Agentic AI in fraud detection demands new governance for autonomy

At a glance

What this is: This article frames agentic AI as a move from reactive fraud scoring to autonomous risk orchestration, with Feedzai highlighting faster decisions, lower manual effort, and new governance pressure.

Why it matters: Fraud, IAM, and AI security teams need to treat agentic systems as decisioning actors with authority boundaries, not just analytics tools, because their outputs can trigger real-world action.

By the numbers:

• 70% of financial services leaders surveyed by The Financial Brand are already deploying or exploring AI agents to handle high-velocity operations.
• The market for agentic AI in fraud is on track to reach $11.53B in 2026, according to MarketsandMarkets.
• Feedzai has observed that financial institutions can reduce unnecessary data consumption by up to 20% by orchestrating expensive signals only when risk warrants it.
• McKinsey & Company reports that organizations using AI agents have seen productivity gains of up to 40% in core operations like underwriting and compliance.

Context

Agentic AI in fraud detection is best understood as a governance shift, not just a model upgrade. The core change is that systems move from scoring events to planning and executing multi-step actions, which means identity, authorisation, and oversight now matter at the point of action rather than only at the point of review.

That matters for financial crime operations because many current controls assume a human analyst remains the decision-maker. When an agent can query data, adjust thresholds, and trigger case actions across multiple systems, the security question becomes which actions are permitted, how they are logged, and where human accountability still sits.

Key questions

Q: How should security teams govern agentic AI in fraud detection?

A: Start by separating detection support from decision authority. Agentic AI can correlate signals quickly, but any action that changes customer treatment, case priority, or compliance status needs explicit policy, traceability, and a human escalation path. Governance should define what the system may recommend, what it may execute, and what always requires review.

Q: Why do agentic AI deployments increase breach risk even when the model is accurate?

A: Accuracy does not remove risk when the system can still take harmful actions. A highly accurate agent can be manipulated through retrieved content, injected instructions, or unsafe tool access, then use legitimate permissions to carry out the wrong operation. The risk comes from delegated authority and connected workflows, not just from model error rates.

Q: What are the signs that agentic commerce fraud controls are failing?

A: A strong warning sign is a rising mix of false declines, unexplained approvals and disputes where the transaction path cannot be reconstructed from existing logs. If analysts cannot tell whether a purchase was human-led or agent-led, the control environment is blind to a new class of traffic rather than simply underperforming.

Q: When should teams require human review for agent-driven fraud decisions?

A: Use human review when the action changes customer access, funds movement, or regulatory exposure, or when the agent cannot show a complete and auditable decision path. Human approval should sit on top of high-impact actions, while low-risk enrichment and triage can remain automated.

Technical breakdown

Autonomous fraud orchestration changes the control surface

Agentic AI in fraud detection is not just faster machine learning. It is a closed loop in which the system sets sub-goals, calls tools, evaluates results, and adapts its next step. That makes it structurally different from a scoring model or rules engine, because the system no longer only recommends. It can execute. In identity terms, the agent behaves like a non-human actor with delegated authority, which means its permissions, data reach, and decision boundaries become part of the security model. Practical implication: treat agent capability as an access-governance problem, not only a model-risk problem.

Practical implication: Define exactly which actions an agent may take, then bind those actions to explicit authorization and audit controls.

Explainability and auditability must track every agent decision

Fraud teams have always needed explainable decisions, but agentic systems raise the bar. A score tells you what happened. An agent also needs to explain why it chose one action over another, what signals it consumed, and which tool calls led to the outcome. That is especially important where the agent influences KYC, case triage, or transaction decisions that carry regulatory and customer-impact consequences. The problem is not only transparency after the fact. It is reconstructable intent at runtime. Practical implication: if an agent cannot produce a decision trace, it should not be allowed to make customer-impacting fraud decisions.

Practical implication: Require decision traces that show inputs, tool use, policy checks, and final action for every customer-impacting event.

Adversarial agents create a new fraud perimeter

The article notes that criminals are also using agentic malware, synthetic identities, and automated probing. That matters because the defence is no longer confronting isolated fraud attempts, but adaptive adversaries that can learn, test, and iterate. In practical terms, fraud controls need to resist both a human attacker and a machine-speed attacker that can generate varied inputs until a control weakens. This is where identity verification and access governance intersect. If the institution cannot distinguish legitimate agent-driven automation from malicious automation, it will misclassify risk at machine speed. Practical implication: move from static rules to continuously validated trust signals for both users and systems.

Practical implication: Continuously verify whether automation is authorised, expected, and within scope before it is allowed to influence fraud outcomes.

Threat narrative

Attacker objective: The objective is to automate fraud operations at scale while bypassing human review and exhausting defensive controls.

1. Entry occurs when an attacker uses agentic malware or synthetic identities to probe a bank’s defenses at machine speed.
2. Credential_harvested occurs when the attacker iterates phishing scripts or trust exploits to obtain or impersonate the information needed to progress.
3. Escalation occurs when the adversary uses autonomous probing to expand access across systems and strengthen fraud attempts.
4. Impact occurs when the attacker achieves fraud at scale, including synthetic identity abuse and unauthorized manipulation of financial workflows.

Breaches seen in the wild

• McKinsey AI platform breach: McKinsey AI platform hack exposed 46M chats and sensitive data.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Agentic AI turns fraud detection into an identity governance problem. Once a system can plan, act, and adapt, it stops being a passive analytics layer and starts behaving like a non-human actor with delegated authority. That changes the control question from model accuracy to who may authorise actions, under what conditions, and with what audit trail. Practitioners should treat agent permissions as part of identity governance, not a separate AI concern.

Explainability is no longer only a compliance feature, it is a control boundary. When a fraud agent can trigger a block, request friction, or change thresholds, the organisation needs to reconstruct why the action happened and whether the agent stayed within scope. Black-box autonomy creates accountability debt because investigators cannot distinguish policy-compliant automation from overreach. Practitioners should require runtime decision traces that can be audited alongside the case record.

Continuous KYC becomes more credible when machine identities are governed as first-class actors. The article’s emphasis on continuous monitoring and dynamic verification points to a wider shift in financial services: identity checks must operate at every stage of the journey, not only at onboarding. That creates a direct intersection between fraud prevention, IAM, and NHI governance. Practitioners should align customer identity, agent identity, and system access under one decision model.

AI-driven fraud defences will fail if they inherit static rules thinking. Agentic systems are valuable precisely because they can re-evaluate thresholds and signals in real time, but that capability also means governance must shift from periodic review to continuous policy enforcement. The market is already moving toward autonomous decisioning, so teams that preserve human-era control assumptions will create blind spots. Practitioners should redesign oversight for runtime authority, not retrospective approval.

Know Your Agent is becoming the next governance layer for financial crime operations. The article’s mention of future frameworks to verify agents’ identities and authorisations is the right direction for the category. Financial institutions will need to inventory, classify, authorise, and monitor agents the same way they govern high-risk service accounts and privileged workflows. Practitioners should prepare for a control model that covers both human and machine decision makers.

From our research library:

• Only about one-third of approximately 500 organizations surveyed by McKinsey in 2026 report maturity level three or higher across agentic AI governance controls.
• Read next: Agentic AI Identity Guide

What this signals

Know Your Agent is the next control plane for fraud operations. As agentic systems take on more decisioning work, the programme question shifts from whether AI is being used to whether the organisation can prove each agent’s authority, scope, and accountability. The control model has to cover machine decision makers the same way it already covers privileged human workflows.

The practical challenge is that fraud teams cannot rely on periodic review cycles alone. An agent can evaluate signals, alter actions, and trigger cases inside a single operational loop, so trust has to be asserted at issuance time and continuously reaffirmed during execution. That is where identity governance, authorisation, and audit converge.

Feedzai’s direction is consistent with the broader market signal that 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems. For practitioners, that means current access models are already under strain and should be reworked before agentic deployments become production dependencies.

For practitioners

• Define agent authority boundaries Map every fraud-use-case agent to a narrow set of allowed actions, data sources, and escalation paths, then revoke any default access that is not needed for the task.
• Require decision-level audit trails Log the inputs, tool calls, policy checks, and final action for each agent-driven fraud decision so investigators can reconstruct why the system acted.
• Separate high-risk actions from routine scoring Keep blocking, threshold changes, and case closure decisions behind explicit approval gates when the agent cannot prove the full context needed to act safely.
• Continuously validate non-human trust signals Check whether an automation identity is authorised, expected, and within scope before it can influence KYC, fraud scoring, or customer friction.
• Build controls for adversarial automation Test fraud workflows against synthetic identities, rapid request variation, and automated probing so the defence can withstand machine-speed abuse.

Key takeaways

• Agentic AI changes fraud detection from reactive scoring to autonomous orchestration, which expands the control surface to include authority, auditability, and runtime scope.
• The article points to measurable upside in productivity and data efficiency, but those gains depend on governance that can explain and constrain machine decisions.
• Financial institutions should govern AI agents as delegated actors with explicit permissions, continuous validation, and human oversight for high-impact outcomes.

Key terms

• Agentic AI: Autonomous AI systems capable of planning, deciding, and taking actions, including calling APIs, writing code, and orchestrating other agents, with minimal human oversight. Agentic AI introduces new NHI risks as agents must authenticate to external services.
• Embedded KYC: Embedded KYC is the practice of placing customer identity verification directly inside the onboarding workflow instead of managing it as a separate process. In regulated environments, it creates a single control path for identity proofing, sanctions screening, and audit evidence, which can improve consistency if governance is clear.
• Human-in-the-loop Governance: Human-in-the-loop governance is a control pattern that requires a person to approve or interrupt specific high-impact actions before they complete. For autonomous agents, it shifts oversight from retrospective review to live intervention. That matters when the agent can act faster than a governance cycle can catch up.
• Know Your Agent: A governance pattern for verifying that an AI agent is the intended actor, not a hijacked or impersonating one. It extends identity assurance beyond login by focusing on runtime behaviour, delegated authority, and the integrity of the agent's actions across connected systems.

Deepen your knowledge

The NHI Foundation Level course covers NHI governance, agentic AI identity, machine identity security, and identity lifecycle fundamentals, including how to reason about delegated authority and access scope. It is designed for practitioners building controls across IAM, security, and AI-enabled operations.