The holiday shopping season has already started. Has fraud prevention kept up?
JP Blaho, Senior Product Marketing Director
Fraud teams once planned around a familiar calendar: activity climbed in November and peaked from Thanksgiving through Cyber Monday. That calendar no longer reflects how people shop—or fraudsters operate.
This year, Amazon’s Prime Big Deal Days fell in October. Walmart’s event runs in October, while Target Circle Deal Days overlaps Amazon. The signal is clear: holiday shopping starts now, not on Black Friday.
For Entersekt, the implication is clear: when customer behavior changes, authentication and fraud prevention must change with it.
Yesterday’s patterns cannot define today’s risk
Fraud follows opportunity. Criminals will not wait when stolen credentials, valuable inventory and urgency arrive weeks earlier.
Fraud systems learn from purchase times, velocity, order value, device behavior and seasonal baselines. Those signals change when genuine customers shop earlier, visit unfamiliar merchants, purchase rapidly or ship to new addresses.
The result is model drift. A late-night purchase or transaction burst may reflect a motivated customer—not an attacker. Systems anchored to last year’s behavior risk missing new fraud while falsely declining good customers. Historical data remains useful, but its assumptions can become obsolete quickly.
Those decisions matter beyond fraud losses. Entersekt’s 2026 State of Digital Banking Security survey of 483 U.S. consumers found that more than 90% consider security a top factor when choosing a financial institution, while 43% would consider leaving based on its authentication methods. Yet 46.7% said their institution uses SMS one-time passwords, while only 18.2% considered them most secure.
Authentication is part of the customer experience—and a competitive differentiator.
The threat is also growing. As the season expands, so does the window for card testing, account takeover and promotion abuse.
The next legitimate customer may be an AI agent
Agentic AI complicates the picture. Shopping assistants can now compare sellers, track prices and purchase when customer-defined conditions are met. Mastercard reported that 42% of surveyed consumers used AI tools for gift buying, while nearly half of Gen Z and millennial respondents would delegate holiday shopping to an agent.
Imagine telling an agent: “Buy these headphones from a trusted seller below $200.” The transaction may occur at 3:00 a.m., seconds after a price change and at machine speed. It is authorized—but can resemble bot activity.
Human browsing cadence, mouse movement and navigation may disappear. Velocity may rise. One agent may transact across merchants, while merchants see many agents using similar infrastructure.
The question can no longer be simply, “Is this a human or a bot?” It must become, “Is this a trusted entity acting within the intent and authority of an authenticated customer?”
That distinction sits at the heart of Entersekt’s perspective on agentic commerce fraud. Secure agent-led commerce requires proof of identity, explicit delegation and transaction-level controls. Organizations must verify who authorized an action, what the agent could do and whether the transaction stayed within those boundaries.
The Entersekt report highlights the same distinction in authorized push payment fraud: a properly authenticated customer can still be manipulated into approving a fraudulent payment. Because the transaction appears legitimate, controls that confirm identity without evaluating transaction intent can miss it. Agentic commerce raises a parallel challenge. Authentication must prove not only who granted authority, but whether the agent’s action remained consistent with that mandate.
Fraudsters gain the same advantages
Automation is not reserved for genuine customers. Fraudsters can use bots and AI agents to test stolen cards, take over accounts, harvest promotions and purchase at machine speed. They can create convincing storefronts and reviews, then exploit urgency—or manipulate agents’ ranking logic—to redirect demand.
The most dangerous attacks will look ordinary. Fraudsters can rotate devices and identities, age accounts, stay below velocity thresholds and blend into promotional surges. New devices, gift addresses and rapid transactions give malicious activity camouflage. Static rules are easier to bypass when “normal” itself is changing.
Authentication must understand context and intent
This environment demands more than friction. Challenging every unfamiliar transaction would punish good customers, depress approval rates and create abandonment when organizations want to build loyalty.
The better approach is context-aware authentication: evaluating identity, device intelligence, behavior, transaction details and cross-channel risk in real time, then applying the right control at the right moment. Trusted activity should remain frictionless. Higher-risk actions should trigger proportionate, phishing-resistant step-up authentication.
For agent-led transactions, that context must expand to include the agent’s identity, the customer’s authenticated mandate, payment-token restrictions and evidence that the purchase matches the customer’s instructions. Authentication must validate transaction integrity—not merely the credential presented at checkout.
Fraud, payments, e-commerce and customer-experience teams also need a shared view of acceptable automation. Trusted-agent credentials, explicit spending limits and durable records of consent will become essential to authorization, liability and dispute resolution.
The holiday season is no longer a five-day sprint. It is a rolling, algorithmically influenced marketplace that begins earlier, moves faster and increasingly includes both human and machine shoppers. At Entersekt, we believe the organizations that succeed will be those that can recognize trusted intent in real time—even when the buyer no longer behaves like last year’s customer.
