Topic starter
12/06/2026 10:21 pm
TL;DR: Agentic commerce creates a new fraud surface where malicious AI agents can browse, transact, and imitate legitimate customer behaviour at scale, according to Fingerprint. Existing device and session controls can reduce bot activity, but they do not by themselves resolve the identity trust problem once agents start acting like users.
Editorial analysis by NHI Mgmt Group, based on content published by Fingerprint: “Fingerprint Blog”.
Key questions
Q: What breaks when fraud controls only trust the device and session in agentic commerce?
A: Device and session controls can still confirm that a browser or app looks familiar while missing whether the actor behind it is authorized to make the transaction.
Q: Why do AI agents increase fraud risk even when they use legitimate user environments?
A: AI agents can reuse approved browsers, devices, and workflows while adapting their timing and navigation to look human.
Q: How should security teams implement actor trust checks for online transactions?
A: Start by placing policy decisions at the point where value is transferred, not only at login.
Practitioner guidance
- Define actor trust checkpoints Insert explicit trust checks before checkout, payment, or account-change actions so the platform can distinguish valid session state from valid authority to act.
- Use persistent device signals as one control layer Keep device fingerprinting, risk scoring, and behavioural telemetry in place, but do not treat any single device signal as proof of legitimate intent.
- Separate delegated use from customer-authorised use Map flows where AI assistants, browser automation, or embedded workflows can place orders on behalf of users, then require policy decisions for each route.
Bottom line: Agentic commerce turns fraud into an actor-trust problem because AI agents can imitate legitimate customer behaviour while staying inside familiar devices and sessions.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 2 days ago by NHI Mgmt Group
13/06/2026 1:04 am
Device identity is becoming a necessary signal, but not a sufficient trust decision, in agentic commerce. Fraud programmes have long treated device intelligence as a way to separate known-good from suspicious activity. That assumption weakens when the actor can borrow legitimate browser context, mimic user timing, and operate through approved channels. Practitioners should stop treating device identity as the final answer and treat it as one layer in actor trust.
A few things that frame the scale:
- 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.
- Systems with least-privileged AI access had a 17% incident rate vs 76% for over-privileged systems. Organisations failing to scope AI access properly are 4.5x more likely to experience a security incident, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: What is the difference between device identity and actor authorisation in fraud prevention?
A: Device identity answers whether a browser, app, or endpoint looks known and trustworthy. Actor authorisation answers whether the entity driving the action is allowed to complete that transaction in that context. Fraud teams need both, but actor authorisation is the deciding control once AI agents can mimic human-like sessions.
👉 Read our full editorial: Agentic commerce fraud exposes gaps in device identity controls
This post was modified 2 days ago by NHI Mgmt Group