Agents of (Small) Change | This Week in Fraud

Hello Fraud Fighters!

Two weeks ago, six banks asked who pays when an AI agent buys the wrong thing. This week American Express published the plumbing behind its answer. In other fraud-related shenanigans… fraud finds new merchants within a month, the Bitget hackers were inside for three weeks before they took a cent, the OCC wants community banks reporting payments fraud in real time and Microsoft Teams is about to start flagging deepfakes on your calls.

(Also. Please, please, do NOT take a photo of your credit card and drop it into Grok.)

Let's get into it.

Nick

On Oct. 13, American Express published its Intent Intelligence framework, the specification for capturing and authenticating what a customer told an AI agent to buy, before the agent buys it. Here’s a look under the hood… a “Create Intent API” records the customer's instructions and constraints (merchant, maximum budget, other preferences), and the customer authenticates and signs off on what the agent captured. Amex then issues an Intent ID and a Proof of Intent Token carrying the high-level constraints. The agent exchanges that token for a scoped payment credential it uses at checkout in place of the actual card number, and the Intent ID and token follow the transaction through authorization, fraud decisioning and disputes. Got that?

Amex's VP of Agentic Partnerships and Strategy, Hannah Bozian, said in TechCrunch that the approach pulls intent earlier into the transaction flow so risk gets caught before it happens. Her example: a customer asks for white Nike sneakers in a size 9, the agent tries to buy Adidas, and Amex can stop the purchase. This addresses the visibility gap the six-bank Building Trust in Agentic Commerce paper flagged last month, where issuers lack real-time access to what the customer actually authorized. Amex also told TechCrunch it hasn't seen agent-driven disputes rise yet, so this is infrastructure built ahead of the problem.

The framework completes a promise Amex made in April, when it launched its ACE developer kit and Agent Purchase Protection. If a cardholder authorizes an agent and that agent sends Amex authenticated purchase intent, Amex will protect eligible customers from charges caused by agent error. Read the fine print, though. The April release framed the protection as a future commitment with terms to apply, and two of the kit's five services (Agent Registration and Cart Context) were still in development. 

Amex can move this fast because it runs a closed loop as issuer, network and acquirer. The more complex four-party model is working the same problem through EMVCo's draft Intent Services framework, whose comment window closed Sept. 30, and through the banks' voluntary principles. The direction is consistent across all three: liability will follow whoever holds an authenticated record of what the customer asked for. Issuers and processors on Visa and Mastercard rails should be asking agent partners now whether they will capture, sign and pass intent, and how that record would hold up in a dispute. 

Merchants should note that a credential scoped to a specific intent is a much stronger dispute position than a stored card number keyed in by a bot.

Fraudio followed 3,923 merchants from their very first payment across more than 127.5 million transactions between January 2025 and April 2026, and found that 10.5% experienced fraud within 90 days. Among those hit, the median time to first fraud was 33 days, and one in five saw it in their first week. The per-transaction fraud rate ran 2.9 times higher during those first 90 days, and 82% of the fraudulent transactions looked unremarkable on amount, currency and payment channel alone.

The card networks are moving on the same window. Mastercard's Scam Merchant Monitoring Program, in effect since July, requires acquirers and payment facilitators to open an investigation within 72 hours when scam signals hit a threshold, with extra scrutiny for merchants with less than six months of processing history. A new merchant has no history of its own to compare against, so detection has to come from network and peer signals from day one, and a 72-hour clock leaves no room to wait for chargebacks to make the case.

Last edition covered how Bitget lost $387.5 million to spoofed transfers without a single private key being stolen. Now we know how the attackers got in. Investigations by SlowMist and Google's Mandiant found the attackers compromised two third-party security appliances using zero-day exploits, planted a web shell on one, moved laterally to the production wallet job server, and deployed a custom withdrawal tool. SlowMist traced the earliest malicious activity to Aug. 31, when a hidden script read a database password from an environment variable. The theft itself took about three hours on Sept. 25.

That's more than three weeks of dwell time, starting inside the tools meant to protect the environment. Custody reviews should treat security appliances as part of the attack surface, keep secrets out of environment variables on anything internet-facing, and monitor the appliances' own behavior. Bitget has since launched a recovery bounty paying 5% to anyone who helps recover or freeze the stolen funds.

Comptroller of the Currency Jonathan Gould announced a new tool on Oct. 6 that lets community bankers report suspected payments fraud involving OCC-regulated institutions directly to an OCC fraud task force, in real time. Speaking to community bankers in Minneapolis, he pointed to non-mortgage fraud reports in Minnesota more than doubling between 2020 and 2024, and called community banks the front line of fraud defense.

He also reminded banks of FinCEN's updated 314(b) fact sheet, which clarifies how institutions can share information about suspected fraud with each other under the PATRIOT Act safe harbor. For smaller institutions without large fraud-intelligence teams, the practical step is to register for 314(b) if you haven't, and route suspected payments fraud to the new channel. The value of both depends on how many banks actually use them. Watch this space…

Microsoft plans to let certified third-party providers analyze Teams meeting audio and video for signs of synthetic or manipulated media and send detection signals back into the meeting, with general availability targeted for November. A separate impersonation-protection feature will surface warnings about suspicious meeting organizers and participants. Microsoft is building the integration, not the detector, and hasn't named supported providers or published accuracy figures.

A deepfake alert is only useful if someone knows what to do with it. Before this ships, fraud and treasury teams should decide what happens when a flagged participant is the one approving a wire or changing vendor bank details, and make sure that decision doesn't rest on the person in the meeting making a judgment call.

This Week in Fraud is a publication for fintech operators, fraud teams, and risk professionals. Have a tip or story? Reply to this email or drop Nick Holland [email protected] a note directly.