Topic starter
15/08/2026 6:14 pm
TL;DR: AI agents are making fraud faster, more adaptive, and harder to distinguish from legitimate users, according to Fingerprint, because they can mimic browsing, rotate tactics, and blend into normal traffic while evading rule-based controls. The operational shift is from bot filtering to behavioural, device, and risk-based identity signals.
Editorial analysis by NHI Mgmt Group, based on content published by Fingerprint: “How to detect AI agents and prevent autonomous fraud”.
Key questions
Q: How should security teams stop agentic AI fraud without blocking real users?
A: Security teams should focus on behaviour inside the flow, not only on whether the account is real.
Q: Why do CAPTCHAs and static bot rules fail against AI agents?
A: They assume attackers will keep repeating the same patterns.
Q: What are the signs that AI fraud controls are failing?
A: Weak controls usually show up as rising scam volume, more difficult-to-spot fraudulent content, higher account takeover rates, and customers abandoning the brand after suspicious interactions.
Practitioner guidance
- Implement layered device intelligence Combine browser, hardware, network and session signals so a single evasion tactic does not reset an attacker’s identity across visits.
- Replace rigid bot rules with adaptive risk scoring Use behavioural and contextual signals to raise or lower risk dynamically instead of blocking based on fixed patterns alone.
- Reserve step-up verification for suspicious sessions Trigger additional checks only when behaviour, device signals or velocity indicate likely automation or coordinated abuse.
Bottom line: AI agent fraud is exposing the limits of controls built for repetitive automation, because adaptive actors can now look human enough to bypass static bot rules.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
15/08/2026 6:20 pm
AI agent fraud creates a behavioural identity gap: static bot controls assume automation will look repetitive, but adaptive agents can vary enough to resemble a real session. That forces fraud teams to treat identity proofing, device intelligence and behavioural scoring as a single control layer rather than separate checks. Practitioners should shift detection logic toward session credibility, not just bot signatures.
A few things that frame the scale:
- 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.
- Nearly 60% of companies reported that fraud losses were still increasing in 2025.
A question worth separating out:
Q: Should identity and fraud teams use the same controls for AI-driven abuse?
A: They should align around the same trust decisions, because AI-driven abuse now crosses account creation, session handling and ongoing access. Fraud teams own the abuse case, but IAM and identity verification provide the lifecycle controls that make trust decisions more defensible.
👉 Read our full editorial: AI agent fraud is breaking legacy bot detection models