AI Shopping Agents: How to Approve the Good Ones Without Waving Through Fraud

Not with a blanket rule, because blocking every AI shopping agent does not cut your losses; it moves them from fraud to false declines, and for a growing channel that is usually the bigger loss. Some agents are legitimate, a real customer who delegated the purchase to an assistant, and some are fraud bots, and a blanket block cannot tell the difference, so it rejects both. Every good order you reject is revenue you never recover, and unlike a chargeback it does not even show up on a report, which is why blanket blocking feels safe while quietly costing more. The better approach is a three-way decision: approve agents with strong positive signals like proof of delegated authority and normal customer behavior, block those with clear fraud signals like card-testing velocity and stolen-looking data, and verify the uncertain middle with a lightweight step-up rather than rejecting it. That keeps the good revenue a block would lose while still stopping the attacks.

By weighing several signals together rather than looking for one tell. A legitimate delegated agent is acting for a real person with a real account and history, so it tends to arrive with continuity, a known device, consistent identity and shipping, and normal spend, and increasingly with a verifiable proof that a specific human authorized the purchase, which a fraud bot on stolen cards cannot produce. A fraud bot shows the opposite pattern: no delegated-access proof, card-testing velocity with many small attempts across different cards, and a billing identity, device, and address that do not form a coherent picture because they were assembled from stolen parts. The honest caveat is that no single signal is proof, a returning device can be compromised, and missing delegated proof does not by itself mean fraud because the standards are still rolling out. So you combine the signals into a risk read: strong positive signals let you approve, strong fraud signals let you block, and the ambiguous middle gets verified rather than guessed.

A false decline is when you reject a legitimate order believing it is fraud, and it matters enormously for AI agents because blanket agent-blocking produces them at scale. When you block every automated checkout, every real customer shopping through an assistant is falsely declined, and each one is a lost sale you never recover. The reason false declines are so damaging is that they are invisible: a chargeback appears on a report, but a customer whose agent was blocked simply does not buy, so you never see the revenue you lost. That invisibility makes blanket blocking feel safe while it quietly costs more than the fraud it prevents, especially as legitimate agent purchases grow. The goal is to minimize total loss, fraud plus false declines, not just the visible fraud number. A store that blocks everything can show clean fraud stats and shrinking sales at the same time, which is why the right measure is total cost, and the right tool is a decision that separates good agents from bad rather than rejecting all of them.

Agentic commerce is buying and selling where AI agents act on behalf of people, for example a shopping assistant that finds and purchases a product for a customer. Fraud is rising in it for two reasons. First, attackers are moving in: Visa found a more than 450% increase in dark-web posts mentioning AI Agent over six months and a 25% global, 40% US, increase in malicious bot-initiated transactions, as fraud operators build bots that push all the way to checkout. Second, the new model creates new tricks, including fraudulent merchants that build storefronts designed to deceive a consumer’s AI agent, passing automated checks and offering below-market prices, then harvesting the stored payment credentials once the agent buys. For a merchant, the practical impact is that a growing share of your checkout traffic is automated and some of it is hostile, while some is legitimate customers using agents. That mix is exactly why blunt bot-blocking no longer works and a decision framework, separating legitimate delegated agents from fraud bots, is needed instead.

The key is to treat verification as a step-up for the uncertain middle, not a wall, so it resolves doubt without rejecting good orders. When an agent purchase looks normal but carries some doubt, for example no delegated-access proof but otherwise consistent behavior, you confirm with the real account holder before completing the order rather than declining it. That confirmation, a quick check to the person the agent is acting for, resolves the ambiguity: a real customer approves and the sale goes through, while a fraud attempt fails because there is no real account holder to confirm. This costs far less than a false decline, because it keeps the good order instead of losing it. The best posture asks agents for verifiable proof of delegated authority where they can provide it, approves confidently when they do, and falls back to a lightweight verification step when they cannot, since the standards are still rolling out and many legitimate agents do not yet carry proof. Failing gracefully, verify when unsure rather than block, is what keeps real customers from being turned away.

Only for the small share of orders that genuinely need it, if you design the decision well. The point of a three-way framework is that most orders never see a verification step: clearly-legitimate agents with strong positive signals are approved immediately, and clear fraud is blocked immediately, so the step-up applies only to the ambiguous middle. For that middle, a lightweight confirmation to the real account holder adds a small amount of friction to a minority of purchases in exchange for avoiding both a false decline and a fraud loss, which is a good trade. The mistake to avoid is applying verification to everything, which would add friction across the board and hurt conversion, or applying it to nothing, which forces you back into the blunt approve-all or block-all choice. Tuned properly, verification is rare, targeted, and cheaper than the alternatives it replaces, and as verifiable delegation standards mature, more agents will carry proof up front, shrinking the share of orders that need a step-up at all.