Verify me… maybe? Why "bot or human?" is about to be the wrong question

Logging into my account on a major ticketing platform to sign up for Carly Rae Jepsen presale access had more friction than logging into my bank account… or did it?

Last week, I was excited to hear the news that Carly Rae Jepsen will be touring for her newest album, Day and Night. As a longtime fan, I ran to sign up for her official presale.

Something interesting happened as I was signing up through a major ticketing platform: I was asked to verify my identity via a liveness check (even though I was already logged into my account). The whole process probably took only three minutes, but I’ve never had to verify biometric information before buying concert tickets, and working at a fraud prevention company, I couldn’t help but find it a bit funny.

That said, I am not mad about it. I’ve been through the wringer trying to secure concert tickets over the past few years. I have to wonder whether 30K people are actually ahead of me in the queue trying to see Hilary Duff in 2026, or if some of them are bots. Don’t even get me started on how far back I was in the queue for Lady Gaga and Ariana Grande. I digress… and I promise I have a point.

Later that day, I logged in to my bank account to send rent. A quick Face ID, and I was looking at my balance in about two seconds. Maybe thirty seconds later, I sent thousands of dollars to my landlord. 

It might seem a little backward. One of these platforms protects my savings and took less than a minute. The other platform protects my shot at seeing “Run Away With Me” live for the seventh time (I think? I’ve lost count), yet had noticeably more friction. 

Still, working at Alloy, I know those <30 seconds in my banking app were a lot busier behind the scenes than they looked.

What my bank did in those 30 seconds

Face ID was the only part I saw. Behind it, a modern bank login is usually asking a few quieter questions:

• Is this the phone I always use, and has anything about it changed?
• Am I logging in from somewhere that makes sense for me?
• Do my typing and swiping look like me?
• Does this session look like my last hundred?

When the answers line up, I’m in. When something’s off, that's when the bank triggers step-up verifications such as OTP or selfie verification. 

So the bank had already checked me; I just never saw it happen. 

Why the ticket site’s fraud prevention is different

The math is different. Presales sell out in minutes, and the biggest threat is bots buying in bulk to resell at crazy markups. Real fans (like me) will put up with almost anything for a chance at tickets to their favorite singer. Each extra step blocks more bots but does little to deter legitimate customers. 

The ticket site only has to do that check one time. When the presale opens, I will be able to enter the queue freely because they’ve already verified me as a human. 

Financial institutions and fintechs don’t have either advantage. Customers have options, and if checking my balance felt like fighting for a spot in the Taylor Swift Eras Tour queue every time, I’d move my money somewhere else. 

On top of that, financial organizations need to verify customers continuously at every touchpoint. 

And verification is about to get a lot harder no matter what industry you operate in.

Coming soon: Not all bots are bad bots

Blocking every bot will quickly become a losing strategy for most businesses — whether you're a ticketing platform or a bank. It only works as long as every bot is a bad actor, but with the rise in agentic commerce, that is becoming less true.

Soon, I may want an AI agent to get presale tickets for me. It would wait in the queue, jump in when the sale opens, and stay under my budget. To the ticket site, my agent looks a lot like the scalper bots it worked so hard to keep out. 

The law sees it that way too (for now). The 2016 Better Online Ticket Sales (BOTS) Act made it illegal to use bots, or any other workaround, to exceed ticket purchase limits. It was written with scalpers in mind, years before a fan could send an AI assistant to wait in line for two seats. So what happens when the bot in line is working for a real fan? Right now, a lot of sites are built to block every bot, including legitimate ones.

“Bot or human?” will stop being a useful question. As our CEO Tommy Nicholas puts it, the better questions are: who authorized this action, what is this agent allowed to do, and should it be allowed to do it right now? Two floor tickets, sure. Twelve? Probably not.

For banks, the stakes are higher than a front-row ticket. Customers are already connecting AI assistants to their accounts. So far, mostly to check balances and spending. Next, they’ll ask those agents to pay down a credit card, move money into savings, or pay a vendor. An agent holding my credentials can pass every login check and still be talked into something I never asked for, for example, by instructions hidden on a webpage it visits. So a successful login proves less than it used to. 

But customers aren’t handing over their keys just yet. A Gartner survey cited in Mastercard’s August Signals report found that only 10% of consumers would let an agent complete a purchase on its own. That trust will grow over time, and businesses and financial organizations alike should start preparing guardrails for agentic banking and commerce now.

For financial organizations, those guardrails are what Know Your Agent (KYA) is for. It means verifying the agent, tracing its authority back to a customer the bank already knows, and limiting what it can do in each session. A bank might be fine with an agent reading balances, but want a step-up check, or a person, before that agent sends a wire. 

Cutting to the feeling point

The ticket site asked me to prove I’m a human once in order to try to get tickets into the hands of more fans. A noble cause. My bank works in the background to authenticate that it is me every time I log in and take actions. Pretty soon, both will need to answer a third question: is this my agent, and did I actually say it could do that?

The answer looks a lot like what my bank is already doing with risk-based authentication. Build a baseline for each account’s behavior and device history. Let the routine stuff go through smoothly enough that the user doesn’t even notice it. Save the friction for moments that look off. When an agent tries something its owner probably wouldn’t, like buying twelve floor seats to Nickelback (subtle shade) in a city they don’t live in or tries to wire rent to a stranger, check with the human first.

Presale day came and went, and I got tickets. That three-minute liveness check was worth it. I can’t say how many of the people ahead of me in the queue were human, but I’m choosing to believe most of them. Next time, some of them may be sending agents. Here’s hoping a real fan authorizes every one!