During the back-to-school shopping rush, malicious AI agents took advantage of seasonal deals and promotional campaigns to gather valuable intelligence — learning customer behavior, probing the limits of fraud detection systems and mapping payment and transaction workflows. Those same tactics that caused headaches for retailers in August are likely to resurface and intensify as the holiday shopping season approaches.
Holiday shopping is one of the biggest retail moments of the year, bringing a massive surge in online sales and consumer traffic — the kind of traffic that attracts fraudsters. As retailers roll out Black Friday deals and gift-seekers scramble to find the best discounts, AI-armed adversaries are blending into the digital background, ready to launch advanced attacks that target everything from promo codes to payment systems.
This holiday season marks what could be a pivotal time in retail — merchants must now navigate a landscape where the line between legitimate automation and malicious activity is much harder to discern. Retailers need to determine their readiness for when the surge hits and promotions and traffic are at their highest. The companies that recognize this and adapt their strategies now to this new digital reality are the ones that will come out on top.
AI Agents Targeting Ecommerce
For many retailers, this holiday season may be the first time they encounter AI agents in large numbers that shop, browse and interact with their ecommerce sites like real customers — and for many merchants, current detection methods are simply not enough to flag these suspicious users.
Advertisement
AI agents can exploit common fraud detection gaps across the entire ecommerce and digital ecosystem. For example, the anonymity provided by guest checkouts makes it difficult to link suspicious activities or stop repeat offenders across multiple transactions. Special offers intended to drive new account signups can also fall victim to fraud as agents create thousands of accounts to take advantage of discounts, systematically stack coupon codes and coordinate mass purchases of promotional items.
What makes these agents particularly dangerous is their ability to adapt: they continuously learn from their attempts and failures, refining their techniques over time. They also learn customer workflows and purchasing patterns so they can adapt their behavior to act like legitimate buyers, making it even more difficult to detect and stop them.
Traditional Fraud Barriers are Failing
Current fraud prevention methods can cause negative experiences for real customers while barely slowing down sophisticated attackers. For example, CAPTCHAS, which are known to frustrate customers, can now be solved by AI models with 100% accuracy, while methods like multi-factor authentication create friction that can lead to cart abandonment, causing revenue loss from incomplete transactions.
Meanwhile, bad actors are finding more advanced ways to evade detection. For example, fraudsters are routing agentic traffic through residential proxies, making them look like legitimate users. This tactic, combined with AI agents’ ability to mimic genuine human behavior patterns, allows agents to fool many existing fraud detection systems and navigate sites undetected.
This means retailers must achieve a delicate balance of providing optimal customer experiences without sacrificing customer account security.
Smart Defense for Smart Attacks
Fighting sophisticated automation requires an equally sophisticated response. Completely blocking AI agents isn’t the answer because it would alienate legitimate customers using these agents to automate transactions, shop and find the best deals. Instead, the industry must evolve toward sophisticated identification strategies that distinguish between beneficial and malicious AI agents.
The most promising approaches focus on what AI agents cannot easily manipulate — the software and hardware signals they emit, rather than the behaviors they are programmed to do.
Retailers should be looking toward adaptive solutions that combine user behavior with browser details and other technical characteristics to provide advanced and accurate detection. Unlike purely behavioral patterns that agents can learn and refine, device intelligence analyzes the technical characteristics that are much more difficult to obfuscate.
Together, these characteristics provide a critical layer of risk analysis and resilience against evolving attacks. The goal is to trust but verify — allowing legitimate automation that enhances the customer experience while identifying harmful agents.
This comprehensive approach helps retailers accurately distinguish between legitimate customers and automated threats, protecting against fraud, increasing customer trust and reducing revenue loss during critical sales periods like the back-to-school rush and holiday shopping season.
Preparing for the Holiday Rush
Retailers that take time to reflect and strategically use the back-to-school rush to understand their vulnerabilities will be better positioned for success. Those that adopt comprehensive, adaptive detection strategies will enter the holiday season better prepared than those assuming current systems will scale to meet the growing threat of AI agents.
Dan Pinto is CEO and Co-founder of Fingerprint and brings over a decade of experience in tech. His career began in software engineering, where he developed an interest in creating bots, but he quickly shifted his focus to entrepreneurship. Pinto has founded many small startups, including Ebay stores, a tech blog and even a forum for TV shows. In 2014, Pinto co-founded Machinio, a search engine for used machinery, which was later acquired by NASDAQ:LQDT in 2018. After this success, he co-founded Fingerprint, which has raised over $77 million since its first funding round in 2020. Fingerprint currently employs over 100 people and is dedicated to solving the complex issue of online fraud.
