If I ran fraud at a bank, here's where I'd start with AI agents

There's a lot of attention right now on AI agent detection and Know Your Agent (KYA).

It’s important, but I think we're spending too much time on identifying agents and overlooking what happens after we identify them.

Let's say you know an AI agent is accessing a customer's bank account. Now what?

You still need to figure out whether what that agent is trying to do is safe.

And to make things even more complicated, some AI agents are already deliberately trying to look like regular human users so they won't get detected or blocked.

I understand why some large banks are restricting agent activity for now. If I were in their position, I'd do the same. It's a reasonable short-term precaution.

But I expect agent detection to be a game of whack-a-mole for a long time. As detection improves, agents trying to avoid those controls will find new ways around them.

If I were leading fraud prevention at a bank, here’s how I would approach AI agents right now.

1. I'd focus on whether an action makes sense for the customer

This would be my first priority.

I'd want to know whether what an AI agent is trying to do makes sense based on what we already know about the customer.

And I'd want to be able to make that assessment even if I couldn't identify the agent.

Take payment scams, for example.

We already have situations where a legitimate customer gets manipulated into sending money to a scammer. The customer is using their own account, they've passed authentication, and they're authorizing the payment themselves.

Now imagine that same customer has an AI agent managing some of their finances.

The agent could be completely legitimate and have permission to make payments. But if the customer gets scammed and tells the agent to send money to a fraudster, the agent could follow those instructions exactly.

The bank still needs to recognize that something is wrong with the payment, regardless of if it was an AI agent or not.

And there are ways to do that.

You can look at the customer's transaction history, the person receiving the money, and whether there's evidence of a relationship between them in the physical world.

For example, at Incognia, we've built a physical social graph that uses historical location patterns and persistent device intelligence to identify evidence of real-world relationships between people. That can tell us something about whether a payment makes sense, even when the sender and recipient have never transacted before.

In our analysis of more than 300 million transactions, we found that:

• 79.2% of legitimate transactions showed evidence of a physical-world relationship between the sender and recipient
• 86.2% of reported scams showed no observed physical-world relationship between the parties

That's much more useful information for a bank trying to prevent fraud than simply knowing whether a human or an AI agent initiated the payment.

Of course, no single signal tells you everything. But when you combine this information with other fraud signals, you can get a much better understanding of the risk.

The same idea applies beyond payments. An agent might be trying to add a new beneficiary or change account information. The bank should be able to look at that request and determine whether it makes sense for the customer.

This is what we've been working on with Intent Intelligence at Incognia. It helps financial institutions assess the risk of actions proposed by AI agents using what they already know about the customers those agents represent.

I wrote more about Intent Intelligence here, if you're interested in how it works.

I'd put this first because banks are already losing a lot of money to scams involving legitimate customers. Improving how we assess these actions helps with a problem we have today, and it'll become increasingly useful as more people start using AI agents.

2. I'd stop relying on SMS and email OTPs to authorize new devices ASAP

This is something I'd want to address immediately.

A lot of banks in the U.S. still use one-time passwords sent by SMS or email to authorize new devices.

I've been concerned about these methods for a long time, and I think AI agents make the problem even more obvious.

Some popular AI agents have access to the customer's phone or email account. Depending on what permissions they've been given, they can read incoming messages, including authentication codes.

Think about what happens when an agent tries to access a banking account through a browser running in a virtual environment.

The bank doesn't recognize the device, so it sends an OTP to the customer's phone or email.

But if the agent can read those messages, it can potentially retrieve the code and complete the authorization process itself.

From the bank's perspective, the correct code was entered. But that doesn't necessarily mean the customer personally authorized the new device.

That's a pretty serious problem.

If I were responsible for authentication at a bank, I'd be looking at methods that are more closely tied to the actual customer.

There are two approaches I like.

The first is Trusted Locations.

This is something we've been working on at Incognia for years.

We use apartment-level location intelligence to learn the places a customer regularly visits over time. That gives us a way to recognize when a device is being used from a location that's part of the customer's normal routine.

And that can be a very strong signal of trust.

For example, when a customer needs to authorize a new device, a bank can use an established trusted device and its location history as additional evidence that the approval is legitimate.

It provides another way to verify the customer without depending entirely on a code that an AI agent might be able to access.

