AI-driven traffic to retail sites surged 4,700% year over year, with AI bots making up 47.9% of commerce traffic on Akamai's global network in the second half of 2025 (Retail Dive - Technology). Simultaneously, bad bots grew to 43% of holiday shopping traffic from 31%, while Visa expects millions of consumers to buy through an agent by the 2026 holiday season (Retail Dive - Technology). The payments industry moved quickly with Stripe and OpenAI shipping the Agentic Commerce Protocol, Mastercard launching Agent Pay, and Visa introducing the Trusted Agent Protocol, yet these frameworks validate the software platform, not the person authorizing the purchase.
Current signed-agent protocols confirm an agent is authentic but cannot verify whether an accountable person authorized the transaction or whether the account belongs to anyone at all (Retail Dive - Technology). Veriff's Identity Fraud Report 2026 found impersonation behind more than 85% of observed fraud attacks, with digitally presented media 300% more likely to be AI-generated or altered year over year, and e-commerce's net fraud rate hitting 19.2% (Retail Dive - Technology). Commerce platforms must implement three checks: verify the agent's authenticity, confirm a verified human is behind the request, and validate that the action is currently authorized—binding agent activity to a verified person rather than just an authenticated session.
For commerce teams, the operational priority is auditing unverified buyer and seller populations, making verification re-runnable through biometric re-authentication at high-risk moments, and measuring agent traffic separately to distinguish approvals and false rejections. A wrongly blocked legitimate agent creates an abandoned basket that never appears in fraud reports but routes customers to competitors, making false rejection rates a revenue concern that outweighs fraud risk at scale.