Socure's Agent Intelligence: Verifying the Human Behind AI Buyers
AI agent identity verification is here. Socure's Agent Intelligence ties AI shoppers to real people. Learn to stop bots without losing good agent orders.
Photo: Pixabay
On this page 7 sections
- What Happened: Socure Launched Agent Intelligence on Oct. 27
- Why AI Agent Identity Verification Matters at Checkout
- Good Agents, Bad Bots: Why Blanket Blocking Now Backfires
- Where Know Your Agent Fits With Visa and Mastercard Agent Programs
- "I Didn't Authorize That": Disputes on Agent Orders
- Questions to Ask Your Processor and Fraud Vendor
- What to Do Before Agent Traffic Grows on Your Store
Key takeaways
- Of Socure's three layers, only Agent Detection is generally available (Oct. 27, 2026). TrustScore is in beta, and Agent Credential is due in Q1 2027, according to Socure.
- Blocking every automated session now turns away paying customers. Set rules by what the session is trying to do instead of by "human or bot."
- A vendor trust score isn't a network rule. On its own, it doesn't change who pays for a fraud chargeback.
- Store agent signals with each order now, because it isn't yet clear whether issuers will accept them as dispute evidence.
Socure, a U.S. identity verification company, launched Agent Intelligence on Oct. 27, 2026. The suite detects AI agents in a website's traffic, scores whether each one should be trusted and links the agent to the verified person or business that authorized it. For online merchants, this means AI agent identity verification is no longer just conference talk: fraud vendors now sell it as a product. The fraud question at checkout now has a second half. After "is this automated?" comes "whose agent is this, and did they approve this purchase?"
Only one of the three pieces is generally available today, and news coverage of the launch focused on banks and large platforms, not small online stores. Small and midsize stores will probably get this technology through a fraud tool, gateway or processor rather than by signing up with Socure directly. Even so, you can decide now how your store treats agent traffic.
What Happened: Socure Launched Agent Intelligence on Oct. 27
Socure announced the launch in a press release on Business Wire, and The Paypers reported it the same day. Socure Agent Intelligence has three layers, and each is at a different stage:
| Layer | What it does | Status as of Oct. 27, 2026 |
|---|---|---|
| Agent Detection | Spots and classifies AI agents running browser sessions, whether or not they declare themselves, and names the agent when it can | Generally available inside Socure's existing Digital Intelligence product |
| Agent TrustScore | Scores the agent on identity, authorization and risk, returned as three separate results | Open to beta customers |
| Agent Credential | A W3C Verifiable Credential, issued through SocurePass, that ties an agent to a verified person or business | General availability planned for Q1 2027 |
Three details matter for merchants. First, Agent Detection gives a confidence score and reason codes instead of a yes-or-no answer. Socure's reason is that control of a session can pass between a human and an agent partway through. Second, Socure says that in controlled lab testing it identified named consumer agents, including Muse and Instinct, with 99.99% accuracy across 700 behavioral variables. That figure comes from the vendor's own lab. Nobody has tested it independently on live store traffic.
Third, the credential is the part designed to work across many sites. Socure says any site can check an Agent Credential without contacting Socure. The format also supports chaining, so trust carries over when one agent hands a task to another. TrustScore is built to score credentials from any issuer, plus agents that carry no credential at all. Existing Digital Intelligence customers can turn on Agent Detection immediately. The announcement didn't name any customers using Agent Intelligence yet. One trade outlet reported Q2 2027 for the credential, but Socure's own release says Q1 2027.
Why AI Agent Identity Verification Matters at Checkout
On a card-not-present sale, you never see the card or the person. Your existing checks only confirm the card data: the CVV matches, the billing address matches and the issuer approves. An AI agent using a customer's saved card passes every one of those checks. So does a fraudster's agent using a stolen card with the correct details.
Those checks can't tell you who is behind the agent or whether the purchase fits what that person allowed. Socure's product page builds every agent interaction around four questions: which agent is acting, who authorized it, what it's allowed to do and whether the action should go ahead. The person or business an agent works for is called the "principal." Socure and other vendors call this practice Know Your Agent (KYA). It answers those questions for agents, much as Know Your Customer rules do for people.
Merchants tend to overlook the authorization question. Say a shopper sets up an agent to reorder printer ink under $60. If that agent, or someone who has taken it over, buys a $900 laptop from your store, the card still goes through. TrustScore's authorization result is meant to catch exactly that: a real person's agent acting outside its permission.
Good Agents, Bad Bots: Why Blanket Blocking Now Backfires
Most fraud setups treat automation as hostile, and for years that made sense. Card testing, inventory scalping and account takeover all run on scripts. Banks still have that reflex. Biometric Update reported that Morgan Stanley has started blocking third-party agents and that JPMorgan, Bank of America and Citi are restricting them.
If your store blocks every automated session, you also turn away paying customers who shop through an agent. The bot vs. AI agent checkout decision works better as a range of responses than as an on/off switch. Here is one way to set it up, by what you see and by what the session is trying to do:
| What you see | Low-risk action (browsing, cart, reorder to a known address) | Higher-risk action (new card, new shipping address, gift cards, instant digital delivery) |
|---|---|---|
| Named agent that declares itself and has good identity and authorization signals | Allow | Allow, or add an extra check if the order is unusual for the account |
| Agent detected, identity unknown | Allow browsing; watch velocity | Add an extra check (for example, 3-D Secure) or hold for review |
| Automation pattern: many cards, many small authorizations, one device | Block | Block |
Digital products need the strictest rules. Gift cards, software keys and downloads are delivered instantly and are easy to resell, so you have no shipping window to catch a bad order.
