What Is Agentic Fraud? AI Agents and Bot Attacks in 2026

Visa's Payment Ecosystem Risk and Control team spent the second half of 2025 watching underground forums and found something worth paying attention to: posts mentioning "AI Agent" rose by more than 450% compared with the previous six months. That figure measures conversation rather than deployed attacks. But the nature of the conversation had shifted. Attackers were no longer asking whether agents could run fraud operations. They were trading playbooks for it.

Agentic fraud is a category of automated attack where autonomous AI agents carry out multi-step fraud operations without a human directing each stage. The agent reads the environment it lands in, chooses its next action, and changes approach when something blocks it. Where a scripted bot executes a plan written in advance, an agent forms one as it goes.

That difference sounds academic until you look at what it does to attack completion rates. Multi-step flows have long been an effective filter against automation, because every additional step is another chance for a rigid script to break. An agent that reads the rendered page treats those steps as instructions rather than obstacles.

This article covers what agentic fraud is, how agents differ from the bots your defenses were built for, the specific attacks they run against websites, and the infrastructure that makes their traffic hard to separate from real visitors. If you are trying to work out whether this affects your site, start here.

What Makes an AI Agent Different

From Fixed Scripts to Decisions

A traditional bot runs one script for one task. Someone writes it, tunes it against a specific page, and deploys it. It works until the page changes.

An AI agent operates a browser and decides what to do with what it sees. It can scan a login form, submit a credential pair, read the response, recognize a rate limit, rotate to a different exit IP, and continue. Each step feeds the next. This works because agents drive full browser instances through automation frameworks rather than firing raw HTTP requests, so they interact with DOM elements, execute JavaScript, and render pages the way a visitor's browser does.

The gap shows up most clearly at the point of failure. A scripted bot retries the same broken request until it times out. An agent works out why the request failed and does something else. A renamed form field, a reordered checkout step, an extra confirmation screen: none of these stop it, because it re-reads the page rather than looking for a selector that no longer exists. The maintenance burden that used to limit bot operations, where every site redesign broke someone's tooling, largely disappears.

Chaining Steps Into Operations

The second shift is scope. A conventional credential stuffing bot has one job, which is to test pairs and log the hits. Somebody else picks up the successful logins later.

An agent treats a successful login as the beginning. It can enumerate what the account contains, identify stored payment methods or linked services, change the recovery address, and extract value, all inside the same session. The handoff between attack stages that used to involve a human, a spreadsheet, and a delay of hours or days now happens in seconds.

[1] INTERPOL Global Financial Fraud Threat Assessment, March 2026.
[2] Residential proxies explained: What Are Residential Proxies?

The Attacks Agents Actually Run

None of the attack types below are new. What changed is how far an attacker gets before something stops them.

Credential Stuffing and Account Takeover

Credential stuffing feeds leaked username and password pairs into a login form and records which ones work. The economics have always favored the attacker, since breach corpora are cheap and password reuse is common.

An agent changes what happens after a hit. Instead of writing the working pair to a file for later, it stays in the session and works out what the account is worth. It can check for saved cards, stored addresses, loyalty balances, or connected accounts that extend access further. It can update the recovery email so the real owner cannot reclaim the account, then move value out. This is what turns a list of valid credentials into an account takeover without a second operator ever touching it.

Step-up authentication still helps, but it filters less than it used to. An agent that hits an SMS or email verification prompt does not simply fail. It evaluates whether it controls a channel that can satisfy the prompt and, if it does, completes the step. Where a legacy script needed a human to intervene at exactly that moment, the agent handles it inline.

Fake Account Creation at Scale

Registration abuse used to be limited by how well a script could survive a signup flow. Multi-step onboarding, conditional fields, and email confirmation loops were reasonably effective filters, not because they were hard, but because they were varied.

Agents complete those flows. An agent can read a confirmation email from a disposable inbox, follow the link, fill profile fields with values that hold together, and pace its activity so the account does not look freshly minted the moment it is used. The result is a supply of plausible, aged accounts.

Those accounts then feed everything downstream: promotional and referral abuse, fake reviews, marketplace scams, spam distribution, and the resale market for pre-verified accounts on platforms with a waiting period.

Card Testing and Payment Fraud

Card testing runs small transactions against a checkout to find out which stolen card numbers are still live. The traditional defense is velocity-based, watching for bursts of small charges from one source.

An agent reads decline responses and adjusts. It can learn which amounts pass without review, which issuers respond differently, and when a step-up challenge triggers, then spread attempts to stay under whatever threshold it inferred. Visa reported a 25% increase in malicious bot-initiated transactions across six months, with the US seeing a 40% increase over the same period.

There is a complication here that does not exist with conventional bots. Legitimate agent-driven shopping traffic is arriving on commerce sites too, and blocking anything that looks automated will start costing real conversions. Distinguishing an authorized agent acting for a customer from an agent testing stolen cards is a genuinely harder problem than distinguishing a bot from a human.

