TL;DR: Agentic orders on Forter's network reached 5.3x their early-August 2026 level after first being detected on September 21, showing that merchant readiness now has to account for machine shoppers, tokenised payments and loyalty abuse. Identity, trust and transaction policy now have to move together because agents behave like customers but do not govern themselves like them.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on Forter's blog post: Agentic commerce is already affecting merchant traffic, and readiness now depends on structured data, controlled connectivity, trust signals, payment recognition and loyalty governance.
Why it matters: IAM, fraud and digital commerce teams need to treat AI shopping agents as a distinct identity-and-transaction class because their access path, authentication and abuse patterns differ from human checkout flows.
Context
Agentic commerce is the point where software negotiates discovery, selection and payment on behalf of a buyer. That changes the control problem from page design alone to identity, transaction trust and policy enforcement across the full purchase path.
Merchant sites were built for human navigation, but AI shopping agents expose a governance gap between what the site publishes, what the bot can interpret and what the payment stack can accept. In practice, the readiness question is whether a merchant can recognise agent traffic without confusing it with fraud or blocking legitimate demand.
This is an emerging commerce pattern rather than a mature operating model, so current starting positions are uneven and often incomplete.
Key questions
Q: Why do AI shopping agents change return fraud governance?
A: AI shopping agents can generate high volumes of coordinated return requests, refund claims, and account activity far faster than manual review can absorb. That shifts the problem from isolated abuse to scaled, distributed manipulation. Teams need identity-linked monitoring and behavioural analysis to keep pace.
Q: Why do guest checkout flows raise loyalty fraud risk?
A: Guest checkout raises loyalty fraud risk because the merchant has weaker identity assurance and fewer reuse signals, so attackers can open accounts, redeem points, or abuse welcome offers with stolen emails, disposable addresses, and scripted payment attempts. Stronger controls include device fingerprinting, velocity checks, email and phone verification, step-up authentication, and linking redemptions to a verified account.
Q: What is the difference between 3DS and decoupled authentication?
A: 3DS is an authentication flow that lets an issuer challenge a cardholder during an online card payment, usually to confirm the payer before authorisation completes. Decoupled authentication separates the challenge from the browser session, so the issuer can approve the payment through a different channel or later step while the checkout remains pending.
Q: What signals indicate agentic traffic needs extra review?
A: Agentic traffic needs extra review when it shows high request velocity, repetitive tool calls, unusual navigation paths, broad data retrieval, and access patterns that do not match a human session. Add step-up checks, per-agent allowlists, rate limits, and runtime policy enforcement when an AI agent uses tokens, APIs, or delegated permissions.
Technical breakdown
Structured data and crawler access determine whether agents can even find products
AI shopping agents depend on machine-readable content before they can compare products or complete a transaction. JSON-LD with schema.org vocabulary gives them a predictable layer to parse, while robots.txt and network-layer controls decide whether they can reach the content at all. llms.txt adds another control point by guiding agents to brand, documentation and product detail pages. The security issue is not just visibility. If discovery is inconsistent, merchants either block useful automation or admit it without a governed path. See the Shadow AI and AI Agent Discovery Guide.
Practical implication: Treat agent discoverability as a controlled access decision, not a pure SEO task.
Headless checkout shifts agentic risk from scraping to API governance
Headless checkout lets an agent submit order and payment data through machine-readable APIs instead of scraping the storefront. That is more efficient, but it also creates a deeper integration surface where authentication, authorisation, rate control and risk signals all matter. When a merchant exposes APIs for agentic purchase flow, the main question becomes whether those interfaces are inventory-managed, policy-bound and monitored like any other transaction path. The shift is from visible browsing risk to governed machine-to-system interaction. See the Multi-Agent and A2A Security Guide.
Practical implication: Inventory and protect the APIs that let agents place orders, because they become the real control surface.
Payment tokens and guest checkout create a new identity boundary
Agentic checkout introduces payment credentials that are not always tied to a logged-in human session. PSP-issued tokens, shared payment tokens and step-up methods such as 3DS change where trust is established and what proves authorisation. Merchant-initiated step-up flows and decoupled authentication can support higher-risk transactions, but only if the payment stack recognises the token type and can make a policy decision in time. The architectural change is that payment trust now sits partly outside the traditional customer session. See the Agentic Commerce Identity Guide.
Practical implication: Align token acceptance and step-up policy with the trust level of the transaction, not just the channel.
NHI Mgmt Group analysis
Agentic commerce creates an identity boundary inside checkout, not just a new channel. Merchants are now deciding whether a purchase is being made by a person, a delegated agent or a fraudster using the same surfaces. That means trust decisions move from storefront heuristics into identity, token and transaction policy. The practical conclusion is that checkout governance has to classify the actor before it can classify the order.
Structured content and transport controls now shape fraud exposure. Search visibility, crawler permissioning and machine-readable product data determine which agents can discover inventory, while APIs determine how they transact. That makes product publishing and transaction governance part of the same control plane, especially where the merchant wants to admit legitimate agents without widening abuse paths. Merchants should treat discoverability as a governed exposure, not a default.
