AI assistants and agents are quickly becoming part of how people interact with their banks, fintechs, and other financial institutions.
We commissioned a survey of 300 leaders across retail banking, fintech, wealth management, and investment banking to take a look at the trends and growth trajectory for AI traffic in financial services.
Here are some highlights from our new State of AI Traffic in Financial Services report, including how fraud and risk teams at these organizations are detecting, verifying, and responding to threats in AI traffic, and where the gaps are.
1. Automated traffic is on the rise across financial services
AI assistants and agents are increasingly being used on both sides of web activity, both for legitimate and malicious uses:
- Customers use them to summarize financial information, analyze portfolios, and query banking APIs.
- Fraudsters use them to scale attacks and impersonate trusted devices.
The increase in AI assistant and agent usage is clearly being reflected in the data: 95% of financial leaders said automated traffic has increased over the past 12 months.
2. Financial institutions are confident, but verification has room to grow
Almost every financial institution we surveyed (95%) is confident it can tell a genuine AI assistant from a malicious scraper or spoofed traffic. But only 43% verify traffic through authorized IP ranges or DNS in real time, while 52% verify only through checking basic headers.
That difference matters, as headers can provide useful information about a request, but they can also be spoofed.
Checking IP ranges or DNS helps confirm that a request actually came from the AI provider it claims to represent. Without that verification, fraudsters can borrow a trusted AI identity and make malicious traffic look legitimate.
3. Spoofed AI identities are already getting through defenses
79% of financial institutions surveyed have detected a malicious bot or scraper that bypassed a perimeter defense by posing as a legitimate AI assistant or search crawler.
These incidents are exposing financial organizations to a variety of different risks including automated script account takeover, competitive data scraping, leakage of customer data, account origination fraud, reverse engineering of APIs, and skewed marketing analytics.
4. Browserless requests still take manual effort for financial fraud teams
Many fraud defenses were built for people interacting through traditional browsers. But AI assistants and agents can interact with the web without opening a browser or running client-side JavaScript, which means browser-based detection may never see them.
Nearly all respondents say they are prepared to handle browserless traffic, but more than half (53%) said managing it still requires significant manual oversight and custom rules.
5. Visibility into automated traffic is limited
Only 26% of financial leaders say they have full visibility into automated traffic that bypasses client-side JavaScript detection.
This leaves fraud teams at financial institutions with a hard balancing act. They need to stop malicious automation without blocking the legitimate AI assistants customers are increasingly using today, and they need the appropriate context about each request to make the proper call.
Read the full State of AI Traffic in Financial Services report
AI-driven traffic will keep reshaping how both customers and fraudsters interact with financial platforms. As legitimate and malicious automation increasingly arrive through the same workflows, verifying what is actually behind each request is becoming a core part of fraud prevention.
The full report goes deeper into what happens after spoofed bots get through, which risks worry financial leaders most, what leadership fears about blocking legitimate AI assistants, and where institutions are putting their budgets over the next year. It also lays out three strategic priorities for improving AI traffic visibility.
Read the full State of AI Traffic in Financial Services report for all the findings and learn how Fingerprint’s AI Assistant Detection and AI Agent Detection capabilities help your team recognize and distinguish legitimate AI activity from spoofed traffic.
