Agentic commerce is reshaping trust and fraud signals in ecommerce

At a glance

What this is: Signifyd argues that agentic commerce is changing how consumers shop online and that the most visible merchant signals now include shorter sessions, thinner device identifiers and more AI-chat referrals.

Why it matters: Merchants and identity teams need to understand where legitimate AI-assisted shopping ends and suspicious automation begins, because fraud controls tuned to human browsing can start blocking real customers.

By the numbers:

• 38% of U.S. consumers are already leveraging AI for help with their online shopping tasks, according to Adobe.
• 86% of ecommerce shoppers say saving money is a motivator to use agentic AI agents, according to a study by Wildfire Systems cited by Signifyd.
• 50% of all Cyber Week orders in 2025 included a discount code, Signifyd says in its State of Global Commerce 2026 report.
• 20% of customers surveyed by Wildfire Systems said they feel very comfortable letting AI agents find grocery or household basics, add them to cart, confirm the order price and initiate check out for them, according to Signifyd.

Context

Agentic commerce is the use of AI agents to research, compare, shortlist, and increasingly execute shopping tasks on a consumer’s behalf. The governance gap is that merchants still infer intent from human browsing patterns, even as more shopping journeys begin upstream in an agent and arrive at the site already filtered, narrowed, and decision-ready.

That shift matters because fraud and trust models were built around visible human behaviour such as device continuity, page-by-page browsing, and session length. When an AI agent compresses the shopping journey into a few high-intent actions, the merchant has less behavioural evidence to rely on, and identity signals start to carry more weight than the old funnel metrics would suggest.

For identity and fraud practitioners, this is a boundary problem as much as a detection problem. The article’s pattern is typical of the broader market shift: merchants are being asked to tell apart legitimate delegated commerce, high-speed automation, and outright abuse using signals that were never designed for agent-mediated transactions.

Key questions

Q: How should merchants handle fast AI-led shopping sessions without blocking real customers?

A: Treat fast, narrow sessions as a normal pattern when they include consistent purchase context, but do not trust speed alone. Use a blended model that weighs referral source, product-page focus, checkout consistency, and post-click behaviour so delegated shopping is not misclassified as automation. The goal is to validate intent, not force every session to look human.

Q: Why do agentic shopping journeys break legacy fraud signals?

A: They break them because older models assume browsing depth, device continuity, and session entropy are strong proxies for legitimacy. Agent-led journeys compress research into upstream systems, so the merchant sees fewer pages, less device fidelity, and more efficient conversion. That makes the old signals less informative and increases false positives unless the model is retrained on delegated behaviour.

Q: What are the signs that agent-led commerce is showing up in merchant analytics?

A: Look for short sessions with unusually high conversion, fast paths to product pages, thinner device identifiers, cloud-region traffic, and more AI-chat mentions with flat click-through rates. Those patterns do not prove abuse by themselves, but they do show that a new kind of pre-qualified traffic is reaching the site and changing what normal looks like.

Q: Should fraud and identity teams use the same controls for human and agent-led transactions?

A: No. Human and agent-led transactions share the same commercial goal, but they present different evidence about identity, intent, and device continuity. Teams should keep a single governance model for trust decisions while using different signals and thresholds for each journey type. That prevents both false declines and blind acceptance of automated abuse.

Technical breakdown

Why agent-led sessions look different from human shopping sessions

An agent-led session is often shorter, more targeted, and less visibly exploratory than a human shopping session because the comparison work happens before the browser reaches the merchant. The agent can search, rank, summarize, and prefilter options in its own environment, then hand the shopper a narrow decision set or go directly to a product page. That removes the browsing patterns merchants have used as soft trust evidence. In practice, this means session length, click depth, and page diversity become weaker proxies for legitimacy when an agent is handling upstream discovery.

Practical implication: Merchant risk models need to treat fast, focused sessions as a normal agentic pattern instead of defaulting to bot suspicion.

Why device and referral signals weaken in agentic commerce

Device identifiers and referral paths lose reliability when the actor is an AI layer rather than a person on a stable endpoint. The article points to thinner device IDs, generic virtualized sessions, cloud-region origins, and AI-chat mentions as the kinds of traces that can replace familiar browser-based fingerprints. This is not just a telemetry issue; it is an identity issue, because the system can no longer assume that a human user, a device, and a shopping intent are tightly coupled. The merchant has to reason about delegated intent, not only about endpoint continuity.

Practical implication: Fraud and IAM teams should enrich trust decisions with delegated-intent signals rather than relying on device fidelity alone.

Why legacy fraud rules misread legitimate agentic activity

Legacy fraud rules were tuned to catch automation that behaves unlike humans, but agentic commerce often does the opposite: it behaves like a highly efficient shopper with minimal noise. That creates a false positive problem where genuine orders can resemble scripted bot activity, especially when checkout happens in seconds after a narrow product search. The security issue is not that all automation is bad, but that the model must distinguish intent-preserving automation from abuse. In ecommerce, that distinction now sits at the same level as payment risk and account trust.

Practical implication: Update fraud scoring to recognize agent-mediated purchase patterns so legitimate agent-led commerce is not blocked as synthetic traffic.

