Feedzai has expanded its Digital Trust solution to help banks identify AI agents accessing customer accounts.
The update is designed to give banks a single view of risk across cybersecurity, identity, and fraud, allowing them to determine whether a human or an AI agent is behind each digital banking session. According to Feedzai, the expansion lays the groundwork for agentic detection at scale and rests on three components: stronger device persistence, a fraud score based on the company's network view and shared intelligence, and cryptographic device binding that links the customer, their device, and the bank.
The company states that these components also deliver value independently of agent detection, helping banks remove unnecessary step-up authentication, lower authentication costs, and strengthen protection against multi-factor authentication (MFA) bypass.
Feedzai's update is built on the premise that a successful login does not necessarily mean a session can be trusted. AI agents can sign in using valid credentials, while fraudsters exploit compromised devices, account recovery processes, and social engineering to manipulate genuine customers. To address this, Digital Trust combines endpoint, device, behavioural, and network signals to assess risk before login and throughout the customer journey.
A further challenge is that personal agents and malicious agents can appear very similar. Feedzai positions the update as a way for banks to distinguish between the two, blocking unwanted agents while allowing those that customers choose to use.
How agent detection works
Persistent device fingerprinting and network signals are used to recognise returning activity over time. The risk score draws on Feedzai's network view and shared intelligence to surface signals that a single institution might not detect on its own. Cryptographic device binding ties each session to a known customer and device, giving banks visibility into whom an agent is acting for.
The solution identifies agents by combining the signals they declare about themselves with device fingerprinting and behavioural indicators of automated activity. Once an agent is recognised, banks can trust returning user-agent relationships and avoid repeated challenges where their policies permit, while retaining control over which agent activity is allowed and how customer consent is managed. Feedzai has said it will continue to expand its agentic detection capabilities in the coming months.
Reducing reliance on SMS one-time passcodes
Beyond agent detection, the release addresses human authentication. Through cryptographic device binding, a trusted device can serve as a possession factor, reducing banks' dependence on SMS one-time passcodes (OTPs) and the associated cost and risk. Digital Trust also protects passkeys against bypass attacks by confirming that a registered device is present and checking it for signs of compromise or social engineering. This protection covers login, account recovery, new device enrolment, and call centre authentication linked to a digital session.
The focus on OTPs reflects wider concerns across the banking sector. According to Gartner, 95% of banks use MFA, with SMS-delivered OTPs the method most frequently cited by its clients. A Gartner analyst noted that tactics such as social engineering, SIM swapping, and phishing can bypass these methods, creating a false sense of security and requiring layered controls.
Feedzai reports that the use of shared signals resulted in 44% more fraud detected within the highest-risk 0.1% of sessions, with no increase in false positives. The company also cites 6.000 fewer unnecessary authentication challenges per million logins compared with competing technology, as well as a 41% reduction in SMS OTPs.
