Agentic commerce is changing checkout, risk and merchant trust

At a glance

What this is: Signifyd argues that agentic commerce moves product discovery and some checkout steps into AI assistants, which changes how merchants evaluate intent, fraud and customer trust.

Why it matters: IAM and fraud teams need to treat agent-led purchases as a distinct trust problem because order approval, delegation and identity evidence no longer map cleanly to human browsing signals.

By the numbers:

• 47% of consumers are interested in using AI agents for commerce.

Context

Agentic commerce is a shopping model where an AI assistant can search, compare and sometimes check out on a shopper’s behalf. The governance gap is that merchants built fraud and customer-experience controls around human-led sessions, so the evidence used to prove intent is now shifting into software-mediated delegation.

This matters for identity security because the trust question is no longer only whether the buyer account is valid. Merchants also need to know whether an agent was authorized, whether its actions stayed within the shopper’s guardrails, and whether the resulting order should be treated as human-approved or machine-initiated.

Key questions

Q: What breaks when merchant controls assume every checkout session is human-led?

A: Controls built for manual shopping lose accuracy when an AI assistant can browse, compare and initiate checkout on behalf of a customer. Fraud models may overreact to unusual machine-like behaviour, while malicious automation can blend in if teams only look for classic bot indicators. The fix is to govern delegation explicitly, not to treat all non-human behaviour as suspicious.

Q: Why does delegated shopping create more fraud risk even when the customer is legitimate?

A: Delegated shopping adds an approval layer between intent and purchase, which creates room for takeover, impersonation and disputes over what was actually authorised. That risk is highest when agent credentials, session context or checkout handoffs are weakly controlled. Merchants need evidence that the agent acted within scope and that the shopper approved the final order.

Q: What are the signs that agent-led commerce is failing in practice?

A: Common signs include higher false declines, more support tickets about unfamiliar charges, customers disputing items they do not recognise and agents dropping out when product or shipping data is inconsistent. If those patterns appear together, the issue is usually not just fraud volume. It is a mismatch between how the merchant governs trust and how the shopping flow now executes.

Q: How should merchants handle fraud risk when shoppers use AI to assist purchases?

A: Merchants should treat AI-assisted shopping as a trust classification problem, not a binary fraud flag. The right approach is to combine behavioural, account, device, and payment signals so fast, AI-shaped journeys do not automatically inherit full trust. Step-up verification should focus on high-risk moments such as account recovery, shipping changes, and disputed claims.

Technical breakdown

How agent-led shopping changes the trust model

Traditional ecommerce assumes the same person who browses also clicks, pays and disputes the order if needed. Agentic commerce breaks that chain by inserting a software actor that searches, filters, shortlists and sometimes hands off to checkout. That creates a delegation problem: the merchant must decide whether to trust the shopper, the agent, or the interaction between them. In identity terms, the purchase is no longer just an authenticated session. It becomes an authorization event with a delegated actor, limited scope and an approval boundary that may sit inside the assistant, not the storefront.

Practical implication: Treat agent authorization as part of checkout design, not just as a fraud signal.

Why fraud signals become noisier with AI agents

Most fraud models rely on browsing behaviour, device reputation, velocity and other patterns that were tuned for human shopping. Agentic journeys can look abnormal without being malicious, because an agent may compare quickly, skip pages or complete a purchase in a compressed sequence. At the same time, bad actors can mimic agent-like behaviour to evade controls. That creates a dual failure mode: false positives on legitimate agent-led orders and false negatives when malicious automation blends in. The merchant’s task is to separate legitimate delegation from impersonation, not simply to block automation.

Practical implication: Update fraud models to recognise delegated automation rather than assuming unusual equals risky.

Where the purchase path gets brittle

Agentic commerce compresses the funnel into a few high-value decisions, which means small data quality gaps matter more. If product titles, variants, shipping rules or return conditions are inconsistent, the agent may choose a competitor, skip the item or fail the checkout sequence. This is not just a catalog problem. It is a trust and execution problem because the assistant depends on machine-readable clarity to preserve the shopper’s intent. The sharper the delegation, the more merchant-side ambiguity turns into abandonment.

Practical implication: Align catalog, shipping and returns data so agents can execute the shopper’s intent without guesswork.

Threat narrative

Attacker objective: The attacker wants to use delegated shopping flows to place unauthorized orders or disguise fraud as legitimate agent activity.

1. Entry occurs when a shopper authorizes an AI assistant to act on their behalf and that delegated session becomes the path into checkout.
2. Credential or session abuse emerges if a malicious actor takes over the agent, its credentials or its approval flow, allowing purchases to be made as if they were authorized.
3. Impact appears as rapid orders, disputed purchases, false declines or support confusion when the merchant cannot clearly prove who approved the transaction.