Threat narrative

Attacker objective: Exploit the ambiguity between legitimate agent-led commerce and abusive automation to bypass merchant trust checks or trigger false declines that degrade the shopping experience.

1. Entry begins when an AI agent is delegated the research, comparison, or checkout task and starts interacting with merchant properties on behalf of the shopper.
2. Credential_harvested or trust established through shopping context when the agent presents thin device data, generic sessions, or high-speed browsing that obscures whether the actor is legitimate or automated abuse.
3. Escalation occurs when the merchant’s fraud controls cannot reliably separate delegated intent from scripted automation, causing either false declines or missed abuse.
4. Impact is distorted commerce trust, with merchants either blocking real agent-led purchases or accepting malicious automation because legacy signals no longer cleanly map to intent.

Breaches seen in the wild

• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
• AI agent retail card theft campaign 2026: AI agents breached 27+ retailers for about $25 each, used cloud keys and a Secrets Manager dump, and stole 600,000+ payment cards.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Agentic commerce creates an intent attribution problem, not just a fraud problem. The merchant is no longer classifying a single user session, but a layered interaction where discovery may happen in one system and purchase in another. That breaks older assumptions in identity and fraud governance because the actor at the point of checkout may be a delegated agent carrying the shopper’s intent without carrying the shopper’s usual behavioural trail. Practitioners should treat delegated intent as a first-class governance object.

Thin device telemetry is now a trust signal gap. The article’s focus on shorter sessions, generic identifiers, and cloud-origin traffic shows why device reputation alone is losing explanatory power. This is a named control gap we can call the delegated commerce visibility gap: when the merchant can see action but cannot confidently see who or what is acting. Teams should redesign trust decisions around context, not just endpoint fingerprints.

Static fraud models will increasingly confuse efficiency with abuse. Agentic sessions can be faster, cleaner, and more conversion-oriented than human sessions, which means a risk engine trained only on old browsing entropy will overfit to the wrong baseline. In broader governance terms, this is a form of model drift in fraud operations, and it becomes more pronounced as merchants admit more AI-mediated traffic. The practitioner conclusion is simple: the scoring model must evolve with the shopping model.

Identity and fraud teams need shared ownership of delegated transactions. This topic sits at the intersection of IAM, fraud operations, and customer authentication because the key question is whether the merchant can establish authorized delegation without over-collecting or overblocking. The right control posture is to validate the transaction context at the moment of action, not to assume the browser session itself tells the whole story. That is where governance has to catch up.

From our research library:

• 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years, according to the 2026 Infrastructure Identity Survey.
• Read next: Agentic AI Security Guide

What this signals

Delegated commerce visibility gap: merchants now have to decide whether a transaction is human-led, agent-led, or abusive automation before the old browsing trail ever existed. That pushes fraud governance toward intent-aware scoring, richer referral context, and stricter separation between discovery signals and checkout signals.

For identity programmes, the practical issue is not whether AI agents will shop, but how merchants establish trusted delegation without turning every efficient session into a risk exception. The control objective shifts from reading behaviour after the fact to validating context at the point of action.

For practitioners

• Instrument agentic-session signals Add detection for short sessions, rapid PDP traversal, AI-chat referrals, and thin device identifiers so merchant analytics can distinguish delegated shopping from noise.
• Tune fraud models for delegated intent Recalibrate scorecards so fast checkout after upstream comparison is not automatically treated as bot behaviour when other trust signals remain consistent.
• Separate human and agent journeys in telemetry Track whether discovery, comparison, and checkout occur in the same session, then flag cases where the purchase arrives pre-qualified through an external agent.
• Review false-decline cases tied to efficient shopping Look for orders blocked because they lacked browsing depth, mobile fingerprints, or visual engagement even though the purchaser intent was legitimate.

Key takeaways

• Agentic commerce changes the evidentiary model for fraud because the shopper’s intent may be established upstream of the merchant session.
• Shorter sessions, thinner device data, and AI-chat referrals are becoming normal signals of delegated shopping, not just signs of automation abuse.
• Merchants need intent-aware controls that separate legitimate agent-led transactions from abuse without punishing efficient customers.

Key terms

• Agentic Commerce: Agentic commerce is a buying and transaction model where software agents act on behalf of a person. The identity challenge is not just proving who owns the account, but constraining what the agent may do, for how long, and under what revocation and audit rules.
• Delegated Intent: Delegated intent is the machine-verifiable statement of what a human authorised an agent to do, for which purpose, and within which scope. It becomes a governance boundary when linked to the principal, the resource, the trust level, and the policy version active at the time of execution.
• Fraud Signal Drift: Fraud signal drift is the gradual loss of reliability in detection indicators as user behaviour, channels, or automation patterns change. In agentic commerce, device fingerprints, session depth, and browsing entropy can drift out of usefulness because AI-mediated journeys no longer resemble traditional human shopping.
• Context-aware scoring: Context-aware scoring is a risk model that combines identity event data with surrounding signals such as device state, factor strength, lifecycle status, and schedule information. It improves alert quality by ranking events according to operational reality rather than isolated heuristics.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, agentic AI identity, machine identity security, IAM, and secrets management. It helps practitioners build the governance foundations needed for AI-mediated access and delegated action.