Why do AI agents and bots increase payment fraud risk for merchants?

AI agents and bots increase risk because they can automate large volumes of probing, scraping, and transaction attempts at machine speed. When malicious traffic blends into normal usage, attackers can test cards, abuse promotions, or simulate legitimate sessions. Merchants need controls that identify automation early and preserve trust in high value customer journeys.

Why AI Agents Change the Fraud Equation for Merchants

AI agents and bots matter here because they collapse the cost of experimentation for fraudsters. Instead of one person manually testing cards, accounts, or checkout paths, automation can run thousands of variations, adapt to simple checks, and keep going until the merchant’s controls fail open. That changes payment fraud from a limited abuse problem into a scale problem, where speed, repetition, and mimicry are the real threat.

For merchants, the issue is not just more traffic. It is more convincing traffic that can imitate browsing patterns, dwell times, retry logic, and session behaviour closely enough to blur the line between legitimate customers and automated abuse. The most common mistake is treating fraud as a pure payment event when the attack often begins earlier, in account creation, promotion abuse, credential testing, or cart and checkout probing. Merchants that only inspect the final authorization step tend to discover the abuse after loss has already accumulated. In practice, many security teams encounter this only after automation has already been tuned against their checkout flow, rather than through intentional testing.

Payment teams can use the OWASP perspective on agentic systems as a helpful adjacent lens, but the primary subject remains merchant fraud exposure, not AI governance itself. For a current overview of the AI agent risk landscape, see the OWASP Agentic AI Top 10.

How Fraud Automation Bypasses Merchant Defences

In practice, automated fraud succeeds when the merchant’s environment makes it easy to separate signal from noise. Bots are valuable to attackers because they can probe controls in parallel, observe which attempts are blocked, and shift behaviour without human pacing. That means even modest weaknesses, such as weak rate limiting, predictable device checks, reused passwords, or inconsistent step-up challenges, can become scalable abuse paths.

The strongest merchant response is to treat the customer journey as a sequence of trust decisions rather than a single payment gate. Each stage can be abused differently:

Account creation can be used to build disposable identities for abuse and testing.
Login and password reset flows can be used for credential stuffing or session takeover.
Promotion and loyalty flows can be targeted for coupon abuse and synthetic demand.
Checkout and authorization flows can be used for card testing, velocity attacks, and chargeback-driven fraud.

Good control design combines bot detection, behavioural analysis, device and session signals, step-up verification, and transaction monitoring. The purpose is not to block all automation, because some automation is legitimate, but to recognise when machine speed is being used to compress attacker learning loops. Merchant teams also need clean feedback loops between fraud operations, engineering, and payment teams so that block decisions are based on durable evidence rather than one-off false positives.

AI-specific risk guidance is useful when merchants rely on agentic tooling to handle parts of the journey or to assist support and checkout. NIST’s AI governance material is relevant where merchant decisions themselves are partially automated, and the NIST AI Risk Management Framework is a useful reference for managing that broader trust boundary. Where this guidance breaks down is when the merchant treats all automated activity as equally suspicious and loses the ability to distinguish fraud from high-value legitimate customers using automation-heavy workflows.

Where the Merchant Risk Becomes Material

Tighter automation controls often increase friction for legitimate customers, so merchants have to balance fraud reduction against conversion loss and support overhead. That tradeoff becomes sharper in industries with high repeat purchasing, subscription flows, marketplace activity, or API-driven commerce, where some machine-like behaviour is normal and some is abusive.

The edge cases matter because fraud actors deliberately hide inside ordinary business patterns. Headless browsers, scripted purchasing, and agent-driven checkout can look similar to genuine customer behaviour if the merchant relies on only one signal. Guidance here is partly consensus and partly operational judgement: there is broad agreement that layered detection is stronger than single-point blocking, but teams still disagree on how much friction is acceptable at different risk thresholds. Merchants should also assume that controls tuned only for classic bot traffic will degrade as attackers adopt better mimicry and as legitimate AI-mediated shopping increases. That creates an ongoing calibration problem, not a one-time fix.

For organisations wanting a broader cyber control baseline around detection and resilience, the NIST Cybersecurity Framework 2.0 provides a useful structure for aligning identify, detect, protect, and recover activities. The practical limit is that no single control will reliably separate fraud automation from legitimate automation in every channel, so merchants need a layered decision model rather than a static bot rule.

Risk and Threat Considerations

Payment fraud risk rises when AI agents and bots can repeatedly test the merchant’s weakest control points at low cost and high speed. The material exposure is not just unauthorized transactions but also account takeover, promotion abuse, and the erosion of trust in automated checkout and support flows.

Failure mechanism: Attackers use automation to vary inputs, rotate infrastructure, and learn which thresholds, challenges, or signals trigger intervention. Once the control set is mapped, the same tooling can sustain card testing, credential abuse, or transaction fraud while blending into ordinary customer activity.

Impact: Merchants can suffer direct financial loss, higher chargeback rates, degraded customer experience, false declines, and reduced confidence in the integrity of their digital commerce channels.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

MITRE ATT&CK address the attack and risk surface, while CIS Controls v8, NIST CSF 2.0 and NIST AI RMF set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
MITRE ATT&CK	T1585 — Establish Accounts	Automation often scales account abuse and disposable identity creation.
Recommendation — Map suspicious signup patterns to T1585 and block bulk account creation before checkout abuse begins.
CIS Controls v8	6 — Access Control Management	Fraud automation often exploits weak access, login, and reset controls.
Recommendation — Apply Control 6 to tighten authentication and revoke abuse-prone access paths quickly.
NIST CSF 2.0	PR.AC-4 — Access Permissions and Authorization Management	Merchants need layered authorization checks across customer journeys and fraud paths.
	DE.CM-1 — Monitoring for Unauthorized Activity	Bot-driven fraud depends on detection gaps and delayed visibility into abuse patterns.
Recommendation — Use PR.AC-4 to enforce risk-based access decisions across account and payment workflows. Use DE.CM-1 to monitor for automated probing, velocity spikes, and abnormal checkout behaviour.
NIST AI RMF	MAP-1 — Context and Scope	If merchants use AI in fraud workflows, they must scope the model's role and limits.
Recommendation — Apply MAP-1 to define where AI-assisted fraud decisions are allowed and where humans must decide.

Practitioner Guidance

What to prioritise: Focus first on the journeys where automation creates immediate value for attackers, especially account creation, login, password reset, promo redemption, and checkout. Those are the places where a small control gap can be exploited at scale.

What to verify: Confirm that bot detection, velocity checks, device intelligence, and transaction monitoring are working together rather than independently. If each team sees only part of the path, attackers can adapt around the blind spots.

What practitioners underestimate: Legitimate AI-assisted shopping and scripted customer behaviour can resemble fraud signals, so merchants need thresholds that are risk-aware rather than simply aggressive. The best controls reduce attacker throughput without making normal purchasing feel hostile.

Practitioner takeaway: Treat AI-driven fraud as a journey-level abuse problem, not a payment-screen problem, because the organisations that win are usually the ones that detect machine speed before it reaches the authorization step.