Agentic shopping raises ATO pressure and rewards ring detection

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Forter's report: Agentic commerce is increasing alongside coordinated fraud, with AI referral activity up 107%, agentic orders averaging $154, and 2.4 million attacks recorded in September.

Why it matters: Fraud, IAM, and digital identity teams need to separate legitimate AI-assisted buying from account takeover, credential abuse, and collusive customer fraud that can now coexist in the same account history.

By the numbers:

• Forter reports 107% growth in AI referral activity globally in September.
• Forter says agentic orders had a higher average order value of $154 versus $121 for human sessions.
• Forter recorded 2.4 million attacks in September, 87% of which were perpetuated by coordinated fraud rings.

Context

Agentic commerce changes the fraud surface because accounts can now carry both human and machine-shaped activity. That complicates trust decisions around login behaviour, purchase intent, and recovery flows, especially when the same account can be used for legitimate shopping and abusive coordination.

The pressure point is not simply automation. Fraudsters are combining social engineering, stolen credentials, and account history to make abuse look ordinary, which forces identity and fraud teams to treat account context as a governance problem rather than a static authentication problem.

Key questions

Q: Why does agentic commerce change fraud detection so much?

A: Because the decision-maker is no longer always a person interacting directly with the system. Software intermediaries can search, compare, and transact at runtime, which weakens traditional behavioural signals and shifts the focus to authorisation scope, delegation, and transaction intent.

Q: Why do coordinated fraud rings evade account-based controls?

A: Coordinated fraud rings evade account-based controls by spreading activity across many stolen, synthetic, or mule accounts, then varying devices, IP addresses, payment instruments, and behavioural signals. The weakness is usually over-reliance on single-account checks. Stronger controls use graph analysis, device intelligence, step-up verification, velocity limits, and linked-account review.

Q: How should merchants respond to account takeover after 3DS adoption?

A: Merchants should treat 3DS as one control in a broader account takeover defence, not as a substitute for account security. After adoption, they need login risk scoring, breached password checks, step-up authentication for profile changes, device binding, and monitoring for credential stuffing and account recovery abuse.

Q: Does customer collusion matter in ecommerce fraud prevention?

A: Yes. Customer collusion matters because legitimate account holders can be recruited, bribed, or tricked into using their own accounts, cards, or identities to hide fraud. That defeats controls focused only on stolen credentials, so merchants need behavioural monitoring, shared-device analysis, payout verification, and cross-account linkage detection.

Technical breakdown

How agentic shopping changes account risk

Agentic shopping sessions behave differently from standard user sessions because they can aggregate multiple items, subscriptions, or repeat purchases into fewer but larger transactions. That changes the signal profile that fraud systems see: volume can look lower while order value rises, and legitimate intent may be expressed through automated or semi-automated behaviour. In practice, this creates a harder classification problem for identity and fraud controls, especially when accounts have both human and AI-assisted activity patterns.

Practical implication: Classify agentic traffic separately from ordinary shopper traffic so fraud models do not overfit to legacy checkout patterns.

How coordinated fraud rings exploit account history

Coordinated fraud rings work by blending social engineering, credential theft, and account reputation. A legitimate purchase history, prior successful logins, or trusted payment behaviour can mask a later abuse event when the attacker uses stolen card details or coerces a customer to cooperate. The fraud signal is often not a single transaction but a pattern of repeat attempts, burst activity, shared infrastructure, and inconsistent location data across accounts. See the Payment Fraud Guide.

Practical implication: Weight account lineage, velocity, and shared infrastructure more heavily than isolated transaction success when scoring risk.

Why 3DS shifts abuse rather than eliminating it

Three-Domain Secure changes the economics of card fraud by making third-party card misuse harder, but it does not remove the incentive to attack accounts through takeover or collusion. When one fraud path closes, adversaries tend to shift toward the weakest adjacent control, often targeting account access, stored value, refunds, or loyalty balances instead. That is why payment authentication, account security, and behavioural fraud detection have to be analysed as one system, not separate lanes.

Practical implication: Reassess whether risk controls are displacing fraud into account takeover, refund abuse, or stored-value theft.