Guest checkout is becoming a loyalty control issue, not only a conversion issue. When agents check out without a durable account relationship, the merchant loses account context but still inherits fraud and dispute risk. If loyalty balances and gift cards can function as payment instruments, they need controls closer to IAM and fraud operations than to marketing administration. The conclusion is that loyalty policy now belongs in the security conversation.
Agentic payment support will separate merchants that can govern transactions from those that only accept them. New token types, 3DS flows and step-up methods make the payment stack a policy engine, not a passive endpoint. Merchants that cannot recognise and authorise agentic tokens will push legitimate traffic away, while merchants that can may still need tighter fraud thresholds and account-link controls. The operational takeaway is that acceptance without governance simply shifts the risk downstream.
What this signals
Agentic checkout governance will move from experimentation into policy design as merchants separate legitimate shopping agents from automation that merely looks legitimate. The control question is no longer whether agents can buy, but which identity, token and transaction conditions make a purchase admissible.
Commerce teams need a trust boundary between discovery and payment. If product data is easy for agents to interpret but the payment stack cannot recognise the resulting token and authentication pattern, merchants will either block demand or invite unsafe fallback paths. The durable model is governed machine-to-system interaction across the full order lifecycle.
For practitioners
- Define an agent acceptance policy Decide which AI shopping agents you will admit, challenge or block based on traffic source, transaction type and risk tolerance. Read Zero Trust for AI Agents.
- Harden product discovery controls Audit robots.txt, network-level bot filtering and llms.txt so machine-readable discovery is intentional rather than accidental.
- Treat checkout APIs as governed assets Inventory the APIs that support agentic purchase flow, then apply authentication, authorisation and monitoring to each one.
- Rework payment step-up rules Map 3DS, merchant-initiated step-up and decoupled authentication to the risk level of agentic transactions instead of using a single checkout policy.
- Move loyalty controls under fraud oversight Review guest checkout, points redemption and gift-card usage for ATO and loyalty abuse, especially where accounts are optional.
Key takeaways
- Agentic commerce is collapsing the distance between browsing, authentication and payment, which turns checkout into an identity governance problem as much as a conversion problem.
- The article's 5.3x order increase shows that agent traffic is already material, so merchants need controls for discovery, token handling and loyalty abuse now, not later.
- Merchants that classify agents, govern their APIs and align step-up authentication to risk will be better placed to accept automation without losing transaction control.
Related NHI Mgmt Group resources: Shadow AI and AI Agent Discovery Guide · Multi-Agent and A2A Security Guide · Agentic Commerce Identity Guide · AI Agent Observability, Audit and Incident Response Guide
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and OWASP API Security Top 10 address the attack and risk surface, while NIST SP 800-63 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | Agentic checkout hinges on delegated action, token use and actor trust, which maps to identity and privilege abuse. |
| ASI09 — Human-Agent Trust Exploitation | The article centers on merchants trusting agent traffic and payment behaviour they may not recognise. | |
| Recommendation — Apply ASI03 controls to distinguish delegated agent actions from human customer actions and constrain their authority. Test payment and loyalty flows for trust-exploitation paths that rely on human-like behaviour from agents. | ||
| OWASP API Security Top 10 | API2 — Broken Authentication | Headless checkout and payment APIs create authentication decisions that must be explicit and monitored. |
| Recommendation — Protect agentic purchase APIs with strong authentication and reject ambiguous or weak token states. | ||
| NIST SP 800-63 | SP 800-63C — Federation | Guest checkout, OAuth and delegated account connections depend on federated identity trust. |
| Recommendation — Use federation controls to govern delegated account access before agents can link or reuse customer identity. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Merchant decisions about which agents may browse, buy or redeem rewards are entitlement decisions. |
| Recommendation — Enforce least-privilege entitlements on agentic checkout, loyalty and reward actions. | ||
Key terms
- Agentic Commerce: Agentic commerce is a buying and transaction model where software agents act on behalf of a person. The identity challenge is not just proving who owns the account, but constraining what the agent may do, for how long, and under what revocation and audit rules.
- Headless Checkout: Headless checkout is a checkout architecture where the front end and commerce or payment back end are separated by APIs. It lets teams build custom purchase flows across web, mobile, or embedded interfaces, while payment and order handling stay in the server-side commerce layer.
- Merchant-Initiated 3RI: Merchant-initiated 3RI is a card-not-present transaction where the merchant starts a 3DS request without the cardholder present. It is used for stored credentials, recurring payments, or delayed charges, and the issuer may rely on prior customer authentication or other risk signals instead of a live challenge.
- 3DS: Three-Domain Secure, a card authentication framework used to step up trust during online transactions. In agentic commerce, it becomes part of the decision layer for non-human checkout, especially when the merchant needs to challenge a transaction without relying on the usual human session cues.
Deepen your knowledge
The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security and workload identity. It gives security and identity practitioners a practical foundation for governing delegated access, tokens and non-human actors across modern systems.
Published by the NHIMG editorial team on November 9, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org