Why "is this a bot?" is the wrong question for 2026 and this is what African fraud teams should ask instead.

At 0241 hrs, an order comes through. The session is clean. No hesitation on the payment page, no back-and-forth between product pages, no abandoned cart before the successful one. Card details entered in one pass. Checkout completed in eleven seconds.

Two things could have just happened.

  • A customer delegated the purchase to an AI agent, and that agent did exactly what it was told to do.
  • Or a scripted session running on a virtual device in a farm of four hundred others just tested a stolen card against your checkout and got a green light.

Your fraud stack sees the same thing in both cases: a session with no human friction in it. And in most stacks built before 2025, "no human friction" resolves to one answer and that is “block it”.

That answer is now wrong roughly half the time. Which is a problem, because the other half of the time it is still very right.

The binary that broke

Fraud tooling was built on a comfortable assumption: humans are customers, automation is attack. Score the session for humanness, and you have your answer.

That assumption held for as long as the only reason to automate a checkout was to abuse it. It does not hold now. AI agents browse storefronts, compare prices, fill forms and initiate payment on behalf of real people with real intent and real money. Stripe's Agentic Commerce Protocol, Google's Universal Commerce Protocol and Visa and Mastercard's agent-payment rails all exist to make this normal. Legitimate, revenue-generating traffic is arriving with zero human motor behaviour attached to it.

So the real map has four positions, not two. Cross human present or not with authorised or not, and you get:

  • Human, authorised — your customer, at the keyboard, buying something.
  • Human, unauthorised — a fraudster, at the keyboard, using someone else's credentials.
  • No human, authorised — your customer's agent, acting on instructions they actually gave.
  • No human, unauthorised — a bot, a script, a device farm.

Most fraud stacks only measure the vertical axis. They can tell you whether a person was there. They cannot tell you whether the automation had permission. And permission — not humanness — is what actually separates revenue from loss.

What the numbers say

The shift is not theoretical, and the attackers arrived early.

Visa recorded a 25% rise in malicious bot-initiated transactions over a six-month window, with the United States up 40% (Visa, Agentic Commerce: Threats and Risks). Visa's Payment Ecosystem Risk and Control team also logged a 450%+ increase in dark web posts referencing "AI Agent" in the first half of 2026 and the chatter is not about building agents. It is about hijacking the delegated payment credentials agents carry (Visa PERC, H1 2026).

Akamai's 2026 research puts commerce at the centre of it, with bot activity climbing 63% in APAC and 48% in LATAM, and average daily phishing volume across commerce customers more than doubling between February and April 2026 (Akamai, State of the Internet, July 2026).

Meanwhile the defensive side is being hollowed out from the other direction. Agent-led checkout strips away the browser, device and behavioural signals merchants have leaned on for a decade. The session gets shorter, the product page is accessed directly, the device identifier is thin, and the purchase completes at machine speed. Every one of those was a fraud signal yesterday. Today, several of them are just what a good customer's agent looks like.

Why this lands differently here

There is a version of this conversation happening in New York and London that treats agentic commerce as a browser problem on a Shopify storefront. That framing does not transfer cleanly to this market.

In Kenya, automation will not arrive first as a shopping assistant on a desktop. It will arrive against mobile money flows, digital lending apps, wallet top-ups and account creation, the highest-velocity, lowest-friction surfaces in one of the most digitally saturated financial ecosystems on earth.

BCG's Nairobi office has been explicit about the risk: agentic systems could automate the entire fraud value chain, and the cost of running a scam may fall by 90% or more once they do. Toivo Hensgens, a partner at BCG in Nairobi, has warned that this would let criminals launch highly personalised attacks at a speed and scale that was not previously possible (BCG, August 2026).

The exposure is already measurable. TransUnion's H1 2026 fraud data puts account creation as Kenya's highest-risk stage, with a 4.5% suspected fraud rate roughly double the global figure and median consumer fraud losses in Kenya at KSh 108,482 (TransUnion, H1 2026 Top Fraud Trends). Kenyan authorities recorded 1,240 SIM-swap cases in the first half of 2026 alone.

