Topic starter
11/11/2026 5:57 pm
TL;DR: Agentic traffic is rising alongside scams that push customers to use stolen cards inside their own accounts, with agentic orders averaging $154 against $121 for human sessions, according to Forter. Fraud teams now need controls that distinguish automation from collusion, because the same account can carry both legitimate purchase intent and abuse.
Editorial analysis by NHI Mgmt Group, based on content published by Forter: “Fraud Temperature Gauge: September 2026”.
By the numbers:
- Forter reports 107% growth in AI referral activity globally in September.
- Forter says agentic orders had a higher average order value of $154 versus $121 for human sessions.
- Forter recorded 2.4 million attacks in September, 87% of which were perpetuated by coordinated fraud rings.
Key questions
Q: Why do coordinated fraud rings evade account-based controls?
A: Coordinated fraud rings evade account-based controls by spreading activity across many stolen, synthetic, or mule accounts, then varying devices, IP addresses, payment instruments, and behavioural signals.
Q: How should merchants respond to account takeover after 3DS adoption?
A: Merchants should treat 3DS as one control in a broader account takeover defence, not as a substitute for account security.
Q: Why does agentic commerce change fraud detection so much?
A: Because the decision-maker is no longer always a person interacting directly with the system.
Practitioner guidance
- Separate agentic sessions from normal shopper traffic Tag AI-assisted shopping flows, compare their basket shapes and velocity to human baselines, and route them through fraud models tuned for bulk or subscription-style orders.
- Treat coordinated fraud as a ring problem Correlate shared IP ranges, rapid retries, account creation bursts, and failed payment patterns before deciding whether a cluster is a single offender or a coordinated ring.
- Review account history as a risk indicator Use prior purchase behaviour, stored value, and login continuity as inputs to scoring, but do not treat them as proof that the current session is legitimate.
Bottom line: Agentic shopping expands the fraud surface because the same account can now carry both legitimate automation and abusive behaviour.
Glossary terms: Account Takeover, Coordinated Fraud, Credential Stuffing, 3-Domain Secure
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/11/2026 6:06 pm
Agentic commerce creates a trust bifurcation: the same account now has to support both legitimate AI-assisted buying and adversarial activity. That forces fraud governance to move beyond static login rules and into behavioural context, because intent is no longer visible from the session alone. The control problem is classification, not just authentication, and practitioners need to separate automated customer convenience from abusive automation.
A few things that frame the scale:
- U.S. fraud losses are projected to reach $40 billion by 2027.
A question worth separating out:
Q: Does customer collusion matter in ecommerce fraud prevention?
A: Yes. Customer collusion matters because legitimate account holders can be recruited, bribed, or tricked into using their own accounts, cards, or identities to hide fraud. That defeats controls focused only on stolen credentials, so merchants need behavioural monitoring, shared-device analysis, payout verification, and cross-account linkage detection.
👉 Read our full editorial: Agentic shopping raises ATO pressure and rewards ring detection