Agentic commerce fraud exposes gaps in device identity controls

At a glance

What this is: This article argues that agentic commerce expands fraud exposure because AI agents can look like legitimate shoppers while bypassing controls built around human behaviour and stable device signals.

Why it matters: It matters because IAM, fraud, and platform teams now have to govern transactions where the user, the device, and the actor may no longer be the same thing.

Context

Agentic commerce is the point where software can behave like a shopper, not just assist one. That changes the identity problem for fraud teams because the platform is no longer only judging a browser, a session, or a device. It is now judging an actor that can imitate human timing, navigation, and purchase flows.

The security gap is not that device intelligence stops working. The gap is that device and session signals were designed to help distinguish legitimate and illegitimate human use, while agentic behaviour can reuse the same paths and look normal at the interaction layer. For IAM and fraud programmes, that shifts the control question from user verification alone to actor trust and transaction intent.

Key questions

Q: What breaks when fraud controls only trust the device and session in agentic commerce?

A: Device and session controls can still confirm that a browser or app looks familiar while missing whether the actor behind it is authorized to make the transaction. In agentic commerce, that means a trusted session can carry fraudulent intent. Teams need controls that validate actor authority, not just environment familiarity.

Q: Why do AI agents increase fraud risk even when they use legitimate user environments?

A: AI agents can reuse approved browsers, devices, and workflows while adapting their timing and navigation to look human. That makes them harder to separate from real customers using traditional bot or session checks. The risk rises because behaviour can be legitimate in form but unauthorized in intent.

Q: How should security teams implement actor trust checks for online transactions?

A: Start by placing policy decisions at the point where value is transferred, not only at login. Then combine device intelligence, transaction context, and explicit authority rules so high-risk actions require stronger verification than routine browsing. The aim is to validate the right to act before the transaction completes.

Q: What is the difference between device identity and actor authorisation in fraud prevention?

A: Device identity answers whether a browser, app, or endpoint looks known and trustworthy. Actor authorisation answers whether the entity driving the action is allowed to complete that transaction in that context. Fraud teams need both, but actor authorisation is the deciding control once AI agents can mimic human-like sessions.

Technical breakdown

Why device identity breaks down in agentic commerce

Device identity works by linking a browser, app, or endpoint to a repeatable signal set. Persistent identifiers, pre-login telemetry, and behavioural patterns help fraud teams decide whether a session looks familiar, risky, or automated. Agentic commerce complicates that model because an AI agent may operate through a real user environment, a delegated browser, or a workflow that inherits a legitimate device context. The result is not simply more bot traffic. It is a control environment where the signal set can look authentic even when the actor behind it is not the person the business believes it is.

Practical implication: treat device identity as one trust input, not the control boundary for transaction approval.

How malicious AI agents mimic legitimate shopping behaviour

Malicious agents do not need to defeat every fraud signal if they can approximate the parts that matter most to purchase flows. They can browse slowly, vary interaction timing, reuse common checkout paths, and adapt to the platform’s own anti-abuse logic. That makes them different from simple bots that trip rate limits or static fingerprint rules. The issue is not only automation. It is adaptive behaviour that can sit inside a normal-looking session and still execute fraud at scale. In practice, this means fraud models need to distinguish human presence from human-like workflow execution.

Practical implication: evaluate whether your fraud stack detects actor behaviour, not just automation markers.

Why session controls alone do not resolve actor trust

Session controls can reduce replay, hijacking, and some forms of abuse, but they do not answer who or what is driving the session when the actor itself is agentic. A session can be valid, a device can be known, and the transaction can still be fraudulent if the decision-making entity is unauthorized. That is the governance gap. Once a platform accepts delegated or autonomous behaviour, the trust decision moves earlier in the flow and must account for the identity behind the action sequence, not just the session state at the moment of payment.

Practical implication: move fraud checkpoints toward actor authorisation and transaction intent validation before checkout completion.

Threat narrative

Attacker objective: The attacker wants to turn AI-driven behavioural mimicry into scalable transaction fraud without triggering standard device or session-based defences.

1. Entry occurs when a malicious AI agent obtains access to a browsing or purchasing workflow that appears legitimate at the device and session layer.
2. Escalation happens when the agent adapts its behaviour to blend in, reusing normal navigation and timing patterns to avoid simple bot controls.
3. Impact follows when the agent completes fraudulent transactions or enables platform abuse at a scale that conventional human-centred controls were not designed to absorb.

