Topic starter
11/07/2026 8:35 pm
TL;DR: LLM-referred traffic can be materially riskier than conventional referral traffic in the ticketing and electronics examples, according to Riskified. Ecommerce controls will need to account for delegated purchase authority when human browsing signals are missing.
Editorial analysis by NHI Mgmt Group, based on content published by Riskified: “Agentic AI: A dilemma for ecommerce merchants”.
Key questions
Q: Why do AI shopping agents create a fraud risk beyond normal e-commerce bots?
A: AI shopping agents create more risk because they can infer intent, combine signals across channels, and act with delegated authority rather than waiting for each user click.
Q: How should merchants prepare for agent-driven checkout flows?
A: They should define where agents are allowed to act, what authority each agent has, and which purchases require additional verification.
Q: What breaks when shopping is delegated to AI agents?
A: The main failure is that many fraud controls assume a human browser session will leave enough behavioural evidence to judge intent.
Practitioner guidance
- Define delegated purchase boundaries Specify which AI agents may browse, recommend, or complete purchases, and tie each permission to a narrow scope, merchant segment, or spend limit.
- Revise fraud models for low-signal checkouts Retrain detection logic to weight transaction context, account history, token provenance, and fulfilment anomalies when behavioural signals are missing.
- Treat agent tokens as governed credentials Inventory any tokenised credentials, spending tokens, or delegated access paths used by shopping agents and apply lifecycle controls that match their risk.
Bottom line: Agentic shopping shifts fraud risk from visible human behaviour toward delegated machine action, which weakens the assumptions behind many current ecommerce controls.
Glossary terms: Agentic Commerce, Delegated Purchase Authority, Transaction Signal Loss, Agent Takeover
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 8 hours ago by NHI Mgmt Group
11/07/2026 9:03 pm
Agentic commerce creates an intent-verification problem, not just a fraud-detection problem: when software can act on a user's behalf, merchants need to know whether the agent is authorised to purchase, not merely whether the transaction is technically valid. That pushes governance from session scoring into delegated-access policy. The merchant control plane becomes a trust boundary, and practitioners should treat purchase intent as a governed entitlement.
A few things that frame the scale:
- 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: Should merchants prioritise control or reach when agents drive traffic?
A: Merchants will need to balance both, but control should come first in high-risk categories. If teams accept agent traffic without clear policy boundaries, they may gain volume while losing visibility, fraud discrimination, and pricing leverage across the customer journey.
👉 Read our full editorial: Agentic commerce will reshape fraud and merchant control online