Agentic Commerce Fraud: How to Tell Trusted AI Agents from Bad Actors at Checkout

Agentic commerce is the shift from customers clicking "buy" to AI agents that search, compare, and pay on their behalf. For fraud teams, it removes the human from the session that most controls were built to observe.

Fraud teams now face a double bind. If they block automated traffic, they turn away legitimate customers who shop through agents. If they let it through, fraudsters gain the same speed and scale as everyone else.

Card networks and AI platforms have released protocols that identify agents and record what customers authorize. They solve part of the problem, and this article covers the rest: where fraud risk remains and which controls stop bad actors without blocking good agents.

What Is Agentic Commerce?

Agentic commerce is a model of online buying in which AI agents act on a customer's behalf to find products, decide within limits the customer sets, and complete the payment, with little or no step-by-step human input.

The customer gives an instruction and a budget, the agent turns it into a cart, and the merchant's payment provider and the card issuer authorize the transaction. Most protocols capture the customer's consent as a mandate: a record of what the agent may buy, from whom, and up to what amount.

Adoption is moving from pilots to real traffic. According to Adobe data cited by Visa in October 2025, AI-driven traffic to US retail websites grew by more than 4,700% in a single year.

In Europe, Visa reported in July 2026 live agent-initiated transactions with more than 30 European issuers, including HSBC UK and Barclays in the UK and Abanca, Bankinter, BBVA, and CaixaBank in Spain. In Italy, a June 2026 Visa and Nomisma study found that 56% of Italians expect to use AI more for purchases by 2030.

Why Agentic Commerce Changes the Fraud Equation

Agentic commerce weakens the signals fraud models rely on most: how a person types, moves, and responds to a challenge. An agent never hesitates over a form, so its sessions look fast and automated by design.

Most fraud stacks flag that profile as suspicious. When Visa introduced its Trusted Agent Protocol in October 2025, it named this problem: merchant bot defenses can block legitimate agent transactions, and each of those false declines costs the merchant a sale.

Attackers adapt just as fast. Visa reported in November 2025 a 25% increase in malicious bot-initiated transactions over six months, and a rise of more than 450% in dark web posts mentioning "AI Agent" compared with the previous six months.

Fraud teams therefore need to answer a narrower question for each session: is this a trusted agent, and is it acting for a legitimate customer?

Six Fraud Risks in Agentic Commerce

The main risks in agentic commerce cluster around identity, delegation, and scale. Most are familiar fraud types that get faster and harder to dispute once an agent sits in the middle.

1. Spoofed and Impersonated Agents

Fraudsters can present malicious automation as a known shopping agent, or build agents that impersonate trusted brands and banks, as Visa's threat research describes.

Signal to watch: traffic that claims to be an agent but carries no valid agent signature, or a signature that doesn't match the agent's registered identity.

2. Account Takeover Through Delegated Credentials

When customers connect an agent to an account, the delegation step becomes a high-value target. In an account takeover, the attacker can link their own agent, change the delivery address, and let the agent spend within limits that look legitimate.

Signal to watch: a new agent connected shortly after a login from an unfamiliar device, IP address, or location.

3. Fake Accounts Created to Run Agents at Scale

Agents make it cheap to operate hundreds of accounts in parallel. Fraud rings commit new account fraud with disposable emails, virtual phone numbers, or synthetic identities, then use agents to buy high-resale goods or test stolen cards.

Signal to watch: recently created emails and phone numbers with no history, clustered around the same IP ranges or devices.

4. "My Agent Bought It": First-Party Fraud and Disputes

Some customers will claim the agent acted outside its instructions, even when it didn't. Merchants without a record of the mandate and the decision will struggle to win these disputes.

Signal to watch: repeat disputes on agent-initiated orders from the same customer, or claims that contradict the stored mandate.

5. Promo, Referral, and Refund Abuse at Machine Speed

An agent can claim a one-per-customer promotion many times over, across many accounts. Fraudsters apply the same scripts to referral bonuses and return policies.

Signal to watch: many accounts with linked contact details or devices redeeming the same offer within a short window.

6. Counterfeit Merchants and Manipulated Shopping Agents

Fraud can also target the agent itself. Visa describes counterfeit merchants built to deceive shopping agents and harvest stored payment data, along with manipulated search results that steer agents to fraudulent sites.

Signal to watch: agent purchases routed to newly registered merchant domains with little or no history.

What Do Agent Payment Protocols Verify, and What Do They Leave Open?

Agent payment protocols prove which agent is making a request and what the customer approved. They don't prove that the customer is who they claim to be, or that the account behind the mandate is legitimate.

Fraud concentrates in that gap: the identity and history of the account behind the agent. For a closer look at agent verification itself, see Trustfull's guide to Know Your Agent.

How to Secure Agentic Checkout Without Blocking Good Agents

Merchants get the best results by combining protocol signals with risk checks on the customer and the session. Five controls matter most.

Classify Every Session

Separate traffic into three groups: humans, verified agents, and unverified automation. Verified agents with valid signatures can follow an approval path designed for them, while unverified automation gets stricter checks.

