TL;DR: Traditional bots follow fixed scripts, while AI agents adapt to context and outcomes, making malicious automation harder to spot and more expensive to block, according to Signifyd. The practical issue is no longer just scale, but whether fraud controls can separate legitimate automation from adaptive abuse without driving false declines.
At a glance
What this is: This analysis contrasts fixed-script bots with adaptive AI agents in ecommerce fraud and argues that the real control problem is distinguishing legitimate automation from malicious automation.
Why it matters: It matters because fraud controls built for repetitive bot signatures can overblock good customers while missing agentic abuse, forcing IAM, fraud and trust teams to rethink how they evaluate intent, behavior and authorization.
By the numbers:
- Signifyd data found that AI-driven card-testing incidents jumped 175% between Jan. and April 2026 compared with the same stretch in 2025.
- A 2026 LexisNexis study found that every dollar retailers lose directly to fraud actually costs U.S. retailers about $5.13 once chargebacks, operations costs and product losses are included.
Context
Ecommerce fraud controls were built around repetitive automation, where high-volume requests, fixed scripts and predictable fingerprints were enough to separate bots from people. AI agents break that assumption because they can reason through context, vary their behavior after each outcome and look less uniform even when their purpose is malicious.
That shift creates a governance problem as much as a detection problem. Fraud teams now have to distinguish legitimate shopping or service automation from adaptive abuse, while keeping false declines low enough that authorised customers, support workflows and AI-assisted commerce are not penalised.
The article frames this as a practical control gap in modern commerce, not a purely technical bot-management issue. The more relevant question is whether fraud and identity controls can evaluate intent, authorisation and transaction context together before a purchase or account action completes.
Key questions
Q: What breaks when ecommerce fraud controls are designed only for fixed bots?
A: Controls tuned to repetitive bot signatures start misclassifying legitimate automation and miss agents that adapt after each failed attempt. That creates two failures at once: good customers get declined, and malicious activity looks human enough to pass through. Teams need decisioning that evaluates account context, device history and transaction intent together.
Q: Why do AI shopping agents create a fraud risk beyond normal e-commerce bots?
A: AI shopping agents create more risk because they can infer intent, combine signals across channels, and act with delegated authority rather than waiting for each user click. That makes them vulnerable to spoofed sellers, fake reviews, and malicious prompts. The issue is not automation alone, but autonomous decision-making under imperfect trust.
Q: How can security teams tell whether automated ecommerce activity is legitimate?
A: Look for consistency across identity, account control, device reputation, payment history and behavior over the full journey. Legitimate automation usually aligns with the customer’s account history and transaction context, while fraud tends to show mismatches such as recent credential changes, unusual values or shifting device signals.
Q: When should fraud teams add step-up checks for AI-assisted transactions?
A: Add friction when the session shows signs that account control may have shifted, such as a new device, a recent password reset, a shipping change or an unusual order value. Those are not proof of fraud on their own, but they are strong triggers for verifying that the current actor is still the rightful account holder.
Technical breakdown
Why fixed bot signatures fail against AI agents
Traditional bot controls work because many automated attacks are repetitive: the same login cadence, device profile or transaction sequence appears over and over. AI agents are different because they can adapt to prior outcomes, change timing, vary amounts and alter device or browser signals after a decline. That means the signal is no longer simple volume or repetition. Fraud detection has to distinguish outcome-driven adaptation from normal customer efficiency, especially when legitimate agents may also behave quickly and with fewer page views than a human shopper.
Practical implication: Treat repetition as one signal, not the deciding signal, when tuning ecommerce fraud controls.
Connected signals matter more than isolated events
A single sign, such as a new device or a fast checkout, does not reliably indicate fraud when AI agents are involved. The stronger model is to correlate identity, account, device, payment and behavioral signals across the full journey from login to fulfilment and post-purchase activity. This is especially important where authorised automation shares the same channels as fraudulent automation. In practice, controls need to decide whether the account holder, the device and the transaction pattern fit together, rather than whether any one field looks unusual.
