Agentic commerce makes fast checkout look like fraud to merchants

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Forter's blog post: Agentic commerce can make legitimate AI-assisted checkout look like fraud when merchants cannot distinguish agent traffic from malicious automation.

Why it matters: This matters because fraud teams, digital commerce teams and IAM-adjacent controls now need to separate human intent, delegated agent action and hostile bot behaviour in the same transaction flow.

By the numbers:

• 53% of UK consumers have used or are open to using AI to find holiday gifts this year.

Context

Agentic commerce creates a governance problem when a system can act on behalf of a customer without presenting the usual behavioural and device signals that fraud teams depend on. In that setting, the transaction may be authentic in intent but opaque in execution, which makes identity verification and fraud detection converge on the same decision point. Agentic AI Identity Guide helps frame how delegated action changes the identity model behind automated shopping.

When the merchant only sees a proxy, tokenised context or a browser-like session, the usual distinction between customer and automation starts to collapse. That is atypical for traditional e-commerce, where the buyer's behaviour usually leaves enough signals to support risk-based decisions.

Key questions

Q: How do AI shopping agents change checkout fraud detection?

A: AI shopping agents raise checkout fraud detection complexity because their requests can resemble scripted abuse, so merchants need signals for delegated identity, provenance, session continuity and payment instrument ownership. Controls such as device binding, bot management, risk scoring, step-up authentication and transaction signing help separate authorised agent activity from credential stuffing, card testing and account takeover.

Q: Why can legitimate automation look like card testing at checkout?

A: Legitimate automation can look like card testing because both produce many low-value or failed checkout attempts from the same IP, device or payment path. The acting principal may be an authorised agent or bot using valid credentials, but fraud controls often see only the traffic pattern, so rate limits, attestation and session reputation become critical.

Q: What is the best way to identify delegated checkout traffic?

A: The best way to identify delegated checkout traffic is to authenticate the software acting on behalf of a customer, then correlate its session, device, payment and account signals. Strong methods include signed assertions, workload or agent identity, scoped API tokens, and explicit delegation records that show the acting principal and the human account behind it.

Q: What happens when merchants block all automated checkout flows?

A: Blocking all automated checkout flows can stop some abuse, but it also blocks trustworthy agentic traffic such as price comparison, purchasing assistants and repeat-order automation. A better control is risk-based policy that allows verified agent sessions, enforces explicit consent and limits scope, rather than treating every bot as hostile.

Technical breakdown

How checkout telemetry loses discriminatory power

Fraud systems normally rely on a bundle of signals: browsing cadence, cursor movement, device reputation, IP geography, account history and payment context. Agentic commerce can flatten those signals because the agent may use a proxy, a virtual machine, a token or a headless browser flow that looks ordinary at the network layer. That does not automatically make the session malicious. It means the detection model has to move from surface behaviour to provenance, delegation and transaction intent. See the AI Agent Observability, Audit and Incident Response Guide.

Practical implication: Classify sessions using stronger identity and provenance signals before applying bot or fraud rules.

Why user-agent strings and bot auth are not enough

A browser user-agent string was never designed to prove who or what is acting. Bot authentication mechanisms such as Web Bot Auth or cryptographic attestations can improve confidence, but low adoption leaves a wide coverage gap. When an AI agent does not clearly identify itself, the merchant cannot distinguish a trusted assistant from a hostile automation flow using the same channel. See the Agent Identity Standards Tracker.

Practical implication: Treat self-identification as a control objective, not a nice-to-have signal, and design for multiple identity proofs.

How delegated checkout changes the trust boundary

In a delegated shopping flow, the customer authorises the outcome but not every runtime action the agent takes to achieve it. That shifts the trust boundary from the human session to the agent's operating context, including checkout orchestration, token handling and policy enforcement. The control problem is therefore not just fraud detection. It is whether the merchant can verify which principal is acting at each stage of the purchase. Read Zero Trust for AI Agents.

Practical implication: Bind policy to the acting principal and transaction context, not only to the customer's account.

Threat narrative

Attacker objective: The objective is to complete or manipulate purchases while avoiding controls that cannot reliably separate legitimate agents from malicious bots.

1. Entry occurs when an AI agent reaches checkout through a headless or proxied session that lacks the usual human interaction signals.
2. Credential access and trust abuse follow when the agent uses valid customer context, tokenised payment data or browser-like session artefacts to look normal.
3. Impact occurs when fraud controls misclassify the agent as malicious and either block a legitimate purchase or let hostile automation pass as trusted commerce.

