Bot Fraud or AI Shopping Agent? How to Tell Good Bots From Bad at Checkout

Two kinds of bots grew fast at checkout last holiday season. DataDome saw malicious bot requests jump 135% in December 2025 compared with the year before. Traffic to retail sites from generative AI tools rose 693% last holiday season, according to Adobe.

The first number is bot fraud. Bots test stolen cards, break into customer accounts and drain gift cards, and they hit hardest during peak season, when real traffic is highest. The second number points to something new. An AI shopping agent buys for a real customer, with that customer’s card and permission. The total is still small, but it’s growing.

Both kinds of bots use the same checkout pages, and they can look alike. The usual fix is a rule that blocks automated traffic. That rule stops the fraud and turns away the customer who sent an agent. It checks whether a bot is there, not who sent it or what it’s allowed to buy.

Let’s look at what bot fraud looked like at its peak, why “block all bots” stops working, and the identity and behavior signals that separate a real agent from a bad bot. And, of course, we’ll explain why no single fraud tool sees all of those signals, and how to get them into one decision.

What is bot fraud?

Bot fraud is the use of automated scripts to commit payment or account fraud, like testing stolen cards, taking over customer accounts, or draining gift cards. It hits the same checkout and login pages your real customers use. That's why it spikes right when legitimate traffic peaks.

During peak season 2025, bad bots ran four main kinds of fraud:

• Card testing fraud. Bots run small authorizations to find out which stolen card numbers still work. The good ones get used for bigger purchases later.
• Account takeover fraud. ATO in digital commerce rose 24% during BFCM compared with earlier in 2025, and travel and ticketing hit a 2.36% ATO rate, according to Sift. Kasada watched ATO attempts nearly triple by Travel Tuesday.
• Stolen account resale. Criminals made at least $17.2 million selling stolen accounts between November and Travel Tuesday, per Kasada.
• Gift card fraud. A gift card balance spends like cash, so bots go straight for it.

Each one goes after something stored: a card number, a login, or a balance. Bots want the credentials your customers already saved with you.

Good bots vs bad bots at checkout

Good bots do tasks a business or customer has authorized, like search indexing, price monitoring, or an AI shopping agent buying on a customer's behalf. Bad bots act without permission to commit fraud, scrape data, or hoard inventory. Both kinds are automated. At checkout, identity and intent tell them apart.

The usual list of good bots covers crawlers and price checkers. Now there's a new one on it: the AI shopping agent. It's a good bot that pays.

Both kinds showed up in big numbers at peak. Kasada counted over a million bot checkouts from November 1 to Travel Tuesday. Automated checkout attempts on Cyber Monday ran 2.8 times the Black Friday level.

On the other side, AI and agents influenced 20% of global Cyber Week orders and drove $67 billion in sales, according to Salesforce.

Why "block all bots" stops working

A "block all bots" rule made sense when every bot at checkout was up to no good. That's changing. In Spreedly's State of Checkout 2026 consumer survey, 36% of shoppers said they'd let AI spend money without their approval, at least for small purchases.

The agents doing that shopping often run in headless browsers on cloud servers. Bot defenses are built to block exactly that profile. So a blanket rule against automation turns away a customer who chose to send an agent. The fraud report logs it as a blocked bot, and the sale is gone. If agentic commerce is on your 2027 planning list, a bot rule written for 2020 traffic gives you a bad answer.

What separates an AI shopping agent from a bad bot?

A legitimate AI shopping agent carries proof of who it is and what it's allowed to do. That proof includes a verified agent identity, a tokenized credential with the customer's mandate attached, spend limits, and a known customer behind the request. A bad bot carries none of it, so behavior and velocity signals still decide those cases. You end up checking two groups of signals.

Know your agent: identity and intent signals

Know your agent is the agent version of KYC. Before an agent pays, you confirm four things:

• Verified agent identity. The agent can prove which platform sent it.
• Tokenized credential plus mandate. The card is a token, and the customer's instructions travel with it.
• Spend limits. The customer set a ceiling, and the agent stays under it.
• A known customer. A real account holder is behind the request.

Behavioral and velocity signals

Traffic that shows up with no identity gets the tests you already run: request velocity, bursts of low-value authorizations, and device and session patterns. Those are still the right checks for card testing and account takeover.

Payment networks and AI platforms are building this proof into their standards. Visa's Trusted Agent Protocol, Mastercard Agent Pay, OpenAI's Agentic Commerce Protocol, and Google's AP2 each send agent identity or mandate data along with agent traffic.

Why one fraud tool can't see the whole picture

The signals above live in four different places. The token and its mandate sit with whoever stores the credential. The card network holds the agent's identity. Your fraud provider holds the behavioral score, and your payments stack makes the routing decision. No single fraud tool sees all four.

Getting them into one decision is an orchestration job. Spreedly connects you to the fraud providers you choose and passes routing context into their decisions. One rule shouldn't run the same way on every gateway or every type of traffic. An agent with a verified mandate and a script hammering your login page need different handling.

Spreedly also secures stored credentials with Vault and network tokens, and Composer lets you set how each transaction routes. For agent traffic, Spreedly supports the emerging standards with mandate enforcement built in.

Trust decides whether agents get to buy

Shoppers already know what's holding them back. In the State of Checkout 2026 consumer survey, 52% said fear of fraud would stop them from letting AI complete a purchase for them. Another 45% pointed to a lack of trust in AI companies, and 30% to a lack of transparency.

Blame is still up for grabs. Asked who they'd hold responsible if an AI purchase went wrong, 41% said the AI company, 13% the retailer, 9% the consumer, and 6% the payment provider. Nearly a third (31%) weren't sure. Whoever ends up with the blame, the checkout is still yours. Telling good automation from bad is your fraud strategy and your agent strategy at the same time.