Score the Customer Behind the Agent

An agent inherits the risk of the account it acts for. Check the account's digital footprint at signup and again before delegation: email age and history, phone number type and tenure, IP reputation, and links to other accounts. These checks run silently and add no steps for legitimate customers.

Reassess Risk at the Moment of Delegation

Treat connecting a new agent like changing a password or a payout account. A new device, a new location, or a recent credential change just before delegation should trigger a step-up check.

Set Rules That Understand Mandates

Velocity limits built for humans don't fit agents. Compare each order with the mandate it relies on: amount, merchant category, frequency, and delivery details. Orders outside the mandate, or mandates changed just before a large purchase, deserve review.

Keep Evidence for Disputes

Store the mandate, the agent identity, the risk score, and the reason codes behind each decision. When a customer says "my agent did it," this record is what settles the dispute.

How Are Regulators in the UK and EU Approaching Agentic Payments?

Regulators in the UK and EU are examining agentic payments, but neither has a dedicated rulebook yet. Until regulators settle liability, merchants depend on upstream controls and good evidence.

United Kingdom

The Financial Conduct Authority (FCA) said in its March 2026 payments priorities that it will consider "whether change or development of regulation is needed to support agentic AI payments." In an October 2026 speech, the FCA described a planned framework for agentic finance covering agent identity, delegated authority, accountability, and execution. The FCA's Mills Review (July 2026) found that 1 in 5 UK adults are already open to AI making decisions for them, and warned that AI could amplify fraud risk.

European Union

The Council and Parliament reached a provisional agreement on PSD3 and the new Payment Services Regulation in November 2025. It strengthens fraud prevention duties and provider liability for impersonation fraud, but it still needs formal adoption and sets no agent-specific rules. Strong customer authentication still applies, and Visa's European agentic transactions used payment passkeys to meet it.

France, Italy, and Spain

Revolut and Visa completed a passkey-authenticated, agent-initiated card payment in France in September 2026. Nexi Group joined Visa's Agentic Ready program at launch, and four Spanish banks have completed live agentic transactions.

How Trustfull Can Help

Agent protocols confirm which agent is acting. Trustfull helps confirm that the customer and the account behind it can be trusted, with silent digital footprint checks on email, phone, IP, and domain signals. With Trustfull, fraud teams can:

• flag disposable contact details, synthetic identities, and linked accounts at signup with Trustfull Onboarding, before they can host agents;
• detect signs of account takeover at login and before sensitive changes, such as connecting a new agent, with Trustfull Login;
• distinguish real users from bad actors, human or not, during the session with Trustfull Session, so verified agents and unverified automation get different treatment;
• act on a risk score and reason codes for each decision, in rules and in disputes.

Discover more about the launch of Trustfull Session.

Preparing for Trusted Agents at Checkout

Teams that move their controls upstream now can welcome trusted agents at checkout and keep stopping fraud, not customers. Talk to our team about preparing your fraud stack for agentic commerce.

What is agentic commerce?

Agentic commerce is online buying in which AI agents act for a customer. The agent searches for products, compares options, and completes the payment within limits the customer sets, such as a budget or a list of approved merchants. The customer approves the mandate once, and the agent handles the checkout steps.

What are the biggest fraud risks in agentic commerce?

The biggest risks are spoofed agents, account takeover when a customer connects an agent, fake accounts created to run agents at scale, disputes over what an agent bought, and promotion abuse at machine speed. Fraudsters also build counterfeit merchant sites to trick shopping agents into handing over stored payment details.

How can merchants tell a legitimate AI agent from a malicious bot?

Merchants can check for a valid agent signature, such as those defined by Visa's Trusted Agent Protocol, and combine it with risk signals about the session and the account. A verified agent acting for an account with a consistent history is low risk. Unsigned automation, or a signed agent acting for a brand-new account with disposable contact details, needs closer review.

Who is liable when an AI agent makes an unauthorized purchase?

Neither the UK nor the EU has settled this yet. The FCA is considering whether payment rules need to change for agentic AI payments, and the agreed PSD3 texts set no agent-specific rules. Existing payment and dispute rules apply in the meantime, so merchants should keep clear records of mandates and decisions.

Do PSD3 and PCI DSS apply to AI agent payments?

PCI DSS applies to any business that stores, processes, or transmits card holder data, whether a person or an agent starts the payment. EU lawmakers provisionally agreed PSD3 and the Payment Services Regulation in November 2025, but the texts are not yet in force. Once adopted, their fraud prevention and authentication duties will apply to payment providers however a payment starts.

How does agentic commerce handle consent and authentication?

The customer approves a mandate that records what the agent may buy, from whom, and up to what amount. Protocols such as Google's AP2 sign these mandates cryptographically. Card networks then rely on tokens and passkeys to tie the payment to a real card holder and meet strong customer authentication requirements in Europe.

How does Trustfull help prevent agentic commerce fraud?

Trustfull scores the customer and the session behind each agent. It runs silent checks on email, phone, IP, and domain signals at signup, login, and during the session, then returns a risk score with reason codes. Fraud teams can use these signals to approve verified agents acting for trusted accounts and stop automation tied to fake or compromised ones. Trustfull is GDPR compliant.