Practical implication: Base approval and step-up decisions on correlated signals across the customer journey, not one-off anomalies.
Authorization checks now need to verify account control
AI-assisted fraud often succeeds not because credentials are obviously fake, but because the attacker or agent can use valid access in an unauthorised way. Recent password resets, new devices, changed shipping details and unusual order values can all signal that account control has shifted. That is an identity problem as much as a fraud problem, because valid authentication does not prove current authorisation for the specific transaction. The control objective is to test whether the person or agent behind the session still has rightful control before the order or refund is finalised.
Practical implication: Add account-control checks to fraud decisions when behavior suggests the session owner may have changed.
Threat narrative
Attacker objective: The attacker wants to monetise automation while avoiding bot signatures and preserving enough legitimacy to keep successful transactions moving through the funnel.
- Entry occurs through automated interaction with ecommerce flows, including login, checkout or post-purchase paths that accept machine-speed activity.
- Credential or identity abuse follows when attackers use compromised accounts, synthetic profiles or adaptive agents to vary timing, device signals and transaction details after each outcome.
- Impact is fraudulent purchase completion, account takeover, card testing, promo abuse or false refund claims that bypass controls tuned for repetitive bots.
Breaches seen in the wild
- AI agent retail card theft campaign 2026: AI agents breached 27+ retailers for about $25 each, used cloud keys and a Secrets Manager dump, and stole 600,000+ payment cards.
- Spain's first AI agent data breach 2026: Spain's AEPD logged its first breach notification attributed to an attacker's AI agent, which altered personal data and accessed invoices.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Adaptive automation is now a governance problem, not just a detection problem. Ecommerce teams built controls around fixed scripts, but AI agents introduce outcome-based variation that can evade pattern matching while still operating at machine speed. That means fraud controls have to reason over authorization, intent and journey context, not just request volume. Practitioners should treat adaptive automation as a control-design issue, not a tuning exercise.
Identity signals now sit at the centre of fraud decisioning. The article shows why valid credentials, familiar devices and quick execution no longer prove legitimate intent. In practice, ecommerce security has to combine identity, device, payment and behavioral evidence before approving high-risk actions. The boundary between customer experience and account security is narrowing, so trust decisions need stronger policy logic.
Authorization is the missing control layer in many fraud stacks. The key failure is assuming that an authenticated session remains authorised for the transaction it starts. AI-assisted abuse can ride valid access into card testing, promo abuse or post-purchase fraud without tripping classic bot rules. The practitioner takeaway is to test account control continuously across the transaction, not only at login.
False-decline management is now part of fraud resilience. Controls that overreact to efficient automation can block legitimate shopping agents and real customers at the same time. That creates revenue leakage, customer churn and noisy review queues, which can make fraud teams more conservative than they should be. The better model is risk-based friction, with policy decisions calibrated to the value and trust profile of the session.
Machine identity thinking belongs in ecommerce fraud programmes. When software acts on behalf of a shopper, the programme must decide whether it is dealing with a human, a legitimate agent or a malicious agent. That is an identity governance question as much as a fraud question. Teams that fail to classify machine-driven activity explicitly will keep mis-tuning controls around the wrong trust model.
From our research library:
- 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.
- Systems with least-privileged AI access had a 17% incident rate vs 76% for over-privileged systems. Organisations failing to scope AI access properly are 4.5x more likely to experience a security incident, according to the 2026 Infrastructure Identity Survey.
- Read next: AI Agent Identity Security Buyer's Guide
What this signals
Adaptive fraud changes the control objective. Teams can no longer rely on bot signatures alone because AI agents are designed to vary after failure. The stronger programme outcome is to shift from blocking obvious automation to validating whether a session, account and transaction belong together before approval.
Machine identity now matters in ecommerce trust decisions. When software can shop, support or abuse on behalf of a user, fraud teams need an explicit way to classify authorised automation versus malicious automation. That classification should influence step-up policy, review thresholds and post-purchase controls.