Illustrative example. Assume a Shopify store with 4,000 orders a month and a $55 average order. Assume 1.5% of orders start coming through shopping agents: 4,000 × 0.015 = 60 orders, and 60 × $55 = $3,300 in monthly sales. A rule that blocks all automated checkouts gives up that $3,300 to stop card-testing attacks, which velocity limits would catch anyway.
A rule that lets every agent through invites those attacks. The table above lets you keep both the $3,300 and your velocity limits. These numbers are assumptions, not real data, so check your own logs to see how much agent traffic you actually get. For the attack side, our guide to detecting and stopping card testing attacks covers the patterns you should keep blocking.
Where Know Your Agent Fits With Visa and Mastercard Agent Programs
Visa and Mastercard have each announced plans for agent payments, which we covered in Visa and Mastercard's AI shopping agent plans. It helps to separate three layers:
- The payment credential. The network programs cover the card itself and how an agent presents it. Network rules govern this layer.
- The agent. Which software is acting and who runs it.
- The principal. Which verified person or business sent the agent, and what they allowed it to do.
Socure works mainly on the second and third layers. It says the suite works with any type of agent and any credential issuer. That's what a merchant needs, because you'll see agents from many platforms. Still, keep the categories separate. Socure's TrustScore is one vendor's product, not a network rule. A good score doesn't, on its own, change who pays for a fraud chargeback. Under network rules, liability shift is tied to specific authentication methods such as 3-D Secure, not to a third-party trust score. Our 3-D Secure 2 explainer explains how that works.
"I Didn't Authorize That": Disputes on Agent Orders
Agent orders blur dispute categories that used to be fairly easy to tell apart. Plan for three situations:
- A fraudster loads a stolen card into an agent. That's true fraud.
- A customer's own agent buys something the customer didn't expect, and the customer reports it as unauthorized.
- A customer regrets a purchase and blames the agent.
To you, all three look the same: a cardholder saying they didn't make the purchase. Your defense depends on what you recorded at the time of sale. If your fraud tool or gateway shows agent signals, save them with the order:
- The agent's name, if it declared itself or was detected
- Any credential it presented, and whether that credential checked out
- The score and reason codes
- Device and IP data
- Proof of delivery or download
Socure returns authorization as its own separate result. That points to the evidence likely to matter most: proof that the purchase was within what the principal allowed.
We haven't seen any public guidance on whether issuers will accept agent credentials as strong evidence in disputes, so ask your processor directly. Fraud disputes also count toward card network monitoring programs, so review Visa's VAMP fraud and dispute thresholds before you loosen any controls. If you're considering insurance-style protection, see our look at Chargebacks911's coverage for AI agent purchases.
Questions to Ask Your Processor and Fraud Vendor
You don't need a contract with Socure to act on this launch. You need clear answers from the companies already handling your checkout:
- Can your tool tell AI agents that declare themselves apart from other automation, and does it name the agent?
- Can I set different rules for agent sessions depending on the action, such as allowing a reorder but adding an extra check for a new card?
- When an agent session gets a 3-D Secure challenge, who receives it, and what happens if no person responds?
- Are agent signals saved with the transaction so I can use them when I respond to a dispute?
- Do you support the Visa and Mastercard agent programs, and when?
- Will you check third-party agent credentials, such as W3C Verifiable Credentials, once agents start presenting them?
If you're comparing tools, our guide to choosing fraud prevention tools for an online store covers the broader criteria.
What to Do Before Agent Traffic Grows on Your Store
Start with your own data. Pull a month of bot or fraud-tool logs and look at what you're blocking today: how many sessions, which rules triggered and whether any blocked sessions reached checkout with valid card data. If your rules block anything that isn't a person using a mouse, you may already be turning away agent orders.
Next, set your rules by action instead of by "human or not." Keep velocity limits and card-testing rules as strict as they are now. Add extra checks to the risky actions, especially instant-delivery digital goods. And make sure your gateway saves the session evidence you'd need for a dispute.
Then watch two things: Q1 2027, when Socure says Agent Credential becomes generally available, and when your processor rolls out the network agent programs. The open question is whether issuers will accept a verified agent credential as proof that the cardholder authorized the purchase. Until they do, the merchant still carries the risk.
For a second look at how your online payment setup handles automated traffic and authentication, request a free quote and a MannyPay specialist will respond within one business day.
Sources
- Socure Launches Agent Intelligence to Bind Every Agent to the Verified Human Behind It (Business Wire, Oct. 27, 2026)
- Know Your Agent (KYA): Socure Agent Intelligence (Socure product page)
- Socure launches Agent Intelligence to tie AI agents to verified humans (The Paypers, Oct. 27, 2026)
- Socure links AI agents to verified people and businesses (Help Net Security, Oct. 27, 2026)
- Socure launches Agent Intelligence to verify who's behind AI agents (Biometric Update, Oct. 2026)
- Socure Launches Agent Intelligence to Detect, Score and Credential AI Agents (ID Tech, Oct. 2026)
This article is for general educational purposes and is not legal, tax or financial advice. Card network rules and state laws change; confirm current requirements for your business.
