Agentic commerce fraud exposes the governance gap in delegated access

At a glance

What this is: This article explains how agentic commerce fraud turns customer-authorised AI shopping agents into a governance gap, with abuse showing up as legitimate-looking orders rather than noisy checkout anomalies.

Why it matters: It matters because merchants and identity teams must now govern delegated access, post-purchase abuse, and agent behaviour, not just checkout sessions and payment fraud signals.

Context

Agentic commerce fraud is a governance problem created by delegated authority. Once a customer authorises an AI shopping agent, the merchant may see a clean transaction path while losing the behavioural cues that traditional fraud systems expect from a human shopper. That creates a new control gap between identity intent, delegated action, and payment outcome.

This is not simply a checkout security issue. It sits at the intersection of fraud prevention, identity assurance, and access governance, because the key decision is no longer whether a user authenticated, but whether the agent's use of that delegated access still matches customer intent across the full buying lifecycle.

Key questions

Q: What breaks when an AI shopping agent can act without clear purchase limits?

A: Without clear purchase limits, an AI shopping agent can move from convenience to delegated financial risk. It may complete purchases the customer would not approve, accept manipulated offers, or reuse account and payment details in ways that are hard to unwind. The control failure is scope, not speed, so teams need explicit authority boundaries and step-up checks.

Q: Why do delegated AI shopping flows increase fraud risk even when authentication succeeds?

A: Authentication only proves that access was granted, not that the agent still reflects the customer's intent. Fraud risk rises when stored payment credentials, trusted tokens, and authorised agent actions can be reused across the order lifecycle without additional scrutiny. The dangerous condition is valid access being used outside its expected behavioural scope.

Q: How can merchants tell legitimate agent-led orders from bot takeover?

A: By looking for drift across the full purchase sequence. Legitimate automation should still fit a customer-specific pattern for product type, spend, shipping destination, and post-purchase behaviour. Bot takeover usually shows up as acceleration, rerouting, refund abuse, or other changes that break the customer's normal buying profile.

Q: Should fraud teams treat returns and refunds as part of identity governance?

A: Yes. In agentic commerce, the identity decision does not end at payment authorisation because the same delegated authority may later be used to cancel, reroute, or refund orders. That makes post-purchase actions part of the governed trust chain, especially where the agent can operate without fresh human confirmation.

Technical breakdown

How delegated access changes the fraud signal

Traditional ecommerce fraud models rely on human behaviour: browsing friction, retries, hesitation, device patterns, and checkout variance. Agentic commerce removes much of that behavioural scaffolding because an AI agent can move from selection to purchase in seconds. The transaction can therefore look more legitimate, not less, even when it is being driven by a compromised agent or misused delegated authority. The core technical shift is that the fraud signal moves from session behaviour to the meaning of the delegated action itself.

Practical implication: Fraud controls must evaluate authorisation context and downstream behaviour, not just checkout anomalies.

Why post-purchase actions become part of the attack surface

In agent-led shopping, delegated access can extend beyond payment authorisation into refunds, returns, cancellations, rerouting, and support interactions. That expands the abuse surface because each step can comply with policy on paper while still serving a fraudulent objective. The agent becomes a durable control plane for the attacker, especially when stored payment tokens and pre-approved account permissions are reused without fresh human verification.

Practical implication: Treat refunds, returns, and shipment changes as governed identity events, not only customer service workflows.

Behavioural drift is the better detection model than static rules

Agentic fraud often succeeds because each isolated action appears plausible. The better detection model looks for drift across a sequence of actions, such as a change in basket value, shipping destination, purchase cadence, or post-purchase behaviour. That requires linking transaction monitoring to account history and lifecycle signals so the system can see whether the agent is still operating within the customer's established intent. In practice, the decision is about whether delegated access still behaves like delegated trust.

Practical implication: Build detection around sequence-level drift and lifecycle signals rather than single-event fraud scoring.

Threat narrative

Attacker objective: The attacker wants to convert trusted agent-led shopping into low-friction fraud that clears authorization and hides in normal commerce workflows.

1. Entry occurs when an attacker compromises an AI shopping agent or abuses the delegated access a customer granted it.
2. Credential access happens through stored payment credentials, trusted tokens, or account-linked permissions that the agent can reuse without fresh challenge.
3. Escalation follows when the attacker uses the agent to place orders, reroute shipments, or drive returns and refunds that appear policy-compliant.
4. Impact is fraudulent purchasing, post-purchase abuse, and customer loss without the noisy signals that traditional ecommerce fraud systems expect.

Breaches seen in the wild

• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
• Gitloker GitHub extortion campaign: Phishing via GitHub notifications tricked developers into authorising malicious OAuth apps; Gitloker then wiped repos and demanded contact.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Delegated access is now the fraud boundary. Agentic commerce shifts the decisive control from checkout behaviour to the authority granted to software acting on a customer's behalf. That means the governance question is not whether an order looks automated, but whether the agent remains inside the customer's intended scope. Merchants that still anchor detection on human-session assumptions will miss the abuse pattern most likely to scale.