NHI Mgmt Group analysis

Agentic commerce creates a trust bifurcation: the same account now has to support both legitimate AI-assisted buying and adversarial activity. That forces fraud governance to move beyond static login rules and into behavioural context, because intent is no longer visible from the session alone. The control problem is classification, not just authentication, and practitioners need to separate automated customer convenience from abusive automation.

Coordinated fraud rings are becoming the dominant operating model: the scale of the attacks matters less than the fact that they are organised, repeatable, and adaptive. That is a governance failure when teams still review suspicious activity one event at a time. A ring-aware model treats shared IPs, burst booking, and failed payment retries as a linked pattern rather than isolated anomalies, which is the right lens for fraud operations.

Account history is now an attack surface: legitimate purchase history, stored balances, and prior trust signals can be repurposed as cover for abuse. That means identity assurance and fraud detection have to share the same evidentiary model, because an account can be both authentic and compromised in the same lifecycle. Practitioners should treat trusted history as a risk signal that can be stolen, not as proof of innocence.

Refund abuse and customer collusion are not edge cases: they are part of the same fraud economy as ATO and stolen-card activity. The important shift is conceptual: fraud prevention needs to account for the customer who knowingly participates in abuse, not only the outsider who breaks in. That makes account governance, payment verification, and dispute handling part of one control plane rather than disconnected functions.

From our research library:

• U.S. fraud losses are projected to reach $40 billion by 2027.

What this signals

Collusive commerce is the next fraud tier: the most difficult cases are no longer simple account theft but accounts that carry legitimate history and malicious intent at the same time. That means prevention has to move closer to decision time, where basket composition, payment path, and behavioural drift can still be evaluated before fulfilment.

Fraud operations should expect more mixed-intent accounts as agentic buying spreads. The practical shift is toward scoring transactions in context, because trust signals that once indicated safety can now be part of the attacker’s cover story.

For practitioners

• Separate agentic sessions from normal shopper traffic Tag AI-assisted shopping flows, compare their basket shapes and velocity to human baselines, and route them through fraud models tuned for bulk or subscription-style orders.
• Treat coordinated fraud as a ring problem Correlate shared IP ranges, rapid retries, account creation bursts, and failed payment patterns before deciding whether a cluster is a single offender or a coordinated ring.
• Review account history as a risk indicator Use prior purchase behaviour, stored value, and login continuity as inputs to scoring, but do not treat them as proof that the current session is legitimate.
• Rebalance 3DS routing strategy Avoid sending only the most suspicious traffic to 3DS. Mix traffic types where your issuer strategy supports it so the authentication step remains useful rather than predictable.

Key takeaways

• Agentic shopping expands the fraud surface because the same account can now carry both legitimate automation and abusive behaviour.
• The strongest evidence in the source is operational rather than theoretical: AI referral activity rose 107%, agentic orders averaged $154, and September saw 2.4 million attacks.
• Practitioners need fraud models that recognise clustered abuse, mixed-intent accounts, and payment-path shifts instead of relying on static account reputation.

Related NHI Mgmt Group resources: Bot vs AI Agent Traffic Management Guide · Payment Fraud Guide · Agent Governance and Risk Guide

Key terms

• Account Takeover: Account takeover is unauthorized use of a legitimate account after an attacker obtains valid access through stolen credentials, tokens, or trusted integrations. The key security problem is that the resulting activity often looks normal to logs and controls, which makes containment and attribution harder than in a forced-entry breach.
• Coordinated Fraud: Coordinated fraud is abuse that only becomes clear when multiple events are correlated across accounts, devices, payment methods or merchants. Each transaction may look harmless alone, but the shared pattern reveals organised activity that needs cross-case analysis and escalation.
• Credential Stuffing: Credential stuffing is an attack that uses stolen username and password pairs from previous breaches to try logging into other services. It works because many people reuse credentials, and because the login attempt uses valid information, it can look ordinary until the surrounding behavior gives it away.
• 3-Domain Secure: A card authentication protocol used to add issuer challenge or risk-based checks to ecommerce payments. It reduces some forms of card fraud, but it can also shift attackers toward account takeover, collusion, or other adjacent abuse paths when the control becomes predictable.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, agentic AI identity, and workload identity. It helps security practitioners connect identity controls to the operational realities of modern access and automation.