Agentic bots fuel fraud rise

Fraud attacks rose 8% worldwide in 2025, and LexisNexis says two things helped push the number up fast: fake people built from stitched-together data and software bots that now behave enough like humans to slip past old defenses. The company based that finding on more than 116 billion online transactions it analyzed across 2025. (prnewswire.com) The shift is not just more fraud. It is fraud that looks patient, consistent, and cheap to scale, because a criminal can now run software that opens accounts, tests stolen credentials, and imitates normal customer behavior without hiring a room full of people. (computerweekly.com; prnewswire.com) A synthetic identity is not a fully stolen identity. It is more like a counterfeit passport made from real scraps: a legitimate Social Security number, a different name, a fresh email address, and a phone number that has never raised alarms before. (prnewswire.com) That mix is useful to criminals because many fraud checks were built to catch obvious theft, not a brand-new “person” with just enough clean history to seem plausible. The result is an account that can survive onboarding, build trust slowly, and then be used for payment fraud, promotional abuse, or account takeover support. (computerweekly.com; cyberriskleaders.com) LexisNexis says synthetic identity fraud was especially prominent in Latin America, where it made up 48.3% of reported fraud, while first-party fraud stayed dominant globally at 38.3%. That regional split matters because it shows companies are not facing one universal fraud pattern anymore; they are facing local mixes of abuse that need different controls. (prnewswire.com) The other half of the story is the bot. An agentic bot is software that does not just hit a login page over and over; it can make decisions midstream, adapt to prompts, and follow the steps of a customer journey more like a person completing a task. (computerweekly.com; microsoft.com) LexisNexis reported a 450% rise in “agentic” traffic in one year and an eightfold increase in human-initiated attacks that were assisted by bots. That suggests criminals are pairing human judgment with machine speed, which is often more effective than either one alone. (computerweekly.com; risk.lexisnexis.com) This is why security teams have started talking less about “users” and more about “identities.” A bank, retailer, or gaming site may have millions of human customers, but it also has software services, application accounts, automated scripts, cloud workloads, and now artificial intelligence agents all asking for access behind the scenes. (nist.gov; microsoft.com) Those software identities are often called non-human identities or machine identities. Microsoft describes them as identities used by applications, services, scripts, and artificial intelligence systems to access data and systems on their own, and Gartner’s workload identity category includes applications, services, containers, virtual machines, and artificial intelligence agents. (microsoft.com; gartner.com) The risk is simple: if a company knows how to hire, monitor, and fire employees but does not know how to create, limit, rotate, and delete software credentials, it ends up with digital keys scattered everywhere. Some of those keys belong to abandoned services, some have more access than they need, and some are never rotated after they are issued. (okta.com; microsoft.com) That is where machine identity and lifecycle management come in. The basic job is to discover every software identity, record what it can access, enforce least-privilege rules, monitor how it behaves, rotate or replace its credentials, and shut it down when it is no longer needed. (gartner.com; okta.com) The LexisNexis report lands at a moment when vendors are trying to turn that job into a formal security category instead of a side task buried inside cloud or identity teams. Gartner now treats workload identity management as a distinct market segment, and large vendors including Microsoft and IBM are publishing dedicated guidance and products around non-human identity control. (gartner.com; microsoft.com; ibm.com) What changed is the cost curve. A criminal used to need time, staff, and infrastructure to mimic thousands of customers; now software can do much of that work, and the same automation trend that helps companies run faster also gives attackers more identities to steal, impersonate, or abuse. (prnewswire.com; computerweekly.com; microsoft.com) So the headline is bigger than one fraud report. It is a sign that online trust systems built for a world of human clicks are colliding with a world of synthetic customers and autonomous software, and companies now have to verify not just who a person is, but whether the “person” is a person at all. (prnewswire.com; nist.gov; microsoft.com)