Agentic commerce raises a new fraud and identity risk model

At a glance

What this is: Sift argues that agentic commerce moves e-commerce from direct user action to delegated AI action, creating a wider fraud and privacy risk model around autonomous shopping decisions.

Why it matters: Fraud, trust, and identity teams need to treat agent behaviour as a governed decision path, because the control problem shifts from user intent to agent authorisation, prompt integrity, and transaction oversight.

By the numbers:

• Agentic commerce is expected to be adopted by 33% of enterprises by 2028, according to Gartner research cited by Sift.

Context

Agentic commerce is commerce in which an AI system acts on a person's behalf, making decisions and completing transactions with less direct human prompting. The governance problem is that once a system can act across channels, the boundary between convenience and unauthorised action becomes much harder to see.

For fraud, trust and identity teams, the core issue is not whether AI can recommend products, but whether it can be trusted to interpret intent, preserve user consent, and resist manipulation. That makes agent identity, transaction authorisation, and guardrail design part of the commercial control plane, not just a product feature layer.

Key questions

Q: What breaks when an AI shopping agent can act without clear purchase limits?

A: Without clear purchase limits, an AI shopping agent can move from convenience to delegated financial risk. It may complete purchases the customer would not approve, accept manipulated offers, or reuse account and payment details in ways that are hard to unwind. The control failure is scope, not speed, so teams need explicit authority boundaries and step-up checks.

Q: Why do AI shopping agents create a fraud risk beyond normal e-commerce bots?

A: AI shopping agents create more risk because they can infer intent, combine signals across channels, and act with delegated authority rather than waiting for each user click. That makes them vulnerable to spoofed sellers, fake reviews, and malicious prompts. The issue is not automation alone, but autonomous decision-making under imperfect trust.

Q: How can security teams tell if an agent is being manipulated by hidden instructions?

A: Look for unusual tool-use chains, unexpected content traversal, repeated context switches, and actions that do not match the declared task. The signal is often behavioural rather than signature-based. Teams should compare agent actions against approved workflows and flag cases where the agent moves from review to disclosure without a clear business reason.

Q: What should governance teams do when software can act on a person's behalf?

A: They should treat the software as a delegated identity with defined authority, audit logs, and revocation pathways. That means documenting what it can access, what decisions it can make independently, and which actions require fresh consent. Without that structure, accountability becomes unclear after the transaction is already complete.

Technical breakdown

How agentic commerce changes transaction authority

Traditional e-commerce systems execute explicit user commands. Agentic commerce introduces a delegated decision layer, where the system can infer intent, compare options, and complete actions without a fresh prompt for every step. That changes the trust model from session-based interaction to ongoing authority. The important question is not whether the model can shop, but how tightly its permission boundary matches the user's real intent, data access, and spending tolerance.

Practical implication: Define agent authority as a scoped control rather than a broad convenience feature.

Why fraud controls struggle when agents operate across channels

Agentic systems can span web, apps, messaging, payment, and fulfilment environments. Each channel may carry different signals, but the attacker only needs one weak point, such as spoofed listings, manipulated reviews, or fraudulent prompts, to influence the agent's decision path. Once the agent becomes a cross-channel executor, fraud detection has to correlate context rather than inspect a single transaction in isolation.

Practical implication: Correlate identity, session, and transaction signals across every channel an agent can use.

How delegated AI actions create identity and privacy risk

When an AI agent can buy, share, or negotiate on a person's behalf, it becomes a decision intermediary that may touch personal data, payment credentials, and purchase histories. That creates a governance question similar to privileged delegation in IAM: who authorised the action, what data did the agent use, and how is misuse detected after the fact? Without that trail, oversight is weak even when the user still owns the account.

Practical implication: Treat delegated commerce actions as auditable identity events with explicit consent and revocation paths.

Threat narrative

Attacker objective: The attacker wants to manipulate delegated commerce behaviour into unauthorised purchases, data exposure, or payment diversion while hiding behind the agent's apparent legitimacy.

1. Entry occurs when attackers feed fake product listings, spoofed seller accounts, manipulated reviews, or misleading prompts into channels the agent trusts.
2. Credential_harvested and trust exploited when the agent accepts those inputs and uses the consumer's payment or profile data to continue the transaction path.
3. Impact follows when the agent authorises an unwanted purchase, exposes personal information, or routes value to a fraudulent seller before the user sees the problem.

Breaches seen in the wild

• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
• AI agent retail card theft campaign 2026: AI agents breached 27+ retailers for about $25 each, used cloud keys and a Secrets Manager dump, and stole 600,000+ payment cards.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Agentic commerce creates a delegated trust problem, not just a fraud problem. The risk is that systems increasingly act with consumer authority while operating across channels the consumer cannot continuously inspect. Fraud controls therefore have to govern the decision path, the data path, and the transaction path together. Practitioners should treat agent consent, scope, and revocation as first-class controls.

