August 2026 Summaries

Universal Commerce Protocol (UCP) checkout requests may originate from platform backends or AI agents rather than browsers, making browser-based bot detection ineffective; the Automation Intelligence API addresses this by analyzing HTTP headers, methods, URLs, and IP addresses without requiring JavaScript. UCP supports REST checkout-session endpoints and an MCP binding, with each providing information about the direct caller and, optionally, buyer IP and user-agent signals supplied by the platform. Merchants can submit sanitized request data to the API’s `/edge` endpoint to assess the caller, correlate events with checkout IDs, and separately evaluate buyer-provided signals for IP reputation, proxy or VPN use, geolocation, and possible automation. Responses identify detected automation as verified, signed, unknown, or spoofed, while the absence of bot information indicates no automation signal rather than confirmed human activity. The approach recommends combining caller and buyer results with broader fraud indicators, while noting that both the public-preview API and the evolving UCP specification may change.

Fingerprint has introduced Active Call Detection, a mobile Smart Signal for iOS and Android that reports whether a user is currently on a cellular or VoIP call through a simple active_call true or false result. Available from SDK version 2.16.0 without requiring extra app permissions or collecting call details such as phone numbers, duration, or participants, the feature is intended to help identify possible voice-phishing, or vishing, scams that traditional fraud tools may miss because victims use their legitimate devices, credentials, and locations. The signal is most useful when checked during sensitive actions such as one-time passcode entry, transfers, beneficiary updates, account recovery, and high-risk settings changes, where an ongoing call may indicate that a fraudster is coaching the user. Because many calls are legitimate, the company recommends using the signal as additional context rather than automatically blocking activity, with potential responses including warnings that the company is not calling, step-up authentication, transaction delays, manual review, and pattern analysis alongside other fraud indicators. Active Call Detection is offered on Pro Plus and Enterprise iOS plans and Free, Pro Plus, and Enterprise Android plans.

A roundup of fraud prevention and risk conferences scheduled for late 2026 and early 2027 organizes events by industry focus, including e-commerce and merchant fraud, marketplace risk, fintech and payments, identity and authentication, trust and safety research, gambling and affiliate fraud, and financial crime and AML. The events address issues such as payment fraud, account takeover, bots, fake accounts, identity verification, AI-enabled abuse, scams, chargebacks, policy abuse, and regulatory compliance, while serving audiences ranging from engineers and fraud analysts to executives, compliance leaders, researchers, and platform operators. Major conference series include MRC, Marketplace Risk, Money20/20, Authenticate, Gartner IAM, Identiverse, TSRC, APWG eCrime, SBC, and financial-crime forums, held across North America, Europe, Asia, and Brazil. Pricing and attendance models vary widely, with some offering discounted or free passes for merchants, financial institutions, startups, operators, or qualifying delegates, while others are membership-based, invitation-only, or sponsor-gated; dates, locations, and fees were verified in August 2026 but should be confirmed with organizers because details may change.

MCP server operators often lack reliable visibility into which AI clients are invoking their tools because MCP requests typically lack browser-based signals and User-Agent strings can be generic, incomplete, or spoofed. Fingerprint’s Automation Intelligence API aims to address this by analyzing HTTP metadata such as ordered headers, request method, URL, and client IP without requiring client-side software, returning classifications of automation type, provider, verified or signed identity status, and network or datacenter context. The proposed integration sends sanitized request metadata to a regional API endpoint, records returned bot and IP information alongside existing telemetry, and can distinguish categories such as AI agents, assistants, crawlers, and browser automation while identifying potentially spoofed client claims. Fingerprint reports using the system on its own MCP server to observe traffic from tools including Claude, Cursor, OpenAI products, GitHub Copilot, and custom agents, informing compatibility testing and product decisions. The post recommends treating the service strictly as non-blocking analytics by failing open during errors or rate limits, preferably processing events asynchronously through a bounded queue, and notes that the API is available in public preview with event retrieval and bot-directory resources.

Ridesharing companies face unique challenges in combating fraud due to their two-sided marketplace structure involving both drivers and riders, each presenting distinct avenues for fraudulent activities. Current identity verification methods, which focus on single points of time, fall short in addressing ongoing fraud risks such as account sharing, profile rental, and referral abuse. The use of device intelligence is proposed as a critical enhancement to existing fraud prevention frameworks by offering persistent cross-session tracking that can link suspicious activities to specific devices rather than just accounts. This approach not only aids in recognizing fraudulent patterns, such as drivers attempting to re-enter the platform under new accounts and riders exploiting referral schemes, but also provides a compliance advantage by demonstrating due diligence in fraud prevention efforts. Such device-level monitoring ensures cleaner growth metrics, higher promotional ROI, and reduced driver churn, by effectively identifying and curbing fraudulent behaviors without adding friction to the user experience.