Agentic AI has captured the imagination of the world for good reason. These systems can automate things that we could not do without human intervention. Like sending emails, replying to messages, arranging travel, monitoring inboxes, filling out forms, even having conversations. Agentic AI is really transformational for good purposes. It automates routine tasks, freeing up humans for complex decisions, and dramatically increasing productivity.
But turn it on its head and you’ll see the same capability that allows for productivity can allow for fraud at scale. The challenge for enterprises as they adopt AI agents in their workflows is no longer limited to detecting suspicious emailsor blocking malicious software. Organizations must also understand what these agents can access, what actions they can perform and how their activities can be monitored.
Consider what becomes possible when an unethical actor deploys agentic AI. In the past, devising financial fraud schemes was a lengthy process. But agentic AI could speed up financial fraud by coordinating multiple steps with less ongoing human intervention. An agent could send hundreds of victims fraudulent payment requests, each personalized and looking legitimate, with the style, timing and context of the writing matching the impersonated sender. The attacker does not generate each message separately. The agent can help do it at scale, making it easier to personalize and coordinate fraudulent communications across multiple targets.
Business Email Compromise (BEC) is evolving in a similar way. Rather than a criminal manually impersonating a CFO in emails to accounting departments, an agent could help out with the process autonomously. It can analyze an organisation’s public communications from its website, learn the CFO’s writing style, monitor available communication patterns for appropriate timing and then initiate or continue conversations. The agent may ask for wire transfers, or credential verification or sensitive files. Humans getting these emails may not notice anything suspicious because the writing looks real, the context is correct and the sender looks legitimate. When these activities are automated and coordinated acrossmultiple organizations, the potential scale of business email fraud increases significantly.
See how credential theft accelerates. An AI agent could assist in accessing accounts using credential stuffing (testing stolen passwords across multiple services). It is not necessarily a human manually trying passwords. Automated systems can test large volumes of stolen credentials, while AI agents could potentially coordinate subsequent actions. Once access is gained, an agent may read emails, identify financial accounts, contacts and business relationships, and gather information about the victim’s digital activities. This creates a risk that compromised access could be used not only to steal information but also to identify further opportunities for fraud or unauthorized access. The extent of such activity depends on the permissions available and the security controls in place.
Impersonation on a large scale is possible now. AI agents can have conversations on social media, messaging apps and forums, acting the part of a real person with real interests. It can gather information, develop relationships and build credibility. Then it might pivot to fraud, like loan requests, investment schemes and romantic scams, all seemingly from someone the victim has built trust with. The agent could be having many conversations at once, each one specific to the victim’s situation. This makes it all the more important that individuals and organizations verify identities and unusual requests independently, even if a conversation appears familiar or convincing.
And with the rise of agentic AI, automated social engineering may become more effective than ever. Instead of phishing emails created by humans, agents can help to generate hyper-personalized phishing content at scale. The message may contain information specific to the victim, such as occupation, hobbies or recent activities, to make it appear as though it was sent by someone who knew the victim. It increases the attack surface because every email, message or conversation could be an automated fraud, not a human-made attempt. Personalized phishing and automated social engineering existed before agentic AI, but the existence of autonomous systems could make coordination of these activities easier andadapt communications across different targets.
This is especially dangerous due to the combination of scale, adaptability and the difficulty of distinguishing malicious automation from legitimate activity. Traditional fraud detection looks for patterns in human behavior, such as unusual login times, strange locations, or irregular activity. But bot attacks can occur in time zones and spread their activities across multiple accounts and services. But automated activity isn’t invisible, by default. Prominent detection signals can include unusual access patterns, anomalous API calls, unexpected privilege use, abnormal transaction behavior and deviations from established workflows. The problem is how to correlate these signals and identify real automationfrom potentially malicious activity.
This threat is starting to be recognized by organizations. To detect malicious use of agentic AI, cybersecurity teams will require greater visibility into identities, access permissions, system interactions and actions taken across connected applications. Systems for detecting the misuse of agentic AIs will need to be able to recognize trends of autonomous agent behavior, and distinguish automated fraud from legitimate automated systems. As the threat landscape evolves, organizations will need to continually reassess their detection capabilities and fine-tune their security controls. Any particular detection capability or research finding must be supported by validated technical evidence.
For businesses, the answer has to be more than the identification of suspicious messages. Organisations need to apply the principle of least privilege, where AI agents and other automated systems are only given access to what they need to perform their assigned tasks. Multi-factor authentication, ongoing surveillance, and strong identity controls can help mitigate the risk of compromised accounts. High-impactactivities such as changing payment details, transferring large sums of money or sharing sensitive information should require independent verification or human approval. Organisations should also have clear details of agent activity, regularly review permissions and have a practice to suspend an agent when suspicious behavior isdetected.
The key takeaway message is not simply about specific threats, or technical defenses. It’s about recognizing that productivity automation has an opposite number: fraud automation. The same technology that enables legitimate efficiency can also be used to launch attacks on a scale never before possible. In the modern era of agentic AI, trust is something organizations and individuals must fundamentally rethink. This means that for enterprises, AI agents are entities that need identity controls, limited permissions, ongoing supervision and clear accountability – not simply productivity tools.
As AI agents become more embedded in enterprise operations, trust must be established at the level of identity, access and action. The challenge isn’t to stop legitimate automation, but to make sure that the technologies meant to boost productivity aren’t exploited to compromise security.
Authored by Govind Rammurthy, CEO & MD, eScan
