Notifications
Clear all
Topic starter
14/08/2026 6:34 pm
TL;DR: Traditional bots follow fixed scripts, while AI agents adapt to context and outcomes, making malicious automation harder to spot and more expensive to block, according to Signifyd. The practical issue is no longer just scale, but whether fraud controls can separate legitimate automation from adaptive abuse without driving false declines.
NHIMG editorial — based on content published by Signifyd: Bots vs AI Agents: 6 Tips to Stop Malicious Automation in 2026
By the numbers:
- Fraudsters now use AI tooling to run attacks that are 4.5 times more profitable, pushing North American fraud pressure up 33% in early 2026 versus 2025.
- A 2026 LexisNexis study found that every dollar retailers lose directly to fraud actually costs U.S. retailers about $5.13 once chargebacks, operations costs and product losses are factored in.
Questions worth separating out
Q: How should merchants distinguish AI agents from fraud bots in ecommerce traffic?
A: Merchants should combine behavioural analytics with device trust, transaction history and policy scope rather than relying on browsing depth alone.
Q: Why do AI agents make fraud controls less reliable?
A: AI agents can change timing, transaction amounts, device attributes, and other signals after each outcome, which defeats controls that depend on repetition.
Q: What breaks when fraud controls rely on a single signal?
A: Single-signal decisions are easy to bypass because one indicator can be benign in isolation.
Practitioner guidance
- Implement cross-signal fraud decisioning Correlate identity, device, payment, account history, and order behaviour before approving high-risk actions.
- Separate authorised automation from abusive automation Define which customer-facing AI agents or workflows are allowed to place orders, change details, or request refunds, and require stronger checks when activity departs from normal account history.
- Tune controls for adaptive patterns Look for low-and-slow probing, small changes after declines, and mixed transaction values that indicate the attacker is learning from each attempt rather than repeating the same script.
What's in the full article
Signifyd's full post covers the operational detail this post intentionally leaves for the source:
- The specific fraud patterns Signifyd maps to bots versus AI agents, including checkout abuse, card testing, and account takeover.
- Examples of how the vendor evaluates connected signals across identity, device, payment, and behaviour.
- Operational guidance on when to step up verification, review account-control changes, and preserve legitimate automation.
- The reported revenue impact of false declines and the supporting calculations used in the article.
👉 Read Signifyd's analysis of bots versus AI agents in ecommerce fraud →
Bots vs AI agents in ecommerce: are your fraud controls keeping up?
Explore further
14/08/2026 6:41 pm
Adaptive automation changes the fraud control problem from signature detection to trust evaluation. Traditional bot management is built to catch repetition, but AI-assisted fraud can change pace, device signals, and transaction shape after each outcome. That means the control question shifts from 'is this a bot' to 'is this session still acting within authorised intent.' Practitioners should treat behavioural variance as a governance issue, not just a tuning problem.
A question worth separating out:
Q: Who is accountable when fraud controls block legitimate customers in real time?
A: Accountability should sit with the team that owns the end-to-end decision path, not only the fraud model. If checkout, identity, and risk signals are not orchestrated into one control, then the business is responsible for the conversion loss as well as the fraud loss. Governance needs shared ownership across fraud, product, and security leaders.
👉 Read our full editorial: Bots and AI agents are reshaping ecommerce fraud controls
