Automated traffic on a marketplace meant scrapers, card testers, credential stuffers. The playbook was simple: detect automation, block automation.

That playbook broke this year. AI bots made up 47.9% of commerce traffic on Akamai's global network in the second half of 2025. Adobe Analytics clocked AI-driven traffic to US retail sites up 4,700% year over year, and Visa expects millions of consumers to buy through an agent by the 2026 holiday season. Bad bots grew too, to 43% of holiday traffic from 31% (Radware).

Automated traffic is now both your fastest-growing acquisition channel and your largest attack surface. So the goal isn't a better wall. It's the confidence to say yes more often: faster checkout, higher limits, fewer interruptions for agents worth serving. That rests on knowing an accountable person is behind the request — on both sides of your marketplace.

The industry built rails first, identity second

The payments industry moved fast. Stripe and OpenAI shipped the Agentic Commerce Protocol. Mastercard launched Agent Pay. Visa followed with the Trusted Agent Protocol, built with Cloudflare and Worldpay.

Signing agent requests is real progress: it confirms the software is what it claims, which IP-based detection cannot.

But note the boundary. Under Cloudflare's signed agents program, the platform an agent runs on signs its requests — validating the platform, not the shopper directing the agent. The protocols can't tell you whether an identifiable person authorized the purchase, or whether the account belongs to anyone at all.

Three checks, on both sides of the marketplace

Is the agent what it claims? Signatures and trusted-agent frameworks answer this. But participation is voluntary, so unsigned traffic needs a graduated path, not a wall.

Is there a verified human behind it? Most stacks haven't built this layer, and on a marketplace it runs both ways. An agent shopping for an unverified buyer is an authenticated request with nobody accountable behind it. Automation running seller, host or driver accounts is the same failure on the supply side, where the cost isn't one chargeback but every buyer who stops trusting your listings.

Is this action authorized now? A standing instruction to reorder groceries isn't permission to ship $4,000 of electronics to a new address.

Answer only the first and you have verified the courier, not the sender.

Fraud is already targeting the identity layer

Fraud follows the path of least resistance, and that path runs through accounts, not protocols.

Veriff's Identity Fraud Report 2026 found impersonation behind more than 85% of observed fraud attacks, and digitally presented media 300% more likely to be AI-generated or altered year over year. E-commerce's net fraud rate hit 19.2%, close to five times the global average.

Document forgery declined. Fraudsters aren't perfecting fake passports; they're becoming someone real and letting automation handle volume. One-time onboarding checks don't survive that: accounts get sold, shared and taken over long after the check passes.

What agent-ready looks like

  • Audit your unverified population, buyers and sellers both. The share never identity-verified is your agentic exposure.
  • Bind agent activity to a verified person, not just an authenticated session.
  • Make verification re-runnable. Biometric re-authentication at moments of consequence costs a real customer seconds and a fraud ring its economics.
  • Measure agent traffic separately — track approvals and false rejections apart from human traffic, or you can't tune either.

A wrongly blocked agent is an abandoned basket that never shows up in a fraud report, it just routes your customer to a competitor. As one customer told Veriff CTO Hubert Behaghel: "It's 10 times a bigger business concern to reject a good person than to let a fraudster through." At marketplace scale, a false rejection rate that looks like a rounding error puts thousands of people on the phone to support.

Verified identity turns agentic traffic from a threat you screen into a channel you serve. The version of fraud prevention that shows up in revenue.

About Veriff: Veriff verifies identities across 12,500+ document specimens from 230+ countries and territories, with an average decision in six seconds and biometric re-authentication throughout the account lifecycle. For more on why anonymous accounts are the structural weak point in agentic commerce, read Agentic AI and e-commerce fraud or book a demo.