Notifications
Clear all
Topic starter
15/08/2026 6:14 pm
TL;DR: AI agents are making fraud faster, more adaptive, and harder to distinguish from legitimate users, according to Fingerprint, because they can mimic browsing, rotate tactics, and blend into normal traffic while evading rule-based controls. The operational shift is from bot filtering to behavioural, device, and risk-based identity signals.
NHIMG editorial — based on content published by Fingerprint: AI agent fraud detection and device intelligence
By the numbers:
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems, inappropriately sharing sensitive data, and revealing access credentials.
Questions worth separating out
Q: How should security teams stop agentic AI fraud without blocking real users?
A: Security teams should focus on behaviour inside the flow, not only on whether the account is real.
Q: Why do AI agents make fraud controls less reliable?
A: AI agents can change timing, transaction amounts, device attributes, and other signals after each outcome, which defeats controls that depend on repetition.
Q: What breaks when bot detection relies too heavily on static rules?
A: Static rules fail when attackers can randomise the exact behaviours the rules look for.
Practitioner guidance
- Implement risk-based step-up at account and transaction boundaries Trigger additional verification only when device, behaviour, or session confidence falls below policy thresholds.
- Correlate device signals across the full identity journey Use repeatable device and browser traits to link account creation, login, profile changes, and payment activity.
- Tune bot detection around adaptive behaviour, not signatures Review whether your current controls still depend on headless browser rules, static velocity limits, or simple fingerprint blocks.
What's in the full article
Fingerprint's full article covers the operational detail this post intentionally leaves for the source:
- How Fingerprint's device intelligence and visitor ID logic differentiate repeat synthetic activity from ordinary user variation.
- The specific Smart Signals used to detect browser tampering, VPN masking, virtual machines, and automated navigation patterns.
- The article's practical examples of balancing bot defence with user experience so step-up controls stay proportional.
- Additional guidance on tuning detection thresholds as AI agent tactics evolve across onboarding and transaction flows.
👉 Read Fingerprint's analysis of AI agent fraud detection and device intelligence →
AI agent fraud detection: are legacy controls keeping up?
Explore further
15/08/2026 6:20 pm
AI agent fraud is now an identity governance problem, not just a fraud detection problem. When agents can create accounts, browse like people, and adapt to controls, the issue is no longer only whether traffic is automated. It is whether identity systems can still trust session-level signals enough to distinguish legitimate intent from synthetic behaviour. Practitioners should treat AI agent abuse as a governance boundary issue across verification, access, and transaction policy.
A question worth separating out:
Q: How do fraud and identity verification teams decide when to add step-up checks?
A: They should add step-up checks when the combined signal from device, behaviour, and account history falls below an agreed policy threshold. The best trigger is not one suspicious event but a pattern that shows the session is behaving unlike a legitimate user with similar context.
👉 Read our full editorial: AI agent fraud is breaking legacy bot detection models
