How to handle AI agents that contact you

An AI agent can fill in forms, write emails, chat and make phone calls on someone’s behalf. To whoever receives it, the contact often looks like any other. A customer might have an agent compare quotes, a supplier might send reminders through one, and a fraudster can use the same tools to sound convincing. The question to ask is the one you have always asked. Who is behind it, and what is that person entitled to receive or order?

Who is behind the agent

An agent can claim to act for anyone. Work on making that verifiable is under way. In October 2025 the IETF, which develops internet standards, approved a working group on cryptographic authentication of automated clients, AI agents among them, towards websites. Authenticating the person behind the agent is explicitly outside its remit. During 2025 payment and technology companies presented protocols in which the agent signs its requests or can show that the user approved a specific purchase. In spring 2026 the US NIST gathered views on how agents should be given identity and authorisation, as input to a possible project.

Until such solutions are established, it is sensible to treat the person an agent claims to act for as unconfirmed. What counts is still the channels you already trust: the customer’s login, a contract, a known contact.

Protecting your own systems

When AI reads incoming email, sorts cases or suggests replies, whatever arrives from outside becomes a way in. Text in an email or a form can carry hidden instructions to your own AI, known as prompt injection.

Incoming text is content to be read, even when it is phrased as a request. The AI that reads incoming cases should not also be able to send data out or change your systems without a person approving. More on how such attacks work can be found in the risks of AI agents.

When the agent asks for data or places an order

When an agent requests personal data on someone’s behalf, it makes sense to handle it as you would a request from a representative. In its guidelines on the right of access, the European Data Protection Board notes that a third party can make a request on the data subject’s behalf, including through an online portal. The controller has to make sure the third party is genuinely acting for the data subject, and disclosing data to someone not entitled to it can be a personal data breach. Nor is there any obligation to provide the data directly through the portal, for instance if its security is insufficient. The reply can then go through the organisation’s own secure procedures. Read more about GDPR and AI.

Orders and bookings raise the question of who is bound. In July 2024 the UN Commission on International Trade Law adopted a model law under which what an automated system does is attributed first according to any procedure the parties have agreed, and otherwise to the person using the system. It is a template for national legislation and does not apply in its own right. For you as the recipient, the practical advice is to decide what an agent may order without confirmation, set limits on amounts and confirm larger orders with a known contact.

Voice cloning and false senders

The same technology is also used for fraud. In May 2025 the FBI warned of AI-generated voice messages claiming to come from senior US officials. In May 2026 the Swedish Police in the southern region warned of a growing number of fraudulent emails to businesses, including CEO fraud, fake invoices with new bank details and hijacked email accounts. Fortifikationsverket, the Swedish Fortifications Agency, points out that a voice deepfake need not be perfect to persuade, especially during a short call.

The protection lies in your routines. Unusual payments and changed account details are confirmed through another channel, by calling back on a number you already have or through the switchboard, never on the number displayed. An agreed code word within the team makes it harder to pose as the boss. Let payments above a set level need two people under the four-eyes principle. When someone presses because it is urgent, there is every reason to verify with extra care.

How it works in iSearch

iSearch answers from your organisation’s own material, and every answer shows which documents were read. You choose who may use iSearch and what may leave the organisation. Sign-in uses SSO and two-step verification, and role-based access controls what each person can see. Sensitive changes need a second person’s approval, and a tamper-evident audit log shows who did what.

Read more about security in iSearch, or book a walkthrough.