How Can Banks Detect AI Agents and Secure Agentic Banking?

About a year ago, Feedzai began exploring what AI agents could mean for banking. We envisioned a future where customers delegate everyday banking tasks to AI agents. A conversation with one of our banking customers brought the challenge into focus.

Their question was simple. At what point do you realize it’s not the user, it’s the agent, doing the banking?

The account could be the same. The credentials could be valid. The activity could look familiar. But who, or what, was doing the banking had changed. A successful login doesn’t establish who is acting, whether the customer authorized the agent’s actions, or whether those actions are safe. 

That question helped shape our approach at Feedzai. Recognizing the handoff was one challenge. Making that recognition reliable as agents evolved was another.

Key Takeaways

• A successful login does not establish whether a human or an agent is acting, or whether the requested action is authorized.
• Automation clues, declarations, and behavior provide complementary evidence. Reliable decisions also depend on protected and trusted signals, validated identity evidence, and device and account context.
• Traditional login screens, bot detection, and self-declaration cannot reliably determine agent intent or legitimacy, as seven in eight agents arrive with no name or owner. 
• Agent identity is distinct from intent and authorization. Even a valid signature associated with a recognized provider does not establish that a banking action is legitimate or customer-approved. 
• Feedzai Digital Trust helps banks detect and evaluate AI agents by combining protected signal collection, device intelligence, behavioral biometrics, and threat analysis across sessions.

Agent Detection Needs a Layered, Continuously Adaptive Trust Approach

Banks need to provide a seamless and secure digital banking experience, stop fraud, and spot when a genuine customer may be acting under a scammer’s direction. They need to do that even after a successful login, while keeping unnecessary authentication challenges out of legitimate customers’ way.

Feedzai Digital Trust provides the identity risk intelligence behind those decisions. It brings together four signal layers: device intelligence, behavioral biometrics, network and threat intelligence, and endpoint security. Together, they help banks assess whether a device is compromised, whether activity fits the customer’s established behavior, and whether a session carries signs of fraud or manipulation.

We are extending the same approach to agents with an initial focus on four connected capabilities:

• Protect signal collection and delivery
• Recognize supported bot and agent identities using a maintained non-human identity registry
• Identifying the agent by a corpus of evidence, including: self-declared web-bot-auth signatures, trusted infrastructure checks, and agent fingerprinting
• Develop a deeper assessment of agentic intent

3 Ways the Market Detects AI Agents Today

Automation signals, agent declarations, and behavioral analysis each answer part of the question, who or what is behind the transaction? Banks need to combine that evidence with device and account context and protect the controls that collect the telemetry signals.

• Automation detection helps identify activity that looks agent-driven. It does not, on its own, establish which agent is acting, who authorized it, or whether the activity is harmful.
• Agent declarations can help identify the claimed source of a request. A valid cryptographic signature associated with a recognized signing identity provider provides stronger evidence of that source. Agents do not always declare themselves, and claimed identities still need verification. Even a verified source does not establish permission for a banking action.
• Agent behavior provides clues through navigation, mouse movement, and typing patterns. Our research shows differences between agents, but also overlap with human behavior. Fingerprints and behavioral profiles need to be tested and updated as agents change.

Financial institutions need to understand both the evidence and its limits. Before relying on any signal, they need confidence that the tools collecting it have not been compromised.

Trust the Signals

In our research, we observed Muse altering its browser fingerprint and suppressing automation flags, making legitimate agent activity harder to recognize. Separately, OpenAI reported that its agents attempted to disable monitoring during controlled testing.¹

As agents evolve, banks face two related questions: can they recognize the agent interacting with an account? And can they rely on the evidence used to assess it? Browser characteristics and automation signals can change, so no single signal layer should carry the entire decision.

Malware already targets banking apps and the tools that collect device and behavioral signals. As agents gain more ability to act, protecting those controls becomes foundational to fraud prevention. Banks need reliable signals in time to stop a risky action.

“By the time anyone notices there is something wrong and opens a ticket, the damage could be insurmountable.” — Amir Boldo in Cyber Responders Strained By ‘Black October’, Angus Loten & Kim S. Nash, The Wall Street Journal.²

Feedzai’s agentic detection strategy starts with a foundation banks can build upon to catch these signals earlier. 