The Infrastructure Behind Agent Attacks

Understanding why this traffic is hard to filter means looking at what it runs on.

Agents route requests through residential proxies, which are IP addresses that ISPs assigned to real households. At the network layer, a request arriving through one looks like a subscriber browsing from home. Blocklists built around datacenter ranges do not cover this traffic at all, which is why detecting it requires IP intelligence specifically mapped to proxy provider networks rather than generic reputation scoring.

The browser side is similar. Automation frameworks give agents control of genuine browser instances, so the fingerprint is authentic in the sense that there is a real browser producing it. The agent clicks page elements, runs JavaScript, and moves through forms much as a visitor would.

Put together, a single request arrives from a residential IP, in a real browser, at a pace that does not look mechanical. Each individual layer that a detector might check reads as ordinary. What remains detectable is the relationship between layers and the shape of the session as a whole, which is a considerably narrower target than defenders had a few years ago.

What the Data Shows

The scale of the shift is not theoretical. Several independent sources from late 2025 and early 2026 point the same direction.

Visa's PERC team observed the >450% rise in dark web posts mentioning "AI Agent" over the six months to November 2025. This tracks discussion volume rather than deployed agents, but discussion volume is a reasonable leading indicator of tooling maturity, and the content had moved past experimentation into operational detail.

INTERPOL's March 2026 Global Financial Fraud Threat Assessment found that AI-enhanced fraud is 4.5x more profitable than traditional methods. Speed is part of that, but the larger factor is how much one operator can now run. One person can supervise many concurrent agent instances, each running a full attack chain, where previously each chain needed hands-on attention at several points.

Visa's transaction-level figures make the same point from a different angle: that 25% increase in malicious bot-initiated transactions over six months, rising to a 40% increase in the United States. If you process payments, logins, or registrations, some share of that increase is arriving at your endpoints.

Why Defenses Built for Scripted Bots Come Up Short

Two structural problems explain why detection that worked well against scripted automation catches less of this.

The Signal Surface Is Narrowing

Bot detection has historically leaned on artifacts: headless browser traces, WebDriver flags, mouse paths no hand could produce, input speeds no person could sustain. An agent driving a properly configured real browser produces far fewer of these. Some remain, since automation frameworks leave traces unless deliberately patched, but the reliable ones are fewer each year and the effort to remove them is well documented.

Combined with residential proxy IPs, an agent's traffic can look ordinary at IP reputation, at browser fingerprint, and at interaction timing, taken one at a time. The detection surface that defenders leaned on through the last decade is genuinely shrinking.

What has not disappeared is the relationship between signals. Timing that is too consistent across a session, a request sequence no real browser flow would produce, or environment properties that contradict the declared user agent are all still observable. But reading them requires evaluating a session as a whole rather than matching against a list of known bad artifacts, and any defense that scores traffic on individual signals in isolation will miss more as agents improve.

Accumulated Trust Becomes a Target

The second problem concerns how trust is stored. Systems that grant standing trust through a cookie or a long-lived token create something worth stealing. If a "trusted user" token from an earlier session is enough to reduce scrutiny later, then capturing that token is a shortcut past the check. Whether it works in practice depends on how tightly the token is bound to the session and how strictly it is validated server-side, but the shortcut exists by design.

Profiles built up over time have a related weakness. When a system lowers risk scores based on accumulated behavioral history, that history can be cultivated. An operator with patience can run an account through ordinary-looking activity before using it for anything, and the profile that was supposed to indicate trustworthiness becomes an asset the attacker built on purpose.

This does not make persistent state useless. It means persistent state is a credential, and it deserves the same handling as any other credential: bound tightly, validated server-side, and never treated as sufficient evidence on its own.

What Effective Detection Requires

The pattern across all of this is that no single layer holds up alone. Agents defeat individual signals well. What they defeat less well is having to pass several independent checks at once, where evading one does nothing for the others.

That is the approach CaptchaFox takes. Browser environment analysis looks at whether the client is what it claims to be. Dedicated residential proxy IP intelligence, built in-house from proxy provider networks, catches traffic that generic reputation data reads as clean. Proof of work attaches a computational cost to each request, which is negligible for someone submitting one form and adds up across a campaign. Session-level behavioral analysis evaluates what is happening during the current request rather than trusting a profile assembled earlier. Because the architecture uses no cookies and stores nothing beyond the verification event, there is no accumulated trust artifact for an agent to capture or cultivate.

CaptchaFox runs on EU infrastructure in Germany with no data shared with third parties and no data used beyond bot detection, which keeps one vendor out of your data processing inventory. It is designed to meet WCAG accessibility requirements, since it relies on neither image recognition nor distorted text, so tightening your defenses against agents does not cost your users anything.

Agentic fraud is not a problem you solve once. Attack tooling will keep improving, and defenses that depend on a single signal will keep losing ground to it. Start your free trial and see how CaptchaFox handles the traffic your current setup is reading as human.