Topic starter
10/06/2026 10:38 pm
TL;DR: AI-driven fraud is getting harder to distinguish from legitimate automation, with Sumsub citing a 180% year-on-year increase in multi-step, coordinated attacks in 2025 and a model that binds agent activity to verified human identity for accountability. The real shift is that identity teams must govern automation as a trust and attribution problem, not just a bot-detection problem.
Editorial analysis by NHI Mgmt Group, based on content published by SumSub: “Sumsub’s AI Agent Verification Introduces Agent-to-Human Binding to Establish Human Accountability in AI”.
By the numbers:
- AI fraud agents are emerging as a new form of evasion as identity fraud reaches unprecedented levels of sophistication, with a 180% year-on-year increase in multi-step, coordinated attacks globally in 2025.
Key questions
Q: How should teams govern AI agent traffic without blocking legitimate automation?
A: By separating delegated agent sessions from unauthorised automation and setting different rules for read-only crawling, structured interaction, and transactional access.
Q: Why do AI agents create accountability gaps in existing identity models?
A: Traditional access models were built for people, but AI agents can retrieve data, open tickets, and run code across many systems in seconds.
Q: What are the signs that automated activity should be challenged rather than allowed?
A: Challenge becomes appropriate when device intelligence, network signals, or behavioural patterns suggest coordinated abuse, session manipulation, or mule activity.
Practitioner guidance
- Define which automated actions require human accountability Map onboarding, account-control changes, and payout workflows to the exact points where a verified person must remain responsible for the agent’s action.
- Use risk-based challenge only at high-impact moments Apply liveness or other step-up checks when the action affects funds movement, identity recovery, or privileged account state, not on every automated event.
- Separate legitimate automation from suspicious agent behaviour Build decision logic that allows routine automation to continue while flagging coordinated mule patterns, device anomalies, and abnormal session behaviour.
Bottom line: AI agent verification reframes automation as an identity and accountability problem, not just a bot-detection problem.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 2 days ago by NHI Mgmt Group
11/06/2026 2:45 am
AI agent verification is really an accountability control, not a bot control. The article frames automation as manageable when it can be tied to a verified human, which places the control problem squarely in identity governance rather than perimeter filtering. That matters because fraud teams often over-index on machine detection while missing the attribution layer that decides who is answerable for the action. The practitioner takeaway is that automation policy and identity assurance now need to be designed together.
A few things that frame the scale:
- 92% agree governing AI agents is critical to enterprise security, yet only 44% have implemented any policies to do so, according to AI Agents: The New Attack Surface report.
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems, inappropriately sharing sensitive data, and revealing access credentials.
A question worth separating out:
Q: What should organisations do when delegated automation changes role or leaves service?
A: They should treat delegated automation like a governed identity with lifecycle events, not a one-time setup. When the human sponsor changes role or exits, the automation’s authority, approvals, and exception paths must be reviewed so accountability does not outlive the business relationship that justified it.
👉 Read our full editorial: AI agent verification ties automation back to human identity
12/06/2026 4:19 am
Automation accountability is becoming an identity control, not a fraud afterthought: When AI agents can act on behalf of a person, the real governance question is who can be held responsible for the action. SumSub’s framing shows that trust must shift from the automated session itself to the verified human behind it. That is a useful pivot for IAM and fraud teams because it makes accountability measurable at the point of action, not only at enrollment or login.
A few things that frame the scale:
- 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: What is the difference between bot detection and AI agent verification?
A: Bot detection identifies that activity is automated, while AI agent verification tries to bind that automation to a verified human identity and risk decision. One answers whether software is involved, the other answers who is accountable when the software acts and whether the action should be allowed at all.
👉 Read our full editorial: AI agent verification ties automation back to human identity
This post was modified 2 days ago by NHI Mgmt Group