Skyfire widens Forter fraud checks for AI-agent checkout
Skyfire has widened its Forter partnership so Know Your Agent tokens feed fraud checks on AI-agent checkout. The Jomashop pilot is the first named test.
Skyfire has widened its partnership with Forter so fraud checks on AI-agent checkout can read a Know Your Agent (KYA) token, rather than treating every automated buyer as a bot. Having followed agent checkout from card-network pilots to the merchant fraud stack, the split that matters is who is allowed to approve the order. Skyfire supplies the identity signal. Forter still makes the decision. That sits closer to Visa's deal for a behavioural-biometrics firm than to a new button on the till.
The release is narrower than the partnership language. On October 12, 2026, Forter wrote that automation-driven fraud had doubled over two months, and that several agents stay anonymous, so detection cannot rest on a single platform's declaration. Seven days later it said Fraud Management for Agentic Commerce now ingests Skyfire's KYA data beside existing risk data. The October 19 release says the checkout screen does not change. Its subheading says Forter accepts the tokens. The body says the module ingests them to enrich a decision. Only the second verb describes a product.
What the fraud check receives
The companies described a strengthened partnership that had raised checkout success on agentic traffic without introducing additional risk. Bot tools flag non-human browsing and heavy automation, which is also how a legitimate agent shops for a person. Fraudsters, they said, try to mask themselves as those agents. The announced fix passes KYA protocol data into a fraud decision the merchant already runs.
Forter said the tie would support higher authorisation rates and lower chargeback exposure, without extra friction on a legitimate agent purchase. Those lines are prospective, not a network scorecard. The quantified claim is demand: agentic orders across Forter's network have increased more than fourfold since August. FinTech Global reported the integration the same day. The same text says Skyfire's token carries verified identity and a tokenised card.
One pilot, and the gap it leaves
The only merchant named is Jomashop, a Brooklyn retailer of luxury watches, jewellery and accessories. Bot tools had blocked much of its agent traffic, the release says, and success on AI-agent checkout reached nearly 100% with no increase in chargebacks. There is no order count, no pilot window and no chargeback rate. A result that high, on traffic that was mostly blocked, fits a false block. It does not show the model catching the two attacks Forter named on October 12: a malicious agent using stolen credentials, or a takeover of a real agent's session.
"Our customers are starting to shop through agents, and we didn't want to be the reason a legitimate purchase was declined," said Osher Karnowsky, general manager at Jomashop, in the release.
Eran Vanounou, chief technology and product officer at Forter, said in the same announcement: "Agentic commerce fails if retailers can't tell the difference between an authorized buyer and a script trying to look like one." The release gives no false-decline rate for the wider book.
Rivals are scoring the agent already
Coverage of the announcement included no public comment from Signifyd or Sift. Riskified had already moved. Destination CRM reported on October 9, 2026 that Riskified's Agent Identity Risk Intelligence would identify the assistant behind an order and tie it to a consumer. Riskified said it would accept a verified agent credential when a platform presented one, and would still try to name the person when it did not.
"Agent protocols solve a real problem: Merchants need a secure way to let a customer's assistant act for them. What they don't solve is whether that customer should be trusted," Assaf Feldman, chief strategy officer, technology and co-founder of Riskified, said in that statement.
Skyfire's June 26, 2025 launch post already quoted Cyndy Lobb, chief product officer at Forter, on extending fraud prevention into AI agents. October 19 feeds KYA data into a named product. Baselayer's raise for Know Your Agent checks funds that signal as a product of its own.
The till does not move
Constructor's agentic checkout turns payment on inside an agent the retailer already sells. Skyfire and Forter leave the checkout screen alone. Merchants that do not run Forter get nothing new. Those that do still depend on the weight given to the token, not on the fact that a credential was presented.
One retailer's near-100% result on previously blocked traffic will not show whether that weighting holds as automated fraud rises with agent orders. The release does not say who pays if a verified agent buys the wrong item. That liability gap is the one this desk has tracked in agentic payments alliances that stay silent on the loss. A KYA token can sharpen fraud checks on AI-agent checkout and still leave the loss on the merchant that approved the order.
Reporting by Rick Steves. Filed 20 October 2026, 08:11 GMT.
Senior Reporter, Regulation and Fintech
Rick Steves has seen business and economics through many lenses. He joined the financial services industry in 2009, and has been a financial journalist since 2011.
