IPQS Says Agent Authorization Alone Won’t Secure Agentic Commerce

Key facts

• Agent authorization establishes permissions. Businesses also need to assess whether the account, device or connection involved shows signs of fraud.
• IPQS gathers firsthand attack intelligence through a proprietary network of more than 100,000 honeypots across over 150 countries.
• Fraud risk assessments should support decisions across account creation, account access and transactions, not just checkout.
  
  

LAS VEGAS, Oct. 29, 2026 (GLOBE NEWSWIRE) -- IPQualityScore (IPQS), a fraud prevention and cybersecurity intelligence provider, today urged banks, fintechs and merchants to assess account, device and connection risk alongside AI-agent identity and authorization. An agent may have permission to act even when the account or infrastructure behind its activity shows signs of fraud.

The call follows September’s publication of Building Trust in Agentic Commerce by ASB Bank, Bank of America, Capital One, Commonwealth Bank of Australia, ING Group and NatWest Group. The banks’ principles include coordinated risk management and timely intelligence sharing across the commerce value chain. IPQS is calling for businesses to use firsthand attack evidence to help put those principles into practice.

IPQS directly observes malicious activity through a proprietary network of more than 100,000 honeypots across over 150 countries. The company owns and operates the network, which captures credential attacks, automated account creation, payment abuse and other malicious activity. Those observations give businesses evidence of attacks beyond what they encounter in their own traffic.

“The quality of an automated decision depends on the intelligence behind it,” said Dennis Weiss, CEO of IPQS. “Businesses should demand to know where their fraud data comes from, how current it is and what evidence supports it. IPQS operates its own collection network to observe attacks directly and put that intelligence to work. As businesses give AI agents more responsibility, the evidence behind their risk decisions becomes more important, not less.”

Firsthand evidence of fraud and abuse

The IPQS honeypot network includes decoy storefronts, simulated environments and other controlled endpoints that attract and record malicious activity. Those interactions reveal IP addresses, infrastructure, attack methods and behavioral patterns that inform detection and risk scoring.

Operating its own network gives IPQS control over how that evidence is collected, validated and incorporated into its intelligence. The company combines these observations with IP, device, email, phone and cyberthreat analysis. Additional inputs include crawlers, participating websites and suspicious-activity reports contributed through its Fraud Fusion™ customer intelligence program.

For businesses adopting agentic commerce, IPQS recommends examining where fraud intelligence comes from, how recently the underlying activity was observed and how it relates to the interaction being assessed.

“Fraud teams need to distinguish legitimate automation from abuse, not treat them as the same problem,” said Alexander Hall, Vice President of Fraud Strategy at IPQS. “An agent’s identity is one part of the assessment. Evidence about the account, device and connection helps teams decide when to allow an interaction and when to intervene. The goal is stronger detection without making legitimate users pay for it in extra steps.”

Assessing risk before, during and beyond checkout

IPQS recommends applying fraud intelligence across three workflows:

• Account creation: Evaluate IP reputation, proxy usage, device characteristics, and email and phone risk to identify suspicious registrations and contact details associated with abuse.
• Account access: Assess device, network and behavioral signals for evidence of automated login attacks, device manipulation and account takeover.
• Transactions: Add user, device and connection risk to transaction screening to help determine when additional verification, review or blocking is warranted.
  
  

IPQS delivers intelligence through APIs and integrations that support existing onboarding, authentication, payment and security workflows. Its risk assessments complement those controls. They do not establish customer consent or expand an AI agent’s permissions.

Learn more at https://get.ipqs.com/agentic-risk-banking.

About IPQS

IPQualityScore (IPQS) provides fraud prevention and digital risk intelligence to more than 3,500 businesses worldwide. Founded in 2011, IPQS analyzes IP addresses, devices, email addresses, phone numbers and behavioral signals to help organizations identify bots, fake accounts, account takeover, payment fraud and online abuse. IPQS supports real-time risk decisions across account creation, authentication, transactions and other digital interactions.

For more information, visit www.ipqualityscore.com.

Media Contact

Graham Kahr
IPQS
news@ipqs.com