Identity governance now extends into commercial actions taken by software on behalf of people. When an AI system can buy, share, or negotiate, it functions as a delegated actor with access to personal and payment data. That makes authorisation, auditability, and consent traceability more important than whether the interface feels seamless. Practitioners should design for explicit delegation, not assumed intent.

Cross-channel fraud detection will need to recognise agent behaviour as a pattern, not a single event. The article's risk model shows why isolated transaction monitoring will miss manipulation that starts in prompts, listings, or trust signals and ends in checkout. The new control surface is the full commerce journey, including the agent's inputs and the quality of its guardrails. Practitioners should broaden fraud analytics to cover the pre-transaction signal chain.

Agentic commerce points to a broader shift toward autonomous decision-making under partial human oversight. That shift will force businesses to define where user choice ends and machine discretion begins. In identity terms, the market is moving toward delegated authority models that need lifecycle governance, not one-time approval. Practitioners should expect accountability questions to become as important as detection questions.

Agentic commerce exposes a verification trust gap: the system must decide whether a prompt, seller, review, or payment request is legitimate before the human ever sees the outcome. That gap is where fraud prevention, identity assurance, and AI guardrails now intersect. Practitioners should close it with tighter decision boundaries and better provenance for the signals agents consume.

From our research library:

• 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
• Read next: AI Agent Authorisation Guide

What this signals

Agentic commerce will force fraud teams to monitor the full pre-transaction signal chain. The attack surface is no longer just checkout, because prompts, reviews, seller identity, and fulfilment data can all steer the outcome before a human notices. That means behavioural analytics has to move earlier in the journey and treat the agent's inputs as part of the control surface.

Verification trust gap: commerce teams will need to decide which signals a delegated agent is allowed to trust, because the system can now be manipulated before the user sees the final action. The control challenge is closer to identity assurance than to traditional cart-abandonment fraud. Teams should build explicit consent, revocation, and transaction traceability into the agent lifecycle.

Agentic commerce sits at the intersection of fraud prevention and delegated identity governance. Once a system can spend, share, or negotiate on behalf of a consumer, the question becomes whether its authority is bounded, logged, and reversible. That is the difference between useful automation and a new class of abuse.

For practitioners

• Define delegated agent authority Set explicit limits for what an AI commerce agent may buy, share, or cancel, and require separate approval for sensitive actions such as payment changes or personal-data disclosure.
• Instrument cross-channel fraud signals Correlate listings, reviews, seller identity, payment behaviour, and session context so an agent's decision path can be evaluated across every channel it touches.
• Separate convenience from consent Require clear consent capture and revocation for automated purchases, subscriptions, and renewals, with logs that show which prompt or signal triggered the action.
• Harden agent guardrails against manipulation Test for spoofed prompts, fake offers, and adversarial content that can steer the agent toward unwanted purchases or data disclosure before deployment.
• Review payment and identity escalation paths Map where an agent can reach stored cards, account profiles, or shipping details, then restrict those paths so a compromised signal cannot widen to full transaction authority.

Key takeaways

• Agentic commerce shifts the fraud problem from one transaction to an end-to-end decision chain that includes prompts, seller signals, and payment authority.
• The central governance issue is delegated action without enough user-visible control, auditability, or revocation.
• Teams that want to use agentic commerce safely need tighter consent boundaries, cross-channel fraud analytics, and explicit authority scoping.

Key terms

• Agentic Commerce: Agentic commerce is a buying and transaction model where software agents act on behalf of a person. The identity challenge is not just proving who owns the account, but constraining what the agent may do, for how long, and under what revocation and audit rules.
• Delegated Authority Model: A delegated authority model defines who is allowed to approve, review, or execute control-related decisions across the enterprise. It helps ensure requests reach the correct responsible party, especially when control owners, managers, and process owners sit in different teams, regions, or systems.
• Activation Trust Gap: The activation trust gap is the difference between trusting data because it is protected and governing it because it is being reused. It appears when organisations move data from backup or archival systems into AI pipelines without reapplying access, sensitivity, and consumer controls.
• Cross-Channel Scam Correlation: The practice of linking suspicious activity across messaging, social, telco, call, and payment systems to reveal one coordinated fraud campaign. This matters because each channel may look benign in isolation while the combined sequence shows active manipulation.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, agentic AI identity, and machine identity security. It helps practitioners connect delegated authority controls to broader identity and security programmes.