AI agent adoption is breaking human-centric fraud detection

At a glance

What this is: This is a Transmit Security analysis of how AI agents are breaking fraud detection signals built around human behaviour, device identity, and single-session assumptions.

Why it matters: Fraud, IAM, and identity security teams need to rework detection and authorization logic when legitimate automation can look indistinguishable from malicious bot activity.

By the numbers:

• Over 60% of visitors to online shops and retailers are now bots, not humans.
• More than 50% of consumers are comfortable letting AI agents shop and browse on their behalf, a number growing daily.
• Generative AI sourced traffic to U.S. retail and banking sites has surged 2000% in the last 12 months.

Context

AI agents are software systems that act on behalf of users across websites and apps, which means they are now entering fraud funnels that were designed for humans. The primary identity governance problem is that fraud controls still infer personhood from device and behaviour signals even when the actor is an agent.

That mismatch is already visible in retail and banking traffic patterns. Once automation is legitimate, the control question shifts from whether a session is automated to whether the programme can distinguish authorised agent activity from adversarial automation without relying on human-centric assumptions.

Key questions

Q: What breaks when fraud controls are built only for human browsing sessions?

A: Fraud controls built only for human browsing sessions lose critical context when AI agents act on behalf of customers. Device fingerprints, cookies, and IP reputation may disappear or become unreliable, which makes legitimate delegated activity look suspicious and can also hide malicious automation. Teams need identity-aware delegation signals, not just browser-era telemetry.

Q: Why do AI-powered bots make device-based fraud controls less reliable?

A: AI-powered bots can mimic human pacing, reuse browser characteristics, and adapt their behavior to the control being tested. That means the same device fingerprint may be compatible with both legitimate use and malicious automation. Teams need layered risk decisions because device recognition alone cannot distinguish intent.

Q: How should security teams tell benign agent traffic from malicious automation?

A: Use a combination of provenance, behavioural patterns, and enforcement context. Benign agents may disclose themselves or act on behalf of a known user, while malicious automation tends to spoof environment signals and optimise for abuse patterns. The decision should be based on trust class and observed intent, not on automation alone.

Q: What should fraud teams do before AI agents are allowed into customer journeys?

A: They should establish a trust model for agent-mediated sessions, including approval criteria, scope limits, and escalation paths for high-risk transactions. Without those controls, approved agent activity and adversarial automation will converge in the same journeys, making detection noisy and response slow.

Technical breakdown

Why device fingerprinting fails when agents run in the cloud

Device fingerprinting assumes a stable relationship between a person, a browser, and a device. AI agents often execute from cloud infrastructure, so the user, the action, and the hardware are decoupled. That means the same agent may appear from transient infrastructure that looks unlike a customer’s normal device profile. In fraud terms, the signal does not disappear, but it stops meaning what the model thinks it means. Identity proofing and risk scoring built around consumer endpoints lose fidelity when the actor is software rather than a person.

Practical implication: move high-risk decisions away from device-only trust signals and require agent-aware authorization logic.

How behavioural biometrics become ambiguous in agent-driven sessions

Behavioural biometrics work by comparing human patterns such as hesitation, scroll rhythm, keystroke variance, and cursor movement. AI agents do not behave like humans, but legitimate agent activity can still resemble automation used by attackers. That creates a dangerous overlap: a trustworthy agent may look suspicious, while a malicious actor may borrow the same interaction style. The result is not just false positives. It is a category error in which the fraud stack treats machine behaviour as a proxy for malicious intent, even when the user has explicitly delegated the task.

Practical implication: treat behavioural biometrics as one input among several, not as a decisive indicator of fraud in delegated sessions.

What changes when bot detection must separate good automation from bad automation

Bot detection was originally designed to block non-human traffic at the edge. AI agents invert that model because some bots are now legitimate users acting with permission. The real challenge becomes intent discrimination, not simple automation detection. Fraud teams need to evaluate whether the session is authorised, whether the task aligns with expected customer behaviour, and whether the agent is operating within a bounded scope. Without those distinctions, the organisation either blocks legitimate commerce or lets hostile automation blend into approved traffic.

Practical implication: define policy for approved agent traffic before exposing core journeys to AI-mediated browsing or purchasing.

Threat narrative

Attacker objective: The attacker wants to commit fraud while blending into approved AI-mediated traffic and avoiding detection.

1. Entry occurs when attackers use legitimate AI agents or agent-like automation to enter customer journeys through retail and banking web applications.
2. Escalation follows when the agent inherits enough trust from normal browsing patterns to bypass device, behaviour, and bot-based checks.
3. Impact is fraud execution at scale, because malicious automation can hide inside traffic that looks legitimate to legacy controls.

