Agentic Threats in Banking: Separating Signal from Noise

Artificial intelligence covers a broad range of capabilities, from generating content to making recommendations and supporting decisions. Those capabilities do not necessarily involve taking action. Producing text or advice is fundamentally different from accessing an application, moving money or completing a task within a banking system.

An agent, by contrast, uses artificial intelligence to act toward a defined objective. It can plan and carry out a sequence of actions, interact with tools or external systems and adjust its approach as conditions change. Most importantly, these can all be done with limited human intervention.

Not all AI-enabled automation is agentic, and not all agentic activity is a new fraud technique. In banking, the risk depends less on the software label than on how the actor reaches a financial system and under what authority it operates.

Agentic activity is developing at different speeds, on different rails.

E-commerce already shows live use of agents that browse, select products and initiate purchases for consumers. In July 2026, Visa announced live agentic commerce transactions at participating European merchants, with agents acting within consumer-defined parameters.¹ That tells us something specific: agents are beginning to shop and check out on merchant sites, using card-payment infrastructure. It does not tell us that the same pattern is now the supported way to operate a retail-banking application.

Traditional banking has increasingly moved third-party access toward authenticated, consent-based, permissioned interfaces. Open Banking regimes such as PSD2, and equivalents elsewhere, put the emphasis on strong customer authentication, explicit consent, authorization and auditability.²

This is not a distinction between banks and merchants as types of firms. The same bank can stand behind an agentic commerce purchase as a card issuer and still face a different problem when activity hits its own online-banking session. The difference is the access path:

• A merchant checkout or card rail, where an agent may be invited to shop within set limits
• A bank customer interface, where unknown automation is typically treated as high-risk
•  A permissioned third-party interface, where access is supposed to carry identity, consent and a defined scope

AI can increase the scale, speed and adaptability of known operations: social engineering, impersonation, phishing and scams. Attackers can produce more variants, respond to victims in the moment and work across languages and channels with less manual effort.

The fraud type may already be familiar. What changes is its volume and adaptability. The immediate challenge is not simply to identify AI-generated content, but to recognize familiar fraud patterns operating at greater scale and adapting more quickly—including cases in which the customer still appears to approve the payment.

Browser automation, mobile automation, credential attacks, device manipulation and other non-human interaction are already in the landscape. AI can shorten the loop between attempt, feedback and adjustment.

That does not necessarily make it a new attack type, but instead a faster way to run attacks. Banks are already aware of probing, scripted sessions, credential and token abuse and device anomalies.

Behavioral, device, session and transaction intelligence therefore stay foundational. The near-term job is to keep those controls effective against more adaptive non-human activity, not to make “agent detection” the primary requirement.

Agents will be able to act for customers through authorized interfaces: comparing options, initiating payments and completing other tasks within defined permissions. That model is emerging first in e-commerce.

Traditional banking is in a different place.

A consumer agent may use a banking application if the customer provides credentials, but this is not yet a supported, low-friction or widely adopted legitimate channel. Banks typically treat such activity as high-risk automation rather than recognized agent access. Confirmed, stable, large-scale use of independent third-party consumer agents through customer-facing banking interfaces remains limited.

What does show up around banking today is narrower. Banks are beginning to operate their own first-party assistants. Licensed third parties already access accounts through regulated Open Banking frameworks. Fraudsters still abuse stolen credentials and tokens. None of those is the same as an independent consumer agent accepted as a recognized participant in the bank’s customer interface. That mature model—with clear agent identity, explicit delegation and scoped authority—is still emerging.

A bank-operated assistant paying a bill inside the bank’s own controls is not an unknown third-party agent driving the customer interface.

The expected threat in traditional retail-banking channels today is AI-amplified social engineering and more adaptive attacks on existing interfaces.

That includes sessions that still look like the customer because they are: the customer is on the phone or has been convinced to approve a payment. It also includes non-human interaction that should already be treated as automation, such as browser and mobile tooling, device anomalies and broken session integrity, whether anyone calls the tooling an agent.

Strengthen the controls that already address these patterns. Do not rebuild the fraud program around the assumption that independent consumer agents are about to become a normal, trusted presence in the banking front end.

Criminal automation will not wait for a regulated rail. That is why unknown front-end automation should remain high-risk. The case for a consent and accountability framework applies to authorized agents seeking to perform banking actions, not to criminal automation.

First-party agents operated by banks are already appearing inside bank-controlled environments. Independent third-party agents authorized to do banking are a different matter. That model should be expected to develop under regulation, with identity, consent, authentication and a defined scope, rather than by treating an unknown agent in the customer interface as a legitimate new user.

When that authorized model arrives, fraud detection does not become obsolete. It becomes more contextual. Alongside identity, device, behavior, session and transaction characteristics sits authorization.

A bank will need to know who or what is initiating the action, on whose behalf, under what authority, how consent was given, whether that authority is still valid and whether the action still matches the customer’s intended purpose.

A valid identity does not guarantee legitimate activity. A valid token does not guarantee legitimate intent. A customer can be manipulated into granting authority. Granted authority can later be used outside the purpose the customer understood.

The useful questions are not “human or agent?” They are:

• Who is acting?
• What authority do they have?
• What was the intended purpose?
• What action was taken?

The test is whether the action makes sense given the actor, the authority and the intended purpose.

Near term: keep investing in detection of automated attacks, compromised access, social engineering and anomalous transaction behavior. Those pressures are already here.

In parallel, start assembling the context needed for authorized participation as it becomes more common: agent identity, delegated authority, consent, access scope and the interface through which access was granted. Evaluate this context alongside the signals already in use.

The aim is not to forecast the exact shape of agentic banking. It is to avoid designing controls around a commerce pattern that does not yet apply to banking while remaining prepared for authorized agent access to mature.

The practical requirement is to identify the threat in front of the bank and apply controls suited to that threat.