False declines are part of the same risk equation. A control stack that is too aggressive will punish legitimate agents and real customers while still letting adaptive abuse through in other paths. The practical answer is calibrated friction, continuous measurement and tighter linkage between identity evidence and payment decisions.
For practitioners
- Filter obvious automation at the edge Use rate limiting, WAF rules, device fingerprinting and CDN-level bot management to stop high-volume scraping, credential stuffing and other obvious automated attacks before they reach checkout.
- Correlate identity and behavioral signals Evaluate identity, account, device, payment, behavioral and order signals together so that fast but legitimate automation is not treated the same as meaningful fraud risk.
- Verify account control before approval Check for recent password resets, new devices, changed shipping details and unusual order values when a session may have shifted from the rightful account owner.
- Extend controls across the full journey Connect fraud policy across account creation, login, checkout, fulfilment, chargebacks, returns and refunds so that decisions reflect the complete customer history.
- Measure false declines alongside fraud Track approval rate, chargeback rate, manual review rate and declined-order recovery so that controls do not quietly suppress legitimate automation and real customers.
Key takeaways
- AI agents are forcing ecommerce fraud programmes to move beyond simple bot detection and into broader authorization and intent assessment.
- Controls that rely on one signal, such as speed or a new device, are increasingly prone to both false declines and missed abuse.
- The most useful defences correlate identity, account, device, payment and behavior across the full transaction journey, not just at login.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and OWASP API Security Top 10 address the attack and risk surface, while NIST CSF 2.0 and NIST SP 800-63 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | AI agents can be misused to act with legitimate-looking access and transaction authority. |
| ASI09 — Human-Agent Trust Exploitation | The article centers on misuse of trust when humans or systems assume agent behavior is legitimate. | |
| Recommendation — Apply ASI03 controls to distinguish authorised agent activity from identity and privilege abuse in customer journeys. Use ASI09 to verify that trusted automation still matches the intended customer or business context before approval. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Fraud control here depends on validating whether a session still has authority for the transaction being attempted. |
| Recommendation — Enforce PR.AA-05 checks so transaction approval reflects current authorisation, not just initial authentication. | ||
| NIST SP 800-63 | SP 800-63B — Authentication | The article shows that authentication alone is not enough when automated actors can operate with valid credentials. |
| Recommendation — Use SP 800-63B to strengthen authentication flows, then layer authorization checks for high-risk ecommerce actions. | ||
| OWASP API Security Top 10 | API2 — Broken Authentication | Credential stuffing and account takeover remain part of the automated fraud threat described in the article. |
| Recommendation — Treat API2-style authentication weakness as a fraud risk and add controls for compromised account use. | ||
Key terms
- AI Agents: AI agents are autonomous software entities that act within organisational environments and make runtime decisions within assigned boundaries. They can hold identities, authenticate to systems, and exercise permissions, which makes them comparable to other non-human identities that require inventory, governance, and continuous activity monitoring.
- False decline: A false decline is a legitimate transaction that is rejected because the fraud controls interpret it as risky. It matters because the operational cost is not limited to one lost sale. It can also damage customer trust, reduce retention, and distort fraud programme metrics.
- Adaptive fraud detection: A fraud control approach that updates its decision logic as new abuse patterns appear. Instead of waiting for scheduled retraining or manual rule changes, the system incorporates fresh signals into its model behaviour so that detection can keep pace with changing attacker tradecraft.
- Account Control: The degree to which a session or actor demonstrably controls an account and is authorised to act on its behalf. In modern fraud and identity governance, account control is more important than credentials alone because valid access can still be used for unauthorised intent.
Deepen your knowledge
NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. The course is relevant for security and fraud practitioners who need to govern machine-driven access decisions with consistent policy.
Published by the NHIMG editorial team on August 14, 2026.
Updated on October 12, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org