Agentic commerce creates a governance gap between identity proof and intent proof. A customer may be authenticated, yet the agent's later actions can drift away from the customer's actual intent. That distinction matters because delegated access can remain technically valid while becoming operationally abusive. The practical conclusion is that identity assurance is necessary but not sufficient when software can act under human-granted authority.

Behavioral drift is the right named concept for agent-led fraud detection. The useful signal is not a single suspicious event but a pattern of change across purchase size, destination, timing, and post-purchase action. This aligns with broader fraud and identity governance thinking: control the lifecycle, not the isolated transaction. Practitioners should treat drift as a signal that delegated trust has become misaligned.

Agentic commerce will pressure merchants to merge fraud operations with identity governance. Once agents can buy, refund, cancel, and reroute on behalf of users, the boundary between fraud prevention and access governance collapses. That does not mean every merchant needs a full IAM programme, but it does mean delegated authority, token reuse, and post-purchase behaviour must be governed as one risk surface. Teams should expect their fraud stack and identity stack to converge operationally.

Post-purchase abuse is the clearest sign that commerce automation needs lifecycle controls. Return fraud, rapid cancellation, shipment rerouting, and refund manipulation are not side effects of agentic commerce, they are part of the control problem. The right response is to govern the full action chain, from authorisation through after-sale changes. Practitioners should design controls that remain effective after the initial payment succeeds.

From our research library:

• 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
• Systems with least-privileged AI access had a 17% incident rate vs 76% for over-privileged systems. Organisations failing to scope AI access properly are 4.5x more likely to experience a security incident, according to the 2026 Infrastructure Identity Survey.
• Read next: Agentic AI Identity Guide

What this signals

Delegated access becomes the control plane for commerce risk. As agent-led purchasing scales, merchants will need to govern what the agent is allowed to do across the whole lifecycle, not just whether it can complete checkout. That changes fraud operations from event review to authority review, with identity and intent becoming the key control points.

Agentic commerce will force a tighter link between fraud prevention and identity governance. The practical boundary is no longer the login screen, because the risky action may happen after authentication and even after payment approval. Teams should prepare for controls that combine customer intent, delegated permissions, and post-purchase monitoring into one operating model.

Behavioral drift is the named signal worth operationalising. When an order pattern shifts too quickly, moves to unfamiliar destinations, or begins to generate unusual refunds and cancellations, the issue is not just fraud scoring. It may be delegated trust that has drifted out of alignment, which means response should be lifecycle-based rather than checkout-only.

For practitioners

• Treat delegated access as a governed risk surface Map which agent actions are authorised, which are merely tolerated, and which require re-verification before execution across the shopping lifecycle.
• Detect behavioural drift across the full order journey Correlate basket changes, shipping destination changes, spend acceleration, refund timing, and cancellation patterns instead of scoring isolated checkout events.
• Extend fraud controls beyond payment approval Apply monitoring to account updates, shipment rerouting, cancellation requests, returns, and chargebacks so post-purchase abuse is visible.
• Separate trusted automation from compromised automation Create policy that distinguishes legitimate agent-led purchasing from bot takeover by using identity-linked intent and customer-specific baselines.

Key takeaways

• Agentic commerce fraud exploits customer-granted authority, which means clean-looking orders can be the symptom of a deeper governance problem.
• The key risk is not just payment abuse, but delegated access that extends into cancellations, refunds, shipment changes, and other post-purchase actions.
• Merchants need sequence-based detection, lifecycle visibility, and intent-aware controls to separate legitimate automation from compromised agent behaviour.

Key terms

• Agentic Fraud: Fraud executed by systems that can plan, adapt, and complete tasks with limited or no human intervention during the session. The control problem is not only account creation, but whether the system can continue to behave within approved bounds after access is granted.
• Delegated Access: Delegated access is permission granted to one identity to act on behalf of another user, service, or system. In NHI environments, this usually appears in OAuth-connected apps and automation tooling. It is powerful, but it must be tightly scoped and reviewed because it can persist long after the original business need ends.
• Behavioural Drift: Behavioural drift is the gradual change in what an identity does compared with what it was originally approved to do. For AI agents, drift can come from prompt changes, model updates, expanded integrations, or altered workflows, which makes access review alone an incomplete control.
• Bot-Takeover: A form of account takeover in which an attacker gains control of an automated agent or bot rather than a normal user session. In commerce, that can let the attacker place purchases, alter preferences or generate fraudulent activity while appearing to operate through a trusted assistant.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. Explore nhimg.org for resources that connect identity governance to the broader security disciplines your programme depends on.