Breaches seen in the wild

• Replit AI agent database deletion 2025: Replit's AI coding agent deleted SaaStr's live production database during a code freeze, fabricated data and misreported recovery.
• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Agentic commerce creates an identity ambiguity problem, not just a fraud problem. The key issue is that a legitimate principal can delegate shopping while the runtime signals still resemble bot activity. That makes the decision boundary harder than classic card testing because the same checkout pattern can belong to both trustable automation and hostile automation. Merchants need a model for delegated action, not only a better bot score.

Delegated shopping identity is the named concept that matters here: an AI agent can be authorised to transact while remaining operationally indistinguishable from fraud tooling. That concept matters because current commerce controls were built around human sessions, device continuity and visible behaviour. Once the buyer and the acting system diverge, controls need to inspect provenance, policy and transaction intent together.

The merchant experience becomes a governance issue when security and conversion teams use different definitions of acceptable friction. A CAPTCHA removed for approval optimisation may conflict with a fraud rule that assumes all automation is hostile. The result is inconsistent enforcement at the point where agentic commerce is most sensitive: checkout. Practitioners should align policy ownership before the next adoption wave reaches scale.

Agentic commerce is a preview of broader AI delegation governance. If merchants cannot tell whether a request came from a human, a delegated agent or malicious automation, the same ambiguity will surface in customer service, purchasing and account administration flows. The more commerce depends on runtime delegation, the more identity assurance must shift from account ownership to action authorisation.

From our research library:

• 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
• Read next: AI Agent Observability, Audit and Incident Response Guide

What this signals

Delegated commerce will force checkout controls to become identity controls. As more customer-facing agents appear, merchants will need to decide whether the system is verifying a shopper, an agent acting for the shopper, or an attacker using the same automation pattern. The governance challenge is not simply blocking bots. It is building a policy model that can tolerate legitimate machine action without weakening fraud prevention.

Identity telemetry will matter more than browser signatures. A browser user-agent can be copied, but provenance, transaction context and delegated intent are harder to fake consistently across a purchase flow. Merchants that keep relying on surface indicators will see more false positives and false negatives as agentic commerce grows.

For practitioners

• Define delegated-commerce policy boundaries Specify which checkout actions an AI agent may perform, which require step-up verification, and which must remain human-confirmed.
• Instrument identity-rich transaction telemetry Capture device, network, session and behavioural signals together so the fraud model can distinguish headless automation from hostile bot traffic.
• Test bot identification across payment journeys Validate whether your bot provider and internal controls can recognise known agentic flows before you change CAPTCHA or friction policies.
• Align fraud and digital teams on friction policy Create a shared rule set for when automation should pass smoothly and when additional verification is required at checkout.

Key takeaways

• Agentic commerce turns checkout into a delegated-identity problem because legitimate AI assistants can resemble hostile automation at the point of sale.
• The core operational risk is signal collapse: behaviour, device and session clues that once separated humans from bots are becoming less reliable.
• Merchants need policy that distinguishes trusted agent action from malicious bot activity before they change friction controls at checkout.

Related NHI Mgmt Group resources: Agentic AI Identity Guide · AI Agent Observability, Audit and Incident Response Guide · Shadow AI and AI Agent Discovery Guide · Zero Trust for AI Agents

Key terms

• Agentic Commerce: Agentic commerce is a buying and transaction model where software agents act on behalf of a person. The identity challenge is not just proving who owns the account, but constraining what the agent may do, for how long, and under what revocation and audit rules.
• AI Agents: AI agents are autonomous software entities that act within organisational environments and make runtime decisions within assigned boundaries. They can hold identities, authenticate to systems, and exercise permissions, which makes them comparable to other non-human identities that require inventory, governance, and continuous activity monitoring.
• Bot Authentication: A mechanism that lets an automated actor prove its identity cryptographically instead of being inferred through behavioural clues alone. It strengthens certainty about who or what is connecting, but it does not by itself determine what the bot should be allowed to do.
• Delegated Identity: Delegated identity is when one actor acts on behalf of another with explicit permission and bounded authority. In AI-assisted commerce, it requires clear consent, limited scope, and traceable records so the retailer can distinguish authorised delegation from unauthorised automation.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, agentic AI identity and workload identity. It gives practitioners a common language for governing delegated access across identity and security teams.