Topic starter
25/06/2026 1:05 am
TL;DR: AI agents are rapidly reshaping retail and banking traffic, with the source article saying more than 60% of online shop visitors are now bots, generative AI traffic to U.S. retail and banking sites has surged 2000% in the past year, and fraud losses could rise sharply if controls remain human-centric, according to Transmit Security. Human-designed fraud models now fail because the actor type has changed, not because the attack has become more sophisticated.
Editorial analysis by NHI Mgmt Group, based on content published by Transmit Security: “Blinded by the Agent: How AI Agents Are Disrupting Fraud Detection”.
By the numbers:
- Over 60% of visitors to online shops and retailers are now bots, not humans.
- More than 50% of consumers are comfortable letting AI agents shop and browse on their behalf, a number growing daily.
- Generative AI sourced traffic to U.S. retail and banking sites has surged 2000% in the last 12 months.
Key questions
Q: What breaks when fraud controls are built only for human browsing sessions?
A: Fraud controls built only for human browsing sessions lose critical context when AI agents act on behalf of customers.
Q: Why do AI-powered bots make device-based fraud controls less reliable?
A: AI-powered bots can mimic human pacing, reuse browser characteristics, and adapt their behavior to the control being tested.
Q: How should security teams tell benign agent traffic from malicious automation?
A: Use a combination of provenance, behavioural patterns, and enforcement context.
Practitioner guidance
- Define approved-agent trust policy Specify which AI agents may act on customer behalf, which journeys they may enter, and what proof of delegation is required before they are treated as legitimate traffic.
- Rebuild fraud scoring around intent and context Add task scope, transaction risk, and delegated authority to scoring models so the decision is not driven by device or cursor patterns alone.
- Separate authorised automation from hostile automation Create policy controls that distinguish permitted agent sessions from unapproved bots before they reach checkout, login, or funds transfer steps.
Bottom line: Fraud prevention built for human sessions does not translate cleanly when AI agents are legitimate participants in customer journeys.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 10:16 am
Human-centric fraud detection is the wrong control model for delegated machine action. Fraud stacks were built to ask whether a person is authentic, attentive, and consistent across sessions. That assumption breaks when a software agent is legitimately acting on the user’s behalf, because the actor is no longer the customer’s body or browser. The implication is that fraud governance must move from human resemblance to authorisation and intent.
A few things that frame the scale:
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: What should fraud teams do before AI agents are allowed into customer journeys?
A: They should establish a trust model for agent-mediated sessions, including approval criteria, scope limits, and escalation paths for high-risk transactions. Without those controls, approved agent activity and adversarial automation will converge in the same journeys, making detection noisy and response slow.
👉 Read our full editorial: AI agent adoption is breaking human-centric fraud detection