Topic starter
25/06/2026 1:05 am
TL;DR: AI agents are now colliding with fraud controls that were designed around human browsing and single-session assumptions, according to Transmit Security. Fraud systems need delegation policy and richer trust signals before approved agent activity and hostile automation blur together.
Editorial analysis by NHI Mgmt Group, based on content published by Transmit Security: “Blinded by the Agent: How AI Agents Are Disrupting Fraud Detection”.
By the numbers:
- Over 60% of visitors to online shops and retailers are now bots, not humans.
- More than 50% of consumers are comfortable letting AI agents shop and browse on their behalf, a number growing daily.
- Generative AI sourced traffic to U.S. retail and banking sites has surged 2000% in the last 12 months.
Key questions
Q: Why do AI-powered bots make device-based fraud controls less reliable?
A: AI-powered bots can mimic human pacing, reuse browser characteristics, and adapt their behavior to the control being tested.
Q: How should security teams tell benign agent traffic from malicious automation?
A: Use a combination of provenance, behavioural patterns, and enforcement context.
Q: What breaks when fraud controls are built only for human browsing sessions?
A: Fraud controls built only for human browsing sessions lose critical context when AI agents act on behalf of customers.
Practitioner guidance
- Define approved-agent trust policy Specify which AI agents may act on customer behalf, which journeys they may enter, and what proof of delegation is required before they are treated as legitimate traffic.
- Rebuild fraud scoring around intent and context Add task scope, transaction risk, and delegated authority to scoring models so the decision is not driven by device or cursor patterns alone.
- Separate authorised automation from hostile automation Create policy controls that distinguish permitted agent sessions from unapproved bots before they reach checkout, login, or funds transfer steps.
Bottom line: Fraud prevention built for human sessions does not translate cleanly when AI agents are legitimate participants in customer journeys.
Glossary terms: AI Agents, Delegation authority, Behavioral Biometrics, Intent Discrimination
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
25/06/2026 10:16 am
Human-centric fraud detection is the wrong control model for delegated machine action. Fraud stacks were built to ask whether a person is authentic, attentive, and consistent across sessions. That assumption breaks when a software agent is legitimately acting on the user’s behalf, because the actor is no longer the customer’s body or browser. The implication is that fraud governance must move from human resemblance to authorisation and intent.
A few things that frame the scale:
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: What should fraud teams do before AI agents are allowed into customer journeys?
A: They should establish a trust model for agent-mediated sessions, including approval criteria, scope limits, and escalation paths for high-risk transactions. Without those controls, approved agent activity and adversarial automation will converge in the same journeys, making detection noisy and response slow.
👉 Read our full editorial: AI agent adoption is breaking human-centric fraud detection
This post was modified 1 day ago by NHI Mgmt Group