Topic starter
11/11/2026 5:56 pm
TL;DR: AI agents can complete checkout so cleanly that fraud controls see the same pattern as bot-driven card testing, according to Forter. Merchants need identity-aware transaction governance, or they will block legitimate automated shoppers and miss malicious ones.
Editorial analysis by NHI Mgmt Group, based on content published by Forter: “Can You Tell the Difference Between an AI Agent and a Bad Bot?”.
By the numbers:
- 53% of UK consumers have used or are open to using AI to find holiday gifts this year.
Key questions
Q: Why can legitimate automation look like card testing at checkout?
A: Legitimate automation can look like card testing because both produce many low-value or failed checkout attempts from the same IP, device or payment path.
Q: What is the best way to identify delegated checkout traffic?
A: The best way to identify delegated checkout traffic is to authenticate the software acting on behalf of a customer, then correlate its session, device, payment and account signals.
Q: How do AI shopping agents change checkout fraud detection?
A: AI shopping agents raise checkout fraud detection complexity because their requests can resemble scripted abuse, so merchants need signals for delegated identity, provenance, session continuity and payment instrument ownership.
Practitioner guidance
- Define delegated-commerce policy boundaries Specify which checkout actions an AI agent may perform, which require step-up verification, and which must remain human-confirmed.
- Instrument identity-rich transaction telemetry Capture device, network, session and behavioural signals together so the fraud model can distinguish headless automation from hostile bot traffic.
- Test bot identification across payment journeys Validate whether your bot provider and internal controls can recognise known agentic flows before you change CAPTCHA or friction policies.
Bottom line: Agentic commerce turns checkout into a delegated-identity problem because legitimate AI assistants can resemble hostile automation at the point of sale.
Glossary terms: Agentic Commerce, AI Agents, Bot Authentication, Delegated Identity
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/11/2026 6:07 pm
Agentic commerce creates an identity ambiguity problem, not just a fraud problem. The key issue is that a legitimate principal can delegate shopping while the runtime signals still resemble bot activity. That makes the decision boundary harder than classic card testing because the same checkout pattern can belong to both trustable automation and hostile automation. Merchants need a model for delegated action, not only a better bot score.
A few things that frame the scale:
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: What happens when merchants block all automated checkout flows?
A: Blocking all automated checkout flows can stop some abuse, but it also blocks trustworthy agentic traffic such as price comparison, purchasing assistants and repeat-order automation. A better control is risk-based policy that allows verified agent sessions, enforces explicit consent and limits scope, rather than treating every bot as hostile.
👉 Read our full editorial: Agentic commerce makes fast checkout look like fraud to merchants