Breaches seen in the wild

• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
• Meta AI Instagram Account Takeover: 20,225 Instagram accounts hijacked via compromised Meta AI support chatbot with overprivileged access.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Agentic commerce turns shopping trust into a delegation problem: the merchant is no longer validating only a human buyer, but the chain of authorization that lets software act for that buyer. That changes fraud analysis, because intent now sits inside an agent workflow rather than in a visible human session. Merchants that keep treating all automation as suspicious will over-block, while those that ignore delegation will miss impersonation. The practitioner conclusion is to govern the approval boundary, not just the cart.

Order confidence becomes an identity question: when a purchase is made through an assistant, the downstream dispute often reflects uncertainty about who actually approved the transaction. That is especially relevant where the human later does not recognise the descriptor, the item mix, or the checkout path. Clear delegation evidence, session traceability and post-purchase confirmation are now part of transaction trust, not just customer service. The practitioner conclusion is to preserve a verifiable link between intent, agent action and order outcome.

Agent-level takeover is a new fraud pattern, not a rebrand of account takeover: a shopping assistant can become the compromised object even when the customer account remains intact. That distinction matters because controls built only for user login security will miss delegated sessions and agent credentials. The governance concept here is delegated purchase trust gap, meaning the space between customer intent and machine execution where fraud can hide. The practitioner conclusion is to monitor that gap explicitly.

Product data quality is now a security control: inconsistencies in size, shipping or bundle metadata are not just merchandising defects when agents are making decisions. They become failure points that reduce conversion and increase false negatives in risk systems. For identity teams, this is a reminder that trust evidence is only as strong as the data the agent can parse. The practitioner conclusion is to treat catalogue clarity as part of the control environment.

AI agent identity belongs in fraud and access governance: the article’s core signal is that merchants need to distinguish legitimate agent-led behaviour from malicious automation. That intersects directly with delegated access, authorisation scope and trust policy, even though the broader problem sits in ecommerce operations. The practitioner conclusion is to bring identity governance into commerce risk decisions before agent-led purchasing becomes routine.

From our research library:

• Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
• Read next: AI Agent Identity Security Buyer's Guide

What this signals

Delegated purchase trust gap: merchants are moving from a world where session behaviour implied human intent to one where intent is split across shopper, assistant and checkout flow. That means fraud teams need evidence about authorisation scope, not just device reputation or velocity. The next control boundary is the approval event, because that is where legitimate automation and impersonation diverge.

The operational consequence is that product data, checkout design and risk policy now overlap. If catalogues, shipping rules and return terms are not machine-readable, an agent will fail fast and merchants will lose the sale before any fraud decision is even made. Conversely, if risk systems remain tuned only to manual browsing patterns, they will continue to confuse delegated activity with attack traffic.

For practitioners

• Define delegation rules for agent-led checkout Specify which shopping actions an AI assistant may perform, which steps require human confirmation and where spending or category limits apply.
• Update fraud models for delegated behaviour Tune velocity, session and device checks so legitimate agent-led purchases are not rejected simply because they do not resemble manual browsing.
• Create agent identity evidence for orders Log which assistant acted, what constraints were applied and how the shopper approved the transaction so disputes can be investigated later.
• Clean up catalog and policy data Make product variants, shipping eligibility, returns terms and availability information machine-readable and consistent across channels.
• Monitor for agent impersonation and takeover Watch for unusual delegation patterns, abnormal transaction bursts and reuse of the same agent context across unrelated purchases.

Key takeaways

• Agentic commerce changes the trust model by inserting a software actor between shopper intent and final checkout.
• The most important risk is not just bot activity but ambiguity over whether an order was genuinely authorised by the customer.
• Merchants need clearer product data, stronger delegation evidence and fraud models that can distinguish approved agent behaviour from impersonation.

Key terms

• Agentic Commerce: Agentic commerce is a buying and transaction model where software agents act on behalf of a person. The identity challenge is not just proving who owns the account, but constraining what the agent may do, for how long, and under what revocation and audit rules.
• Delegated Purchase: Delegated purchase is a transaction in which a non-human actor executes shopping actions with permission from the customer. The security question is not whether the account exists, but whether the delegated action stayed within the authorised intent and approval boundary.
• Agent-Level Takeover: A compromise pattern where an attacker hijacks the delegated AI agent or its credentials instead of the human account behind it. This can let the attacker place orders, alter choices or abuse trust flows while appearing to operate under legitimate authorization.
• Order Confidence: Order confidence is the degree of assurance that a transaction was both authorised and accurately represented to the buyer. It depends on clear approval evidence, understandable product data and traceable checkout actions, which become harder to preserve as AI agents mediate the shopping flow.

Deepen your knowledge

Our NHI Foundation Level course covers NHI governance, machine identity security and identity lifecycle controls in the NHI Foundation Level course, the industry's only accredited NHI security programme. It helps practitioners connect delegated access risk to the controls that govern non-human actors and their credentials.