Fingerprint has released a report finding that 79% of US financial institutions have detected bots bypassing defences by spoofing AI identities.
US-based device intelligence company Fingerprint has published its 2026 State of AI Traffic in Financial Services report, which draws on a survey of 300 financial services leaders in the US. The research points to a gap between institutions' confidence in identifying legitimate AI traffic and their ability to mitigate spoofed traffic at scale. While 95% of respondents said they were confident they could distinguish genuine AI assistants from spoofed traffic, 79% reported having detected a malicious bot or scraper bypassing a perimeter defence by impersonating a legitimate AI assistant or search crawler.
Detection and mitigation gaps
According to the report, fewer than half of respondents (45%) detect spoofed AI traffic and mitigate it in real time. Only 26% said they have full visibility into automated traffic that bypasses client-side JavaScript detection entirely.
Part of the gap relates to the tools institutions continue to use. Three out of five organisations (61%) still rely on client-side JavaScript tags or native SDKs to detect automated traffic and bots, while 43% verify traffic against authorised IP ranges or DNS in real time. As more AI traffic operates without executing client-side JavaScript, the report notes, organisations relying on these methods risk missing spoofed AI assistant, agent, or search crawler identities.
The shift towards browserless traffic
Fingerprint frames the findings against a wider transition towards a browserless, AI-native web. AI assistants and agents interact with websites and APIs through a combination of direct HTTP requests and browser automation, and requests that do not run client-side JavaScript can create blind spots for JavaScript-based detection. Fraudsters, meanwhile, can spoof user-agent strings and other headers to pose as trusted AI tools and get past legacy defences.
The volume of this activity is rising. Nearly all respondents (95%) reported an increase in automated traffic interacting with their web properties and APIs over the past 12 months. Although 97% said they were prepared for traffic that interacts with their systems without opening a traditional browser, 53% acknowledged relying on significant manual oversight and custom rules to manage it.
Dan Pinto, CEO and co-founder of Fingerprint, said legacy defences were built for a web in which people used browsers that executed JavaScript, and that many AI agents operate outside that model. The task for institutions, according to the official, is now to establish whether automated traffic is what it claims to be.
Compliance and commercial considerations
The report positions traffic verification as a compliance matter as well as a fraud concern. Seven in ten respondents (70%) said they cannot guarantee consumer data privacy compliance if their security stack cannot verify automated traffic at the HTTP level.
At the same time, institutions are cautious about restrictive measures. Two in five respondents (40%) said their primary concern is that inadvertently blocking a legitimate consumer AI assistant could lead users to move to a competitor that permits AI tools.
This is shaping investment plans. Around a third (32%) rank real-time IP-range and DNS verification for AI provider networks as their top priority for next year. Almost half (46%) said upgrading application security to support 'edge-deployed, no-JavaScript required' identification is a critical or high-priority project already planned or funded for the next six to 12 months.
Taken together, the findings indicate that financial institutions are moving towards verifying automated traffic at the network and HTTP level rather than relying primarily on client-side detection, while seeking to avoid blocking the AI tools their customers use.
