If your software touches a checkout page, a billing portal, or an invoice, your next big fraud problem probably won’t look like fraud at all. Indeed, AI agents are now comparing prices, filling carts, and completing purchases on behalf of consumers and businesses. Visa has predicted that millions of consumers will use AI agents to complete purchases by the 2026 holiday season, which means the agent traffic reaching your merchant customers this quarter isn’t a pilot, it’s production.
That’s a real problem for software developers, because most of the fraud tooling we’ve built around was designed to catch a human doing something odd. Agentic fraud doesn’t behave that way, and if your platform can’t tell the difference between a trusted agent and a hijacked one, your customers can’t either.
Why agent fraud slips past your current defenses
Criminals spotted this opportunity early. In its agentic commerce threat analysis, Visa’s Payment Ecosystem Risk and Control (PERC) team identified a more than 450% increase in dark web posts mentioning AI agents over a six-month period. Visa also saw a 25% increase in malicious bot-initiated transactions globally, with a 40% jump in the U.S.
The bigger issue is how these attacks look once they land. Signifyd has observed that agentic fraud often shows up as clean, fast, and successful transactions, rather than the messy behavior fraud systems are trained to flag. Think about what your risk logic rewards today. A trusted, tokenized card on file, a known shipping address, no failed attempts, and a checkout completed in seconds all read as low risk. They also describe a compromised agent perfectly.
When attackers take over an agent, they inherit everything the user delegated to it, including stored payment credentials, saved addresses, and purchase history. They can also build counterfeit storefronts designed to pass an agent’s automated checks, so the agent willingly spends the user’s money in the wrong place. And the wider fraud environment is heating up at the same time. Signifyd’s 2026 State of Fraud Report found that account takeover attacks rose 78% and card-testing attacks rose 175% in the first four months of the year.
The emerging standards you need to understand
The good news is that the payments industry isn’t waiting for a crisis. Several open standards are taking shape, and they share a common goal of proving which agent is acting, on whose behalf, and with what authority.
Visa’s Trusted Agent Protocol (TAP), introduced in October 2025, lets a legitimate shopping agent cryptographically sign its identity into the web requests it sends. A merchant’s systems can then check that signature and separate a verified agent from a malicious bot posing as one. Mastercard has taken a related approach with agentic tokens, which carry the agent’s identity in the transaction record so disputes can be attributed correctly.
Google’s Agent Payments Protocol (AP2) focuses on authorization. It uses a chain of cryptographically signed mandates, starting with an intent mandate (what the user told the agent it may do), then a cart mandate (the specific items and price the user approved), and finally a payment mandate (what the payment network sees). Together, they create a verifiable record that a real person approved a specific purchase.
The Agentic Commerce Protocol (ACP), co-developed by OpenAI and Stripe, standardizes the checkout exchange between an agent and a merchant. Its key security feature is a shared payment token that’s bound to one merchant, a maximum amount, and an expiration time. The merchant never handles raw card data, and the agent can’t spend beyond what the token allows.
You don’t have to pick a winner today. These standards overlap and, in places, work together, and adoption is still uneven across processors and platforms. What you do need is an architecture that can accept, store, and pass along these signals instead of discarding them at the first integration layer.
What you should build into your platform now
Start by making agent traffic visible. Your application programming interfaces (APIs) and checkout flows should be able to flag a transaction as agent-initiated, capture any agent signature or token that comes with it, and hand that context to your payment processor and your merchant’s fraud tools. If you can’t tell agent orders from human ones, neither can your customers.
Next, treat delegated credentials like the high-value targets they are. Favor scoped, short-lived tokens tied to a specific merchant, amount, and time window over broad, persistent card-on-file access. That principle applies whether you run an ecommerce platform, a point of sale (POS) system with online ordering, or a software as a service (SaaS) billing engine handling business-to-business (B2B) invoices, where procurement agents are starting to pay bills on their own.
Then rethink your velocity and anomaly rules. A burst of rapid, flawless purchases from the same agent and credential should raise a flag, not lower one. Build in per-agent spending caps, throttling, and a fast kill switch that lets a merchant suspend one agent’s access without shutting down their entire checkout.
Finally, log everything. When a disputed agent purchase lands, the merchant will need proof of what the user authorized and what the agent actually did. Retaining mandates, tokens, agent identifiers, and timestamps gives your customers a fighting chance in a chargeback, and it gives you a capability your competitors may not have yet.
Make agent readiness part of this quarter’s roadmap
Agentic commerce is moving faster than most product roadmaps, and waiting for the standards to settle means your merchants face this holiday season unprotected. They’ll see agent traffic whether you’ve planned for it or not, and they’ll expect your software to help them separate good agents from bad ones.
Assign a clear owner for agent readiness, audit your checkout and payment integrations against the standards above, and ask your payment partners which agent signals they already support. It’s a short list of work with a long tail of benefits. The ISVs who act now won’t just reduce fraud exposure. They’ll give merchants one more reason to stay.
