Fingerprint has released a Censuswide-conducted survey finding 79% of US financial firms have detected bots posing as AI assistants.
Fingerprint, a device intelligence company, has published its 2026 State of AI Traffic in Financial Services report, based on a survey of 300 financial services leaders in the US. The findings point to a gap between how confident institutions are in identifying AI-driven traffic and how well they can act on it at scale. While 95% of respondents said they are confident they can distinguish genuine AI assistants from spoofed traffic, 79% reported having detected a malicious bot or scraper that bypassed perimeter defences by impersonating a legitimate AI assistant or search crawler.
Detection tools built for the browser
The report links the issue to the shift towards what Fingerprint describes as a browserless, AI-native web, in which AI assistants and agents interact with systems directly over HTTP rather than through a traditional browser. Legitimate customers and fraudsters alike are deploying tools such as ChatGPT, Claude, and Gemini Spark, and this traffic increasingly reaches APIs without executing client-side JavaScript. Nearly all respondents (95%) said the volume of automated traffic interacting with their web properties and APIs had increased over the previous 12 months.
Stated preparedness contrasts with operational practice. Although 97% said they are prepared for traffic that does not open a traditional browser, 53% acknowledged relying on significant manual oversight and custom rules to manage it. Some 61% still use client-side JavaScript tags or native SDKs for bot and automated traffic detection, an approach that leaves visibility gaps when AI traffic does not run JavaScript. Only 26% reported full visibility into automated traffic that bypasses client-side JavaScript detection, and 43% verify traffic against authorised IP ranges or DNS in real time. Fewer than half (45%) said they both detect spoofed AI traffic bypassing perimeter defences and mitigate the incident in real time.
Dan Pinto, CEO and co-founder of Fingerprint, noted that legacy defences were designed for humans using browsers and basic bots. AI agents circumvent that model, which makes the central challenge establishing whether automated traffic is what it claims to be. The report notes that fraudsters are exploiting this by spoofing legitimate user agents and headers.
Compliance and customer retention concerns
The report frames unverified automated traffic as a compliance issue as well as a fraud one. Seven in ten respondents (70%) agreed they cannot guarantee consumer data privacy compliance if their security stack cannot verify automated traffic at the HTTP level.
Institutions are also cautious about blocking AI traffic outright. A further 40% said their primary concern is that inadvertently blocking a legitimate consumer AI assistant could lead users to switch to a competitor that permits AI tools. Financial institutions are therefore weighing two pressures: filtering out impersonation attempts while accommodating customers who use AI assistants to interact with their services.
Shifting investment priorities
Survey responses suggest security spending is moving accordingly. Around a third (32%) ranked real-time IP-range and DNS verification for AI provider networks as their top priority for the next year. Meanwhile, 46% said upgrading application security to support ‘edge-deployed, no-JavaScript required’ identification is a critical or high-priority project already planned or funded for the next six to 12 months.
Censuswide conducted the research between June and August 2026, surveying CISOs, chief risk officers, CTOs, and vice presidents and directors of fraud strategy, among others, across retail banking, fintech, wealth management, and investment banking. Censuswide follows the Market Research Society code of conduct and ESOMAR principles and is a member of the British Polling Council.
