Fraud detection today is built on a mountain of behavioral signals: mouse movements, keystroke rhythms, browsing history, and IP geolocations.
When an AI agent makes a purchase, all of these signals disappear. This is the Zero-Signal Problem.
What is the Zero-Signal Problem?#
Traditional fraud detection engines are designed to distinguish between a "legitimate human" and a "bot." In the era of agentic commerce, the bot is the legitimate customer.
The agent doesn't have a mouse. It doesn't "browse" the page. It makes API requests or interacts with a headless browser in a perfectly efficient, non-human way. If your fraud engine flags non-human behavior, it will flag 100% of your most valuable agentic traffic.
The Behavioral Void#
- No Browser Fingerprinting: Agents often use standardized headless environments.
- No Biometrics: Keystroke dynamics and mouse heatmaps are non-existent.
- Perfect Efficiency: Agents go straight from intent to transaction in milliseconds.
The Fraud Risk
Without behavioral signals, a malicious agent looks identical to a legitimate one. This opens the door for large-scale, automated sophisticated fraud that circumvents legacy defenses.
What Replaces Behavioral Signals?#
In the absence of human-centric signals, we must move toward Protocol-Centric Compliance.
Instead of asking "Is this a human?", we must ask:
- "Does this agent follow the AP2 (Agent Payment Protocol) standard?"
- "Is the intent consistent with the agent's historical evaluation profile?"
- "Does the transaction meet the verifiable constraints of the merchant's policy?"
Introducing AP2 Compliance#
The Agent Payment Protocol (AP2) is designed to include cryptographically signed intent and verifiable constraints.
json{ "intent": "purchase", "item_id": "sku_9921", "max_price": { "amount": 29.99, "currency": "USD" }, "signature": "0x7f...ac4", "protocol_version": "AP2-v1.2" }
At Faultr, we help merchants and agent-builders bridge this gap by providing adversarial testing for these new protocol-driven signals.
In the next part of this series, we'll explore Intent Verification and how it replaces the traditional "browsing" signal.