Feedzai expands Digital Trust to help banks detect AI agents
For the head of fraud at a regional bank
Feedzai said in a press release on Nov. 12 that it expanded its Digital Trust solution to help banks detect AI agents accessing customer accounts.1
Feedzai said a successful login does not mean a session can be trusted, because AI agents can sign in with valid credentials and criminals exploit compromised devices, account recovery and social engineering.1 The release rests on stronger device persistence, a fraud score built on Feedzai's network view and shared intelligence, and cryptographic device binding that links the customer, their device and the bank.1
Digital Trust combines endpoint, device, behavioral and network signals to assess risk before login and throughout the customer journey, and identifies agents by pairing the signals they declare about themselves with device fingerprinting and behavioral signals, Feedzai said.1
Once an agent is recognized, banks can trust returning user-agent relationships and skip further challenges where their policies allow, while keeping control over which agent activity is allowed and how customer consent is handled, according to Feedzai.1
Feedzai said a trusted device can act as a possession factor to reduce reliance on SMS one-time passcodes, and that Digital Trust protects passkeys by confirming a registered device is present and checking it for signs of compromise or social engineering.1
Feedzai reported its own results: 44% more fraud detected using shared signals in the highest-risk 0.1% of sessions with no increase in false positives, 6,000 fewer unnecessary authentication challenges per million logins compared with competing technology, and 41% fewer SMS one-time passcodes; the press release did not describe how these were measured.1
Gartner's Vatsal Sharma said 95% of banks use MFA, with SMS one-time passwords the most commonly cited method by Gartner clients, and that social engineering, SIM swapping and phishing can bypass such MFA.1
Banks that expect customers to use AI agents will need to tell a customer's own agent from a malicious one, and Feedzai's pitch is device binding plus shared network signals. The performance figures come from the vendor and cover only the riskiest 0.1% of sessions, so banks should test them against their own data. The Gartner comment also points to a separate cost and risk in SMS codes that the device-binding approach is meant to reduce.
Feedzai said it will continue to expand its agentic detection capabilities in the coming months, without giving dates.1
Our take. A valid password now proves only that something knew the password. If your session controls cannot tell a customer's chosen agent from a fraudster's, you will either block your customers or wave in criminals, and SMS codes won't decide which.
Action. Fraud operations: Test whether login and session controls can tell a customer-authorized AI agent from a malicious one signing in with valid credentials.
From our records
Sources
- Primary sourceExpanded Digital Trust Helps Banks Detect AI Agents | Feedzai Feedzai
- Primary sourcehttps://support.feedzai.com/hc/en-us Feedzai
- Also reported byFeedzai helps banks detect AI agents accessing customer accounts Finextra
- Also reported byFeedzai expands Digital Trust to detect AI agents at banks FinTech Global