Agentic Commerce Fraud: When the Buyer Is a Bot With a Real Card
AI agents that shop, book and pay on a user's behalf break every fraud signal built on human behaviour. Merchants are now approving or declining transactions with no way to tell delegation from compromise.
Fraud engines were built on a simple assumption: a human is on the other end, and humans move mice, hesitate at the payment step, and type at a recognisable rhythm. Agentic checkout removes all of it. A legitimate delegated purchase and an automated card-testing run look nearly identical at the network layer.
The three new patterns
Delegation ambiguity
The cardholder genuinely authorised an agent to "book the cheapest flight under €400". The agent booked something else. Was that fraud, a dispute, or a product failure? The chargeback framework has no category for it yet, so it lands as fraud, and the merchant's ratio suffers.
Injection-driven purchases
A shopping agent browses a merchant page whose content instructs it to add an item, apply a supplier code, or ship to a different address. The user approved a purchase; they did not approve that purchase.
Scaled, patient card testing
Agents replay realistic sessions with plausible browsing paths and human-scale delays, defeating velocity rules that assumed automation meant speed.
Controls for merchants
- Ask for the agent to identify itself, and reward it for doing so. A signed agent identity with a declared principal should get a smoother path than an agent that pretends to be a browser. Make honesty the cheaper option.
- Bind the mandate to the transaction. Amount ceiling, merchant category, expiry and a shipping-address lock, verified server-side at authorisation rather than trusted from the agent.
- Re-authenticate on delta, not on amount. If the final basket differs materially from the stated intent, push a confirmation to the human's device.
- Separate agent traffic in your fraud model. Scoring bots on human features produces confident nonsense in both directions.
Controls for the issuer side
Single-use, scope-limited virtual credentials per mandate are the cleanest available answer. They make the blast radius of a compromised or misled agent equal to one transaction, and they give the dispute process an artefact to reason about.
Agentic commerce is not a bot-detection problem. It is an authorisation problem wearing a bot-detection costume.
