Bot detection, behavioural biometrics, CAPTCHA, OTP and 3D Secure all break at the same time — and for the same underlying reason. Understanding that reason tells you what’s left to build on.
E-commerce spent a decade building walls against bots. Now the bots are the customers.
One developer documented what that contradiction looks like in practice: he gave an AI agent a small budget and told it to buy a gift, and hit five separate security layers inside a single purchase flow — CAPTCHAs, bot detection, payment verification, address validation, fraud scoring. Nobody designed for a world where automated traffic is the traffic you want to convert.
The reflex response is to treat this as a tuning problem. Loosen the bot rules. Whitelist the known agent user-agents. Move the CAPTCHA further down the funnel. That response misreads the problem, because the failure isn’t in any individual signal. It’s in the question all of them were built to answer.
Every pre-auth signal answers the same question
Device fingerprinting, behavioural biometrics, CAPTCHA and step-up authentication look like four different technologies. Functionally, they’re one. Each is a proxy for a single question: does this session look like a human behaving normally?
That was a reasonable proxy for twenty years, because every legitimate buyer was in fact a human at a browser. The proxy and the real question — is this purchase legitimate? — pointed the same direction, so nobody had to distinguish them.
Agentic commerce pulls them apart. The human authorises; the machine executes. The purchase can be entirely legitimate while the session looks nothing like a person. Every tool built on the proxy inherits the same failure at the same moment.
Device fingerprinting and bot detection
Fingerprinting assumes a stable device with a history. Agents running from cloud infrastructure rotate hardware signatures, so there’s no consistent device to profile. Agents running in real Chrome on residential IPs present a clean, entirely convincing fingerprint.
The harder problem is that a legitimate shopping agent and a malicious one are indistinguishable at the network layer. Fraudsters have noticed, and use legitimate agent infrastructure as cover — which produces the worst possible outcome: attackers pass, and real customers get flagged instead.
Behavioural biometrics
Behavioural analysis reads mouse trajectory, scroll cadence and keystroke rhythm. Non-human actors don’t generate any of it, and the signals that make behavioural detection powerful — patterns produced live across a session, hard to fake — simply have nothing to read.
Vendors are adapting by scoring the shape of automation rather than its absence. But the session model itself is changing faster than the scoring. A shopper browses manually, asks an assistant to compare options, hands off checkout, then takes control back. Person and agent no longer occupy separate sessions. A percentage-of-automated-requests score describes that session without telling you anything useful about it.
CAPTCHA
reCAPTCHA v3 doesn’t show a puzzle — it silently scores mouse movement, typing cadence, session timing and interaction history. An agent with precise non-human timing and no cookie history on your domain scores high-risk and is rejected before the form submits. One 2026 benchmark put a leading model’s pass rate at roughly 60%, which would mean four in ten agent checkout attempts dying at the CAPTCHA layer before they ever reach payment processing.
Then there’s the second-order damage. When an agent retries — invalid promo codes, repeated form submissions — merchant WAFs read it as a bot attack and blacklist the IP. If that agent runs from shared egress infrastructure, the block takes down every session from that IP across the merchant network. Users don’t see WAF mechanics. They see a broken shopping agent.
The emerging fix is cryptographic agent identity: Web Bot Auth, a draft IETF protocol now in preview inside AWS’s agent browser, gives agents verifiable identities so sites can stop treating all automation as hostile. It’s the right direction. It also authenticates the agent — not the purchase.
OTP and 3D Secure
3DS is the cleanest illustration of the whole problem, because its entire design assumes a cardholder is present to answer a challenge. An agent can’t read the SMS. It can’t complete a biometric prompt on someone else’s phone.
The frictionless path is supposed to cover this — the issuer authenticates silently on background data, no customer action required — but that path depends on the issuer’s risk assessment, and agent sessions look precisely like the ones issuers challenge. There’s a trap underneath it, too: merchants who route only their suspicious transactions to 3DS teach issuers to read a 3DS request as a fraud signal, and get declined harder for it. Signifyd’s data has North American merchants sending only a small fraction of transactions through 3DS at all — the population is pre-selected for risk.
“The protocols will handle it”
They’ll handle part of it. Since late 2025 a genuine stack has assembled: AP2 carries cryptographically signed Intent, Cart and Payment mandates as verifiable credentials, giving merchants a tamper-evident record of what the user authorised versus what the agent selected. ACP standardises the checkout handshake between agent and merchant. Visa and Mastercard have added network-level overlays that encode agent identity into the transaction record so disputes attribute correctly.
This is real infrastructure, and it solves attribution. It does not solve your decision at the moment of the transaction, for three reasons.
Adoption is partial and will stay partial. Agent traffic will keep arriving from surfaces that implement none of these standards, and merchants are integrating with several in parallel rather than betting on one.
The standards are still moving. AP2 was donated to the FIDO Alliance in April 2026. Visa’s on-ramp is deliberately protocol-agnostic because nobody knows which layer wins. That’s a healthy sign for the ecosystem and an unhelpful one for anyone who needs a decision rule this quarter.
Most importantly: authorisation is not legitimacy. A stolen card can produce a perfectly valid mandate. A cryptographic proof that a user instructed an agent to buy something tells you the instruction was real — not that the instructing party was entitled to that card, and not that the purchase won’t come back as a dispute. Friendly fraud in particular gets easier: “the agent bought it, I didn’t” is a defence that didn’t exist two years ago, and one already showing up in the wild when agents hallucinate discount codes and the final charge doesn’t match what the buyer approved. Juniper’s April 2026 research put trust ahead of every technical concern as the top barrier to agentic commerce — which is a polite way of saying nobody has solved this layer.
What’s actually left standing
Strip out every signal that requires a human present at authorisation and something still remains — it just sits on the other side of the transaction.
The account’s history. Delivery and fulfilment behaviour. Whether the goods are used, returned, or resold. Whether the accountholder — a person, reachable directly and asynchronously — confirms the purchase when asked. None of these depend on mouse movement, and none of them care whether a machine typed the card number.
That reframes the whole architecture. Instead of forcing a binary decision in the 400 milliseconds before authorisation, using proxies that agentic traffic has invalidated, you accept the transaction and keep evaluating it — verifying directly with the buyer when, and only when, actual risk appears. Verification stops being a gate at the door and becomes a conversation you can have at any point afterwards.
This is the model FUGU was built on, and it predates agentic commerce by years. Agents didn’t create that problem. They just removed the last excuse for pretending the old proxies still work.
The industry is about to spend a lot of money trying to rebuild “is there a human here?” for a world where increasingly there isn’t. It was never the right question. The right one — did a real person actually want this? — is answerable, and it doesn’t require anyone to be watching the checkout page.