Banks are beginning to add AI agents to their fraud checks and access controls, as software acting for customers creates new questions about identity and permission. New tools from BioCatch and LexisNexis aim to identify agent activity, while an Okta and TrueFoundry integration offers a way to grant agents narrower, time-limited access.
Watch Desk analysis
What happened
Biometric Update reports that BioCatch has launched AiRE, which looks for signs of AI agents in digital sessions, including behavioural anomalies, synthetic inputs and agent infrastructure. BioCatch says nearly half of the agentic interactions it detected in customer sessions happened during account opening.
LexisNexis Risk Solutions has introduced what it calls Know Your Agent intelligence, intended to help businesses assess who an agent is acting for, whether it has permission and whether its behaviour fits that permission. The company says agentic traffic in its analysis of global digital transactions rose by more than 750% in the first half of 2026.
Separately, Okta and TrueFoundry are supporting the Cross App Access protocol. Their integration replaces broad, long-lived API credentials with short-lived tokens tied to a user’s Okta identity and limited to a specific task. Security teams can revoke access and keep an audit trail. Biometric Update says Cross App Access is included in Okta workforce SSO plans at no additional cost, and the TrueFoundry integration is available through the Okta Integration Network.
Why it matters
An agent that can open accounts or initiate transactions needs more than a login. A bank also needs to know who it represents, what it is allowed to do and whether its actions fit that authority. The new offerings tackle different parts of that problem: detection, risk assessment and tightly scoped access.
The figures on attacks and rising agent traffic come from company and industry research cited by Biometric Update, rather than a universal measure of agent activity. Still, the practical shift is clear: organisations are starting to treat AI agents as a distinct kind of actor in financial systems, not simply another human user or familiar automation script.
Our read
This is a useful move from “agents are coming” to the less glamorous business of deciding which ones can do what. Short-lived, task-specific credentials are a more concrete control than a sweeping promise to govern AI responsibly. But detection and access controls are only useful if they work across the systems agents actually touch, and if someone can understand the audit trail when things go wrong.
What to watch
- Whether banks adopt these tools and publish results from real deployments.
- How accurately agent-detection systems distinguish legitimate agents from malicious activity.
- Whether task-specific access becomes common beyond the Okta and TrueFoundry integration.
Discussion spark: Should banks block AI agents by default until they can verify who authorised them, or is task-limited access enough to let them operate?
Sources and evidence
- Source update (11 November 2026, 12:46 UTC)
Watch Desk is operated by WittyWires as an independent cross-cutting AI news tracker. It does not speak for the organisations or people it covers.