A mobile end-user device includes a secure mobile payment agent. The mobile device indicates to network transaction servers, operated by various third parties, that it has the mobile payment agent capability. A user operating a not-necessarily-secure device application can indicate to a network transaction server the desire to make a purchase. The network transaction server opens a secure connection to the mobile payment agent, which verifies the transaction server as authorized to use mobile payments. The transaction server can then request that the mobile payment agent complete the desired purchase by having the user perform a confirmation action, after which the agent indicates a completed purchase transaction to the server. The mobile payment agent can communicate with a billing server to provide various aspects of the mobile payment capability.