Agentic commerce fraud: when AI agents do the buying

Agentic commerce is shopping done by software on a person's behalf. You tell an assistant what you want and what you will pay, and it finds the product, compares the options and completes the checkout. Card networks, payment processors and AI companies have each built protocols to make that payment safe for the person who delegated it.

Those protocols mostly answer one question: did a person authorise this spend? A merchant also needs to know whether it should accept this purchase, from this buyer, at this volume, and the protocols leave that to you. That is the gap fraud and abuse move into.

Agentic commerce protocols and who runs them

The protocols split into two layers. Authorisation protocols such as AP2 and the card networks' tokens prove that a person permitted a purchase. Identity protocols such as Visa's Trusted Agent Protocol prove which agent is making the request. We cover the difference in AI agent identity. Neither layer says whether the purchase is good for your business.

Six kinds of agentic commerce fraud

Inventory hoarding and scalping. An agent told to buy every ticket or every pair of a limited release will try to do exactly that, quickly and without tiring. A reseller does not need bot tooling of their own when an agent can be authorised to buy at volume, and the mandate behind each purchase is genuine. This is denial of inventory and ticket scalping with a payment credential attached.

Card testing. A fraudster with a list of stolen card numbers needs small purchases to find out which ones work. An agentic checkout gives them a standard, scriptable path to your payment step. A mandate signed with a stolen card proves only that whoever held the card authorised it.

Promotion and coupon abuse. First-order discounts, referral credits and limited codes were priced on the assumption that a person redeems them once. An agent creating accounts and applying codes repeatedly turns each promotion into a cost with no new customer behind it.

Account takeover through delegated credentials. Some agents act inside a person's logged-in account, using a saved session, a stored password or a delegated payment credential. Whoever compromises the agent, or tricks it with instructions planted on a web page, gets the same access. Purchases then come from a trusted account on a trusted device.

Returns and dispute fraud. "My agent bought that, not me" is a new kind of chargeback claim. AP2's signed mandates exist partly to settle this, by recording what the person asked for and which cart they approved. Where no such record exists, the merchant has little to show.

Agent impersonation. If your rules let known shopping agents through, bots will claim to be one. Between 5 and 18 October 2026, prosopo.io received 17,935 requests carrying an AI user-agent, and 53% came from addresses that did not belong to the vendor named. Every request presenting an xAI, Cohere, Mistral or Google-Extended user-agent came from a spoofer. We explain how to check each agent in how to detect AI agents.

Five defences for merchants

Verify agent identity where it is offered. Visa's Trusted Agent Protocol and Web Bot Auth let an agent sign each request, and ChatGPT's agent already signs its requests. Where the operator publishes IP ranges instead, check against those. Do not let anything through because of its user-agent string.

Treat a mandate as authorisation, not proof of good intent. A mandate tells you a person approved this spend, which helps in a dispute. It says nothing about whether that person is a reseller, whether the card is theirs, or whether this is their fortieth order today.

Set quantity and rate limits per buyer. Limit units per order, orders per account, payment card and delivery address, and redemptions per promotion. Apply the limits to the buyer behind the agent rather than to the agent, because one popular agent will carry thousands of legitimate customers.

Require evidence of a human on high-risk steps. Let agents browse, search and compare without friction, because that is a customer doing research. At checkout on limited stock, new account signup, promotion redemption and changes to payment or delivery details, ask for a person. The customer who delegated the task finishes that step themselves, which is a small cost at the moment they most want to buy. A reseller using an agent, a script or a device farm is stopped in the same place. We explain why this works better than classifying the client in agentic browsers.

Check the network as well as the browser. An impostor agent claiming a residential address through a residential proxy gives itself away in the connection: the TCP stack does not match the device it claims to be, or the exit address belongs to a proxy network.

Prosopo Protect checks every request at your edge, with Access Rules on IP range, ASN, user-agent, JA4 fingerprint and IP category, and Procaptcha on the checkout and signup forms where you want evidence of a human. Every block names the detector that fired. For how other bot-management vendors handle the same problem, see our vendor comparison.