Banking
Deployment record
In the tracker →- Organisation
- Feedzai
- System
- Digital Trust solution
- Stage
- Live
- Function
- detect AI agents accessing accounts
- 01Fraud and identity vendors are developing tools to help banks distinguish between human customers and AI agents accessing accounts.
- 02Feedzai, Trust Stamp, and Socure have launched products aimed at detecting and managing AI agent interactions with bank accounts.
- 03Banks like JPMorgan Chase, Bank of America, and Citi have restricted AI agent access due to concerns over unauthorized actions.
Show all 5Show less
- 04Socure reported a 1,700% increase in daily AI agent requests over the past year, indicating a significant rise in AI activity in banking.
- 05Industry leaders express concerns about liability and the need for new protocols to govern AI agent transactions.
Feedzai
Follow Deployed on Google
Fraud and identity vendors are building tools to help banks answer a new question: whether the customer logging in is a person or an AI agent acting on their behalf.
On November 12, Feedzai expanded its Digital Trust solution to help banks detect AI agents accessing customer accounts.
Two days earlier, Trust Stamp launched a product that requires customers to approve transactions started by AI agents with a live selfie. Socure launched its own suite of agent detection tools in late October.
"Personal and malicious agents can look very similar," said Pedro Barata, chief product officer at Feedzai.
What Banks Are Seeing
The launches follow an Axios report on October 22 that unvetted third-party AI agents had been detected inside customer accounts at US banks, often logging in with customers' own credentials.
Some agents attempted actions that appeared "independent of user instructions," according to the report, and bank executives said they struggle to tell agents apart or confirm whether a customer authorized them.
JPMorgan Chase, Bank of America and Citi have restricted AI agent access to customer accounts, according to Banking Dive.
"There's a lot of code reds going on in the banks right now," Socure CEO Johnny Ayers told Banking Dive.
Feedzai: Detection at the Front Door
Feedzai's update identifies agents by combining the signals agents declare about themselves with device fingerprinting and behavioral signals that reveal automation.
Banks can then recognize trusted agents and skip repeated authentication challenges where their policies allow, while still controlling what each agent is permitted to do.
The system assesses risk before login and throughout a session. It also uses cryptographic device binding, which links the customer, their device and the bank, so a registered device can serve as an authentication factor in place of SMS one-time passcodes.
Feedzai said its approach detected 44% more fraud in the highest-risk 0.1% of sessions with no increase in false positives, and cut SMS one-time passcodes by 41%.
The week's banking, insurance and brokerage deployments. Tuesdays.
Gartner analyst Vatsal Sharma said in the release that "overreliance on weak multifactor authentication (MFA) is prevalent," noting that 95% of banks use MFA and SMS one-time passwords are the most commonly cited method.
Trust Stamp and Socure
Trust Stamp's Knowing Consent takes a different approach, focusing on the moment an agent acts. When an AI agent or a bank initiates a transaction, the customer is prompted for a selfie through SMS, email, push notification or the bank's app.
Liveness and anti-spoofing checks confirm the account owner is present, and the approval applies only to that specific request.
"Trust Stamp's approach reflects the need for controls at the moment an AI-Agent acts," said CEO Gareth Genner.
More than 100 financial institutions are integrated with Trust Stamp's orchestration platform, and the company said implementation can take "a matter of days."
Socure's Agent Intelligence, launched on October 27, has three layers. Agent Detection, now generally available, identifies agents driving browser sessions whether or not they declare themselves.
Agent TrustScore, in beta, rates each agent on identity, authorization and risk. Agent Credential, expected in the first quarter of 2027, binds an agent to the verified person or business that authorized it.
Socure said it identified named consumer agents, including Meta's Muse, with 99.99% accuracy in controlled lab testing. It also said daily AI agent requests grew more than 1,700% in a year.
"Human traffic is going to look like a rounding error next to agent traffic very quickly," Ayers said.
Socure serves about 6,000 customers.
Ayers told Banking Dive he expects it to take about six months for lenders to set clear protocols for what agents can do, and said fraud, anti-money laundering and know-your-customer frameworks are not yet written for agents.
Bank executives have tied their caution to who is responsible when an agent acts. PNC CEO Bill Demchak said the industry is "years away" from giving AI agents control over transactions "because the liability framework is not set up for that."
Fifth Third, which blocks AI agents, has called for "know your agent" protocols similar to existing know-your-customer requirements, according to Banking Dive.
Last updated
