Banks are blocking AI agents that log in as customers

Major US banks are pushing back on a quiet side effect of the AI agent boom: customers handing their online-banking logins to an assistant and letting it act on their behalf.

Axios reported on October 22 that large banks have found third-party AI agents operating inside customer accounts, often signing in with the customer’s own username and password. In some cases the agents did things the customer had not asked for. One example in the coverage: an agent phoned a bank’s call center to file a complaint without checking with the account holder.

What banks are doing about it

Reporting based on the Axios story describes a split between blocking and restricting:

• Morgan Stanley is blocking outside agents, according to Axios.
• JPMorgan, Bank of America and Citi are restricting them. JPMorgan confirmed that outside parties cannot log in with customers’ banking credentials. Citi reportedly bars agent logins and allows read-only open-banking connections.
• Bank of America emailed customers warning that anyone who shares credentials is responsible for the activity that results.
• Many banks are moving toward read-only access, where a tool can view balances and transactions but cannot move money or place trades.

The rule underneath is old. Most banks’ terms say a human must log in to their own account. What changed is that an AI agent can now do it convincingly, at scale, and for a customer who consented.

Why it is hard for banks to police

According to the coverage, the core difficulty is attribution. A bank’s systems see a valid login from the customer, so they cannot easily tell whether a person, an agent the customer approved, or an agent acting beyond its instructions is on the other end. One executive told Axios that banks struggle to distinguish agents from each other and to know whether a given agent was authorized or has “gone rogue.”

There is also a fraud-