Sardine's new tool helps stores tell AI shopping agents from bots

A company called Sardine has launched Know Your Human, a system that lets online stores see who is really behind an order placed by an AI shopping agent. The goal is simple. Stores often block these orders because they look like bot attacks. Sardine wants real customers who use agents to get their purchases through.

Why good orders get declined

Most AI shopping agents work inside cloud browsers. At checkout, these sessions come from data center IP addresses and carry signs of automation. Store fraud systems read that as bot activity. Sardine says orders from legitimate customers are therefore flagged as high risk and declined. Stores lose the sale, and the shopper loses the purchase.

How the check works

Know Your Human passes the buyer's device ID, device fingerprint, IP address, email and phone number to the merchant. A device fingerprint is a profile of a device built from its settings. Either the agent developer or the merchant can set it up.

Stores can also ask for extra proof. If Sardine detects that an agent such as Muse, Dot or Instinct completed a checkout, the store can text the customer a verification link. Opening it lets Sardine match the customer's browser to the agent's cloud browser.

• Each link can be opened up to three times.
• A link expires five minutes after it is created.
• A new link can be sent for the same session if needed.

The chargeback angle

Sardine says the data also helps stores fight chargebacks, which happen when a customer disputes a charge with their card company. Agents tend to hide the device and IP signals stores use as evidence. Under the Visa Acquirer Monitoring Program, fraud reports and disputes both count toward a merchant's ratio. A claim that an agent acted without permission can therefore count against a store twice.

Sardine also points to Visa Compelling Evidence 3.0. It lets a merchant win a dispute if the same device ID, fingerprint or IP address appeared in two earlier transactions within 120 to 365 days. It cites Mastercard's First Party Trust program as well, which also relies on device and IP data.

What is not known yet

Sardine is still looking for design partners among agent developers and merchants to develop the protocol further. The material does not say which stores will use it, what it costs, or how many shoppers will see text checks. Sardine says it could later pass identity verification details to banks and fintechs.