Read those together and the picture is uncomfortable. The onboarding funnel is the weak point. The SIM is the re-entry point. And the marginal cost of attacking both is about to collapse.

Device farms are not a future threat in this region. They are current infrastructure. The change is that they are about to get an operator that never sleeps, never fat-fingers a form and adapts faster than a quarterly model refresh.

The device is the one thing that can't perform

A session can be dressed up. A face can be synthesised. A document can be forged convincingly enough to clear a template check. Behaviour can be replayed.

The device is harder, because a device is not a claim it is a record. It has a hardware profile, a boot state, a sensor stack, a network path and a history. An agent can decide what to say. It cannot decide what the silicon underneath it actually is.

That is where the classification has to happen. Concretely:

  • Integrity of the runtime. Emulators, virtual devices, rooted and jailbroken states, hooking frameworks, instrumentation drivers and headless browser artefacts. This is the difference between an agent running on a customer's real phone and a session running on a farm's hypervisor.
  • Farm topology. One physical host presenting as many devices leaves fingerprints: repeated entropy, sensor readings that never drift, battery and thermal curves that are impossible, clusters of "unique" devices sharing a hardware lineage.
  • Device reputation and continuity. Has this device transacted for this account before? How many accounts has it touched? How old is the association? A customer's agent inherits the customer's device history. A farm has none, or has too much.
  • Behavioural biometrics read correctly. Human input carries motor noise: tremor, curved pointer paths, typing rhythm with natural variance, pressure and accelerometer drift. Agents have none of it. But so do legitimate agents. So the absence of human behaviour is a classification signal, not a fraud signal. Its real value is in catching the third case automation deliberately engineered to fake human noise. Synthetic humanness is detectable precisely because real motor behaviour is messier than a model expects.
  • SIM and identity recency. A recent SIM swap sitting behind a clean device on a high-value transaction is a different risk object entirely, whoever or whatever is driving the session.

A framework you can actually run

Four questions, in order. Each one narrows the decision.

  • Is a human present? Behavioural biometrics answers this. Do not act on it yet. This is a label, not a verdict.
  • If not, is the automation declared or hidden? Known agent signatures, published agent identifiers, cryptographic attestation and bot-authentication standards separate automation that identifies itself from automation that is pretending. Hidden automation is the adverse signal not automation itself.
  • Is the device entitled to this account? Device intelligence and device reputation. A customer's agent runs on infrastructure the customer's account has a relationship with, or through a provider you can verify. A farm does not.
  • Does the action match the mandate? Transaction monitoring against scope. Value ceilings, category limits, velocity per device and per credential, delivery address changes, retry patterns. Delegated authority is bounded authority — enforce the boundary.

Then set policy per quadrant, not per session type. Human + authorised: pass. Agent + declared + known device + in-mandate: pass, and instrument it. Agent + hidden + fresh device: block. Anything in between: step up, and step up on the identity, not the interface because there is no human at the keyboard to solve a CAPTCHA.

What to do in the next 90 days

Three things, none of which require you to have solved agentic commerce.

  • Stop treating non-human as adverse. Split the field. Log agent-attributed sessions separately from bot-attributed ones and measure their outcomes. You cannot tune a model against a category you refuse to acknowledge exists.
  • Instrument the device layer before you need it. Device intelligence you deploy after the incident is forensics. Deployed before, it is a control. The signals that will let you tell a customer's agent from a farm are signals you have to be collecting now to have any history to compare against.
  • Move the decision off the interface. CAPTCHA, liveness checks and friction-at-checkout all assume a person is there to experience the friction. As delegated commerce grows, controls that depend on a human being present degrade into controls that only inconvenience your customers.

The industry spent fifteen years learning to ask whether a human was on the other end. The question that matters now is narrower and harder: was this action authorised, and is the device carrying it out the one that has the right to?