Breaches seen in the wild

• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
• AI agent retail card theft campaign 2026: AI agents breached 27+ retailers for about $25 each, used cloud keys and a Secrets Manager dump, and stole 600,000+ payment cards.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Human-centric fraud detection is the wrong control model for delegated machine action. Fraud stacks were built to ask whether a person is authentic, attentive, and consistent across sessions. That assumption breaks when a software agent is legitimately acting on the user’s behalf, because the actor is no longer the customer’s body or browser. The implication is that fraud governance must move from human resemblance to authorisation and intent.

Intent discrimination is now the central fraud question. The important distinction is no longer human versus bot, but authorised automation versus hostile automation. That requires policy boundaries for agent use, task scope, and trust delegation, because the same interaction pattern can be either approved commerce or fraud. Practitioners should treat agent permissioning as part of fraud control, not as a separate UX concern.

Device identity no longer anchors trust when the actor is software. Device fingerprinting assumed the endpoint revealed something stable about the user behind it. Cloud-run agents sever that relationship, so the signal degrades from identity evidence to weak telemetry. The practical conclusion is that session risk must be evaluated using delegated authority, transaction context, and behavioural consistency together.

Behavoural biometrics cannot carry the burden of delegated identity on their own. When legitimate agents do not hesitate, misclick, or type like humans, the model loses its baseline. That creates a governance gap, not just a tuning problem, because the control assumes human variability is the normal state. Fraud teams need controls that understand non-human but authorised interaction patterns.

AI agent adoption is creating an identity blast radius across fraud, access, and customer trust. Once agents are trusted to act on behalf of users, the same delegation decision affects how sessions are authenticated, how fraud is scored, and how disputes are adjudicated. That makes agent governance a cross-functional identity problem, not a fraud-team-only issue. Practitioners should align fraud policy with broader AI agent authorisation rules.

From our research library:

• 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
• Read next: AI Agent Identity Security Buyer's Guide

What this signals

AI agent trust has to be governed as delegated access, not just monitored as traffic. Fraud controls that only watch interaction patterns will keep missing the governance decision that matters most: who authorised the agent, for what scope, and under what conditions. That is an identity problem first, a detection problem second.

Identity blast radius is now a fraud concern. Once an AI agent is permitted to browse, buy, or transfer on behalf of a user, the consequences of a bad delegation decision spill across account security, payment risk, and dispute handling. Teams should treat agent approval as a control point with downstream business impact, not as a convenience feature.

For practitioners

• Define approved-agent trust policy Specify which AI agents may act on customer behalf, which journeys they may enter, and what proof of delegation is required before they are treated as legitimate traffic.
• Rebuild fraud scoring around intent and context Add task scope, transaction risk, and delegated authority to scoring models so the decision is not driven by device or cursor patterns alone.
• Separate authorised automation from hostile automation Create policy controls that distinguish permitted agent sessions from unapproved bots before they reach checkout, login, or funds transfer steps.
• Tune behavioural signals for delegated sessions Review which behavioural biometrics still add value when the user is an agent rather than a person, and downgrade signals that collapse under automation.

Key takeaways

• Fraud prevention built for human sessions does not translate cleanly when AI agents are legitimate participants in customer journeys.
• The operational weak point is not automation itself but the inability to distinguish approved agent activity from hostile automation.
• Teams that want to support AI-mediated commerce need delegation policy, scope limits, and richer trust signals before relying on legacy fraud controls.

Key terms

• AI Agents: AI agents are autonomous software entities that act within organisational environments and make runtime decisions within assigned boundaries. They can hold identities, authenticate to systems, and exercise permissions, which makes them comparable to other non-human identities that require inventory, governance, and continuous activity monitoring.
• Delegation authority: Delegation authority is the right for one identity to act on behalf of another within a defined scope. For agents, it must be explicit, time-bound, and auditable because the system may initiate actions independently once granted access.
• Behavioral Biometrics: Behavioral biometrics uses patterns such as typing rhythm, swipe style, device handling, and session timing to infer whether the same user is still present. In practice, it supports continuous verification, but it also demands careful tuning because legitimate behavior can change with context.
• Intent Discrimination: Intent discrimination is the practice of deciding whether an interaction is authorised, expected, and aligned to a permitted task. For AI agents, it matters more than simple bot detection because the same machine-driven pattern can represent either legitimate delegated action or adversarial automation.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.