The second is biometric authentication.

I think biometrics can also be a good way to verify that a real person is involved in authorizing a device.

But you have to be careful here, especially with how good AI-generated deepfakes are getting.

You need strong liveness detection and, importantly, protection against injection attacks. Otherwise, someone could potentially use a manipulated image or video to bypass the biometric check.

Personally, I'd want to move away from SMS and email OTPs for new-device authorization as soon as possible.

We've needed stronger authentication methods for a while. With AI agents gaining access to more of the information on people's devices, I think that need is becoming even more urgent.

3. I'd limit what agents can do and let them earn trust over time

Even with stronger authentication and transaction-level risk evaluation, banks still need to decide what AI agents should actually be allowed to do.

Today, when a customer logs into their bank account (as a human), they generally have access to all the functions available to them.

But an AI agent is a proxy for a customer. I wouldn’t automatically give the same level of access to an agent.

My approach would be to start agents with very limited permissions and gradually allow them to do more as we build confidence in how they behave.

For example, when an AI agent connects to a customer's account for the first time, I might allow it to check balances or analyze transaction history.

That's relatively low risk, assuming the customer has authorized that access.

But I wouldn't allow a new agent to start moving money or making sensitive account changes right away.

Over time, the bank can start evaluating how the agent behaves. Is it staying within its permissions? Has it attempted anything suspicious? Is the customer consistently approving the requests that require authorization?

If the agent has a good history, maybe we can start allowing it to do a little more.

For example, the bank could permit small payments to recipients the customer has paid before, within limits the customer has approved.

If the agent wants to make a larger payment or send money to someone new, we can require additional authorization directly from the customer.

And as the agent establishes a longer history of appropriate behavior, the bank could consider allowing more activities, as long as they're within the customer's authorization and the bank's policies.

There are also some things I wouldn't allow an AI agent to do independently, regardless of how much trust it has earned.

Changing security settings, updating account recovery information, or adding authorized users, for example. I'd require the customer to handle those directly.

And I'd still evaluate every transaction for fraud, even if the agent has been behaving perfectly for months.

Because an agent that's been legitimate for a long time can still be manipulated into making a fraudulent payment.

I see this as a more sustainable approach than treating agent access as a binary decision where the agent is either completely blocked or allowed to operate with broad permissions.

4. I'd treat agent detection as an ongoing challenge

I would still invest in agent detection. I think banks need to know what's accessing their systems, especially if they're going to have different rules for AI agents.

But I wouldn't expect to identify every agent.

Some agents are already making themselves look like regular human users. They're using normal browsers and changing how they operate to avoid detection.

And I think we'll see a lot more of this.

As soon as you figure out how to identify a particular agent, it can change its behavior. Then you have to figure it out again.

I expect this to be a long game of whack-a-mole.

And there's a practical problem here.

Let's say your bank has a rule that AI agents aren't allowed to change account security settings.

When you identify an agent, you can enforce that rule.

But what happens if the agent manages to look like a regular customer?

You might never realize an agent is behind that request.

So you need other ways to protect those sensitive actions. You need to be able to recognize suspicious activity and verify that the customer is actually authorizing a change.

The same goes for payments. If an agent tries to send a significant amount of money to a suspicious recipient, I'd want my fraud controls to catch that, even if the system thinks it's dealing with a human.

That's how I'd approach agent detection. I'd absolutely want the capability, but I'd also prepare for the times when it doesn't work.

Fraud controls can't depend on detecting every agent

If I were running fraud at a bank, I'd want to know that our fraud controls could still protect customers when an AI agent goes undetected.

Can we recognize when a payment looks suspicious, even if the customer or their agent has authorized it?

Can we reliably verify the customer when someone tries to authorize a new device?

Those are the things I'd be looking at first.

We can already make meaningful improvements in these areas today. And I think those investments will become even more important as AI agents start doing more on behalf of banking customers.

I'd be interested to hear how you're approaching this at your bank. Are you focusing on agent detection, or are you also looking at changes to your existing fraud and authentication controls?

Reply and let me know.

Read more about the risks of authorized AI agents and what financial institutions should consider before giving them access to customer accounts.

Subscribe to The Signal: FinServ for more perspectives on fraud prevention and digital identity every other week.