AI agent shopping fraud: why checkout needs identity and intent

AI shopping agents now browse, compare and buy for real customers, so a checkout can no longer treat automation as a sign of fraud. Identity checks tell a retailer what is acting: a human, a bot or an agent. To stop agent fraud, the retailer also has to read intent, meaning what the session is trying to do, because a verified agent can still check out with a stolen card, farm a promotion, abuse refunds, scalp stock or follow hidden instructions.

What is agentic commerce fraud?

Agentic commerce fraud is abuse carried out through an AI agent that shops on someone's behalf. Some agents declare themselves with a signed request or a clear identifier, and many do not. In both cases the agent can be a legitimate customer channel, so blocking all agents turns away real buyers. The fraud sits in what a particular agent session does once it is inside.

How do AI agents reach an ecommerce checkout?

AI agents reach a checkout in three ways: through a browser, through MCP tools, or through agentic commerce APIs. Each route leaves different evidence.

All three routes end at the same checkout decision. A fraud control built only for browser traffic will miss agents that arrive through MCP or an API.

What is the difference between agent identification and intent?

Agent identification answers "what is acting?" It sorts a session into human, bot or agent, names the agent where possible, and checks whether the agent declared itself, for example with a signed request.

Intent answers "what is it trying to do?" A verified agent buying a gift and a verified agent draining a stolen card carry the same identity. Only the behavior of the session separates them.

What does agent identification stop?

Identification works at the door.

Humans and declared agents get in, and undeclared bots get risk assessed and potentially turned away. That removes a lot of familiar automated abuse before it reaches a cart, including card testing, scraping, fake account creation and scalper bots.

What does agent identification miss?

It misses a verified agent that has been steered to steal, abuse or hoard.

Three verified agents can arrive together: one buying a gift for its user, one re-ordering household basics, one checking out with a stolen card.

An identity check passes all three.

Four examples of agentic commerce fraud

In each example below, the agent passes an identity check on its own. The session's behavior is what gives it away.

1. Stolen card fraud through a verified agent

A verified shopping agent checks out with a network token. The session adds a new card to the account and a new shipping address, buys only high-resale items, and skips browsing entirely. The response is an issuer step-up and a hold on shipment.

2. Promotion abuse by agent-created accounts

Many declared agents arrive with fresh accounts and redeem the same offer. They share an agent template and fragments of the same payment or address details, and the accounts were created minutes before redeeming. The response is to limit the offer per linked identity instead of per account.

3. Refund abuse by service agents

A service agent files refund claims for a buyer. Claim rates run well above peers, "not received" claims appear on tracked parcels, and the same wording repeats across accounts. These claims go to manual review.

4. Scalping by shopping agents

When a product drop goes live, agents, declared or not, fill carts within the same second. Many carts are held and few are paid. The response is a queue, purchase caps and releasing held stock.

Summary: what identity sees, what intent sees, and the response

Why do retailers need both identity and intent signals?

Identity alone knows what is acting but lets the stolen card, the promotion farm and the hijacked agent through. Intent alone sees what the session is doing but can't tell an agent from a person, which agent it is, or who sent it. With both, a retailer can block bad sessions, step up uncertain ones and approve good agents faster.

Why do security and fraud teams miss agent abuse?

Most retailers already collect both kinds of signal, but different teams hold them. The CISO’s edge signals rarely reach the system that approves the order, and attackers work in the gap between teams.

• Security Team: Sees bots, proxies and attack tools at the edge.
• Fraud Team: Sees orders, payments and chargebacks.
• Growth Team: Watches conversion and adds friction to stay safe.

How should retailers prepare for AI shopping agents?

Blocking every agent turns away customers, and allowing every agent action gives away control. Retailers should judge each session on identity at the door and on intent all the way to checkout.

Five questions show where a team stands:

1. Which agents reach your checkout today, and how many declare themselves?
2. Does your fraud or bot management system falsely reject AI-assisted genuine transactions?
3. Do edge security signals, including off-app MCP calls, reach the system that approves orders?
4. Could you spot a verified agent adding a new card and address and skipping browsing before the order ships?
5. Which actions can agents take alone, and which should go back to the human?

A team that can't answer one of these has found the place attackers will try first. Darwinium combines identity and intent signals in one checkout decision. Contact us to learn more.

Frequently asked questions

Should retailers block AI shopping agents?

Many agents shop for real customers, so blocking all of them loses sales. Retailers admit agents on their own terms, and keep assessing what each agent session does.

Can a verified AI agent commit fraud?

Yes. Verification confirms which agent is acting, not what it is doing. A verified agent can check out with a stolen card, redeem one promotion across many fresh accounts, file inflated refund claims, scalp limited stock, or follow hidden instructions planted on a web page.

What signals reveal agent intent at checkout?

Useful intent signals include a new card or shipping address on the account, high-resale baskets, no browsing before checkout or the equivalent MCP queries from a customer searching through AI Chat, accounts created minutes before a promotion is redeemed, shared payment or address fragments, refund claim rates above peers, and carts held but not paid during a product drop.