Topic starter
14/08/2026 6:34 pm
TL;DR: Traditional bots follow fixed scripts, while AI agents adapt to context and outcomes, making malicious automation harder to spot and more expensive to block, according to Signifyd. The practical issue is no longer just scale, but whether fraud controls can separate legitimate automation from adaptive abuse without driving false declines.
Editorial analysis by NHI Mgmt Group, based on content published by Signifyd: “Bots vs AI Agents: 6 Tips to Stop Malicious Automation in 2026”.
By the numbers:
- A 2026 LexisNexis study found that every dollar retailers lose directly to fraud actually costs U.S. retailers about $5.13 once chargebacks, operations costs and product losses are included.
Key questions
Q: What breaks when ecommerce fraud controls are designed only for fixed bots?
A: Controls tuned to repetitive bot signatures start misclassifying legitimate automation and miss agents that adapt after each failed attempt.
Q: Why do AI shopping agents create a fraud risk beyond normal e-commerce bots?
A: AI shopping agents create more risk because they can infer intent, combine signals across channels, and act with delegated authority rather than waiting for each user click.
Q: How can security teams tell whether automated ecommerce activity is legitimate?
A: Look for consistency across identity, account control, device reputation, payment history and behavior over the full journey.
Practitioner guidance
- Filter obvious automation at the edge Use rate limiting, WAF rules, device fingerprinting and CDN-level bot management to stop high-volume scraping, credential stuffing and other obvious automated attacks before they reach checkout.
- Correlate identity and behavioral signals Evaluate identity, account, device, payment, behavioral and order signals together so that fast but legitimate automation is not treated the same as meaningful fraud risk.
- Verify account control before approval Check for recent password resets, new devices, changed shipping details and unusual order values when a session may have shifted from the rightful account owner.
Bottom line: AI agents are forcing ecommerce fraud programmes to move beyond simple bot detection and into broader authorization and intent assessment.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
14/08/2026 6:41 pm
Adaptive automation is now a governance problem, not just a detection problem. Ecommerce teams built controls around fixed scripts, but AI agents introduce outcome-based variation that can evade pattern matching while still operating at machine speed. That means fraud controls have to reason over authorization, intent and journey context, not just request volume. Practitioners should treat adaptive automation as a control-design issue, not a tuning exercise.
A few things that frame the scale:
- 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.
- Systems with least-privileged AI access had a 17% incident rate vs 76% for over-privileged systems. Organisations failing to scope AI access properly are 4.5x more likely to experience a security incident, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: When should fraud teams add step-up checks for AI-assisted transactions?
A: Add friction when the session shows signs that account control may have shifted, such as a new device, a recent password reset, a shipping change or an unusual order value. Those are not proof of fraud on their own, but they are strong triggers for verifying that the current actor is still the rightful account holder.
👉 Read our full editorial: Bots and AI agents are reshaping ecommerce fraud controls