How Banks Can Identify and Verify Non-Human Identities

Distinguishing between automated entities requires evaluating how each request is authenticated, verified, or characterized. Banks can classify non-human interactions into four distinct categories based on their authenticity signals:

• Signed: Identity authenticated through a valid cryptographic HTTP signature associated with a trusted agent or provider (web bot authentication).
• Verified: Identity confirmed through trusted provider infrastructure, such as provider-published IP ranges or validated reverse DNS.
• Inferred: Identity attributed through fingerprints, behavioral patterns, or unverified declarations.
• Spoofed: A claimed bot or provider identity fails the applicable authenticity checks, such as signature validation, provider infrastructure verification, or evidence of tampering.

Connect Agent Identity to Device Context

Knowing which agent is acting gives the bank part of the picture. Knowing whether it is using a browser already linked to the customer adds context that a bot name or signature cannot provide. 

Digital Trust can cryptographically bind a supported native agentic browser, or an existing agent-operated browser, to a customer, allowing the bank to recognize that particular browser instance linked to that customer.

Agent identification and browser binding together can help the bank recognize the agent operating through that browser and assess its access. Device, behavioral, and network signals help assess the risk, so the bank can decide which agent activity to restrict or block and which relationships it may choose to permit as its policies evolve.

How Agentic Banking Creates New Fraud Risks

We have seen this story before. Technology changes how people bank, and fraudsters look for the easiest opening. Stronger authentication still leaves room for scammers to bypass it by manipulating the customer. New digital channels create handoffs where responsibility, visibility, and controls still lag.

Agentic banking introduces another handoff. A customer delegates a task, and an agent accesses the account. If the bank can’t recognize that change or enforce delegation limits, familiar fraud tactics find those gaps.

“Fraudsters look for the simplest way to exploit a new channel. When standards and controls are still taking shape, familiar tactics like account takeover, scams, and malware find new openings.” — Stuart Dobbie, Senior Director of Product Strategy and Management for Digital Trust

Major institutions are blocking or restricting agents’ access to customer accounts.³ The immediate challenge is recognizing agent activity and enforcing the bank’s rules, even when the customer wants the agent to act.

The MITRE Fight Fraud Framework provides a way to examine the openings an attacker could use to access an account via an agent,⁴ interfere with fraud controls, change account details, and initiate a fraudulent payment. It connects those actions to the risk signals a bank could assess and the controls it could apply before money moves.

What Feedzai’s Digital Trust Delivers Now…and Will Deliver Next 

Banks need to know when an agent enters the customer journey and have the context to decide what happens next. Digital Trust’s agentic detection builds on the same foundation banks use to protect customers today by protecting the signals behind that decision and identifying supported agents. 

Our roadmap builds toward understanding their behavior and bringing that intelligence into payment decisions. Here’s what Digital Trust offers now, and a glimpse into our future roadmap.

• Identify agents and control access (available today). Digital Trust combines protected signals, persistent device recognition, web bot authentication, cryptographic browser binding, and network intelligence, including a network score, to help banks detect agent activity and decide whether to allow, restrict, or block access. These same capabilities strengthen authentication, identify compromised sessions, and reduce unnecessary authentication challenges.
• Strengthen agent identity detection (available in Q4 2026).  Trusted provider infrastructure checks and a maintained registry of non-human identities, giving banks more confidence and an enterprise standard about which agent is connecting and whether its claimed identity can be verified.
• Agent fingerprinting (target Q1 2027). Building richer agentic fingerprints based on how they navigate and interact. Develop evolving agent profiles alongside customer context to help banks determine agentic intent, spot unusual activity, and assess risk as agents change.
• Agent behavioral intent (target Q2 2027). Develop evolving behavioral profiles to assess whether an agent is behaving as expected and whether its actions fit the customer’s historical intent. Help banks spot unusual agentic activity, assess potential misuse, and decide when to allow activity, restrict it, or require customer confirmation.

Explore Feedzai Digital Trust and give your bank the context to recognize agent activity and control access. 

Additional Resources

• Blog: Fraud prevention needs protection, too.
• Webinar on Demand: Continuous Adaptive Trust with Deloitte 
• eBook: How to Grow Digital Banking Without Increasing Fraud
• Solution Brief: Digital Trust