Breaches seen in the wild

• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
• AI agent retail card theft campaign 2026: AI agents breached 27+ retailers for about $25 each, used cloud keys and a Secrets Manager dump, and stole 600,000+ payment cards.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Device identity is becoming a necessary signal, but not a sufficient trust decision, in agentic commerce. Fraud programmes have long treated device intelligence as a way to separate known-good from suspicious activity. That assumption weakens when the actor can borrow legitimate browser context, mimic user timing, and operate through approved channels. Practitioners should stop treating device identity as the final answer and treat it as one layer in actor trust.

Agentic commerce creates an identity problem, not just a bot problem. The central shift is that the platform must reason about who or what is initiating the transaction, not only whether the transaction looks automated. That matters for fraud prevention, IAM, and customer authentication because the same session can now contain delegated intent, autonomous action, or outright abuse. Practitioners need governance that separates valid device context from valid decision authority.

Actor trust must replace session optimism as the governing assumption. Traditional controls often presume that a valid session implies a legitimate actor for the life of the transaction. That premise fails when AI agents can operate inside normal-looking sessions and still act outside the customer’s intent. The implication is that fraud and identity teams need common language for transaction authority, not siloed views of device telemetry and authentication events.

Agentic commerce forces fraud and IAM to converge around entitlement to act. This is the same governance move that machine identity programmes made when they stopped asking only whether a workload had authenticated and started asking whether it should still be allowed to act in that context. The field is moving toward actor-centric authorisation, where policy has to reflect delegated execution and not just login events.

Identity blast radius is now a transaction design problem. Once AI agents can traverse shopping flows at human speed and scale, the question is no longer only how to block abuse. It is how much damage a trusted device, session, or delegated agent can do before a control boundary is reached. Practitioners should redesign controls around blast-radius reduction, not just fraud detection after the fact.

From our research library:

• 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.
• Systems with least-privileged AI access had a 17% incident rate vs 76% for over-privileged systems. Organisations failing to scope AI access properly are 4.5x more likely to experience a security incident, according to the 2026 Infrastructure Identity Survey.
• Read next: AI Agent Identity Security Buyer's Guide

What this signals

Actor trust is the missing control plane in agentic commerce. Fraud stacks built around device reputation, browser integrity, and behavioural heuristics still matter, but they do not answer the harder question of whether the entity initiating the action is authorised to do so. As AI agents become capable of acting through legitimate customer paths, practitioners need transaction-level policy that checks authority before value moves.

Existing fraud controls were designed to spot abuse inside a human session. Agentic commerce changes the assumption set because the session can be real, the device can be known, and the intent can still be wrong. That pushes IAM and fraud teams toward shared governance for delegated action, with clearer limits on what a trusted context is allowed to do.

For practitioners

• Define actor trust checkpoints Insert explicit trust checks before checkout, payment, or account-change actions so the platform can distinguish valid session state from valid authority to act.
• Use persistent device signals as one control layer Keep device fingerprinting, risk scoring, and behavioural telemetry in place, but do not treat any single device signal as proof of legitimate intent.
• Separate delegated use from customer-authorised use Map flows where AI assistants, browser automation, or embedded workflows can place orders on behalf of users, then require policy decisions for each route.
• Escalate transaction review for high-risk flows Require stronger review for first-time payee changes, unusual basket composition, or rapid sequence purchasing that may indicate agentic abuse.
• Align fraud operations with IAM governance Make fraud, IAM, and platform security share the same policy model for actor identity, delegated authority, and transaction boundaries.

Key takeaways

• Agentic commerce turns fraud into an actor-trust problem because AI agents can imitate legitimate customer behaviour while staying inside familiar devices and sessions.
• The main control gap is not the absence of device signals, but the assumption that a normal-looking session proves authorised intent.
• Fraud and IAM teams should move policy decisions earlier, tying transaction approval to actor authority rather than relying only on behavioural detection.

Key terms

• Agentic Commerce: Agentic commerce is a buying and transaction model where software agents act on behalf of a person. The identity challenge is not just proving who owns the account, but constraining what the agent may do, for how long, and under what revocation and audit rules.
• Actor Trust: Actor trust is the decision that a specific entity is allowed to initiate or complete an action in a given context. In agentic environments, it must distinguish between a valid device, a valid session, and valid authority to act, because those are no longer guaranteed to be the same thing.
• Device Intelligence: Device intelligence is the practice of interpreting signals from a device to assess whether a session or transaction is likely legitimate. It goes beyond fingerprinting by combining device context with behavioural, identity, and payment evidence to support a risk decision.
• Delegated action: An action performed by one identity on behalf of another, with some authority borrowed from the principal. In agentic environments, delegated action needs explicit scope, auditability, and revocation boundaries because the executor is not the same as the beneficiary.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.