands payment steps to the user instead of typing credentials, and that "passwords and one-time codes never belong in ordinary chat." SpaceXSI
  • The 24 August 2026 privacy policy of SpaceXSI, formerly xAI, asked users not to include personal information in prompts. The version dated 11 October 2026, the day after Elon Musk's post about card photos, has no such sentence and says users are responsible for all actions, "including providing payment information". SpaceXSI Privacy Policy, SpaceXSI Privacy Policy (Outdated - Aug 24, 2026)
  • Grok Bot's terms, updated on 12 October 2026, say the service may keep data, browser sessions and credentials in a persistent cloud environment, that deleting a bot may not delete them, and that the customer is solely responsible for charges from actions it authorizes. Cursor
  • Visa reported on 20 November 2025 a 25% rise in malicious bot-initiated transactions over six months, and 40% in the United States. It warned that fake storefronts are built to fool AI shopping agents and harvest the stored card data they pay with. Visa
  • BCG's Matt Kropp told CBS News MoneyWatch, in an article updated on 16 September 2026, that shopping by AI agents "isn't mainstream yet and it's pretty risky right now", and said of an agent: "It could potentially go buy a car, but I wouldn't say, 'Here's my credit card.'" CBS News, Moneywise via Yahoo Finance

Sources

  1. Elon Musk on X: "To buy stuff, you can just take a picture of your credit card, drop it in the chat and Grok @Bot will ..." X
  2. Elon Musk on X: "I just asked Grok @Bot to research the most fun Lego Star Wars kits for young kids and order them. As easy as that." X
  3. Elon Musk asks Grok to buy Lego, accidentally exposes addresses and credit card details Ynet News
  4. Elon Musk Gives Financial Advice To 'Take a Picture of Your Credit Card', and Replies Are Hilarious IBTimes UK
  5. Elon Musk Trolled and Mocked Online After He 'Doxxes Himself' by Posting Grok Lego Order Receipt IBTimes UK
  6. Elon Musk wants you to send Grok a photo of your credit card RuntimeWire
  7. Elon Musk says uploading a credit card photo lets Grok shop for you, but even Visa flags rising fraud risks Moneywise via Yahoo Finance
  8. Grok Bot: 'Grok Bot can now buy things on the internet' X
  9. Grok Bot can shop online, one human-approved charge at a time RuntimeWire
  10. Giving agents the ability to pay Stripe
  11. Grok Bot docs: Security SpaceXSI
  12. Grok Bot docs: Computer and apps SpaceXSI
  13. Grok Bot docs: Approvals, security and privacy SpaceXSI
  14. Grok Bot Terms Cursor
  15. SpaceXSI Privacy Policy SpaceXSI
  16. SpaceXSI Privacy Policy (Outdated - Aug 24, 2026) SpaceXSI
  17. xAI Privacy Policy provision: user advised not to input personal information ConductAtlas
  18. Agentic Commerce: The Threat Landscape Visa
  19. AI "agents" can do your shopping. Should you let them? CBS News
  20. I Tested Grok Bot vs. Meta Muse: Who Wins? Jordan Rafealov on YouTube
  21. Visa Intelligent Commerce launch press release Visa
  22. Mastercard unveils Agent Pay, pioneering agentic payments technology to power commerce in the age of AI Mastercard

More in AI news explained