Know Your Agent for online stores
How to verify an AI agent before it buys from your store
Verifying an AI agent means confirming three things: the software is a real, registered agent, its request is signed and unaltered, and a verified person stands behind it. This is Know Your Agent, or KYA. The first two come from the agent's signature and network credentials. The third comes from verifying the person.
deepidv does not process payments. Your payment provider moves the money. deepidv proves who is on the other end: the agent, the person who authorized it, and whether they are allowed to buy.
What is Know Your Agent?
Know Your Agent applies the logic of Know Your Customer to software that shops, books and pays. It answers who built the agent, who it acts for, and what it is allowed to do. The payment networks are moving the same way: Ant International, Mastercard and Visa have begun work on a shared KYA framework for identifying agents across networks. deepidv's KYA verifies both sides: the agent making the request and the human behind it. Arc, deepidv's Know Your Agent gateway, is the MCP entry point agents use to request verification. A public agent identity registry, getai.id, is planned.
Signals that identify a real agent
Five signals identify a real agent: a signed request, a signing key listed in a network directory, a declared profile that resolves, a payment token scoped to that agent, and a platform registration. An impostor copies a known agent's name and skips the proof.
| Signal | What it tells you | Watch out for |
|---|---|---|
| Signed HTTP request (RFC 9421) | The request came from the key holder, and the parts it signed were not changed in transit | Missing or invalid signatures on traffic claiming a known agent name |
| Network directory listing | Visa's Trusted Agent Protocol ties signing keys to a directory of agents | Keys not found in the directory |
| UCP agent profile | Google's UCP requests carry a UCP-Agent profile header | Profiles that do not resolve or do not match the declared agent |
| Agent payment token | Mastercard agentic tokens are scoped to one agent and its limits | Tokens used outside their scope |
| Platform registration | Shopify lets developers register agent profiles | Unregistered agents hitting checkout at volume |
Swipe the table to see every column.
A user agent string proves nothing on its own. In early 2026, DataDome counted 16.4 million requests impersonating Meta-ExternalAgent and 7.9 million impersonating ChatGPT-User.
Verify the person behind the agent
A real agent can still work for a fraudster. Verify the person once with ID and a live face check, then let their agent reuse that verification on later orders. Luna, deepidv's verification agent, can send that check through the agent's own conversation in Claude, ChatGPT, Gemini and other LLMs through MCP, so the person completes it without leaving the chat.
Streetwear and fashion drops
Drops reward whoever has the most accounts, and agents make accounts cheap. A one-per-person rule only works if it means one face. deepidv's 1:N match compares each new verified face with every existing account, so a second account by the same person is flagged before it buys.
For shoppers: how not to get scammed when AI shops for you
Give your agent limits before it shops and check the store before it pays. The five habits below reduce the chance of an agent spending your money on a scam.
- Give your agent a spending limit and an approved-store list.
- Prefer stores that show verified seller details and clear return terms.
- Be wary of prices far below other stores; cloned storefronts use them to attract agents.
- Do not trust a video or voice endorsement on sight. deepeye checks images, messages and live video calls for synthetic media in Chrome, including Microsoft Teams calls in the browser, and over WhatsApp.
- Check a seller's verification receipt where one is offered at proof.deepidv.com.
Add verification to your Shopify store
The deepidv app for Shopify adds verification to your store without code. Choose when it runs: first orders, orders above a value you set, limited releases, age-restricted products, or agent orders your rules flag. Customers verify once with ID and a live face check, and their later orders, including those placed by their AI agent, reuse the result. Every check produces a signed receipt you keep with the order.
- ID and face verification
- One person, one account
- Age checks without an ID upload
- A receipt for every check
Frequently asked questions
How do I verify an AI agent?
Check that the request is signed with a key listed in a trusted directory or tied to a network token, that its declared profile resolves, and that a verified person stands behind it. Treat a request that uses a known agent name but cannot prove it, by signature, token or the operator's published IP ranges, as a bot.
What is Know Your Agent (KYA)?
A set of checks that confirms who built an AI agent, who it acts for and what it may do, so merchants and networks can trust agent transactions the way KYC lets them trust customers.
Can fraudsters pretend to be ChatGPT or Gemini agents?
Yes. They copy names and user agent strings. Signed requests, network directories and the operator's published IP ranges are how you tell a real agent from an impostor.
Why verify the human if the agent is legitimate?
A legitimate agent can act for a fraudster, a synthetic identity or one person running many accounts. Agent checks prove the software. Person checks prove the customer.
How can shoppers avoid AI shopping scams?
Set spending limits and approved stores for your agent, distrust prices far below other stores, check seller verification, and treat video or voice endorsements with caution until checked.
Does deepidv verify agents and people?
Yes. deepidv's KYA verifies the agent making the request and the human behind it, with a signed receipt for each check.
Verify the person behind the orders that matter, and keep a record of every check.
Sources
- Ant International: Ant International, Mastercard and Visa Initiate Collaboration on Know-Your-Agent Interoperability to Scale Agentic Commerce (September 10, 2026)
- American Banker: Payment giants battle the fear factor in agentic commerce (September 17, 2026)
- IETF: RFC 9421, HTTP Message Signatures (February 2024)
- Visa: Visa Introduces Trusted Agent Protocol: An Ecosystem-Led Framework for AI Commerce (October 14, 2025)
- Visa Developer: Trusted Agent Protocol specifications
- Google for Developers: Universal Commerce Protocol (UCP) FAQ
- Mastercard: Scaling agentic commerce with trust (October 14, 2025)
- Shopify: Agentic commerce for every developer, the Spring '26 Edition (June 17, 2026)
- DataDome: The AI Traffic Report: High Volume, Low Visibility, and a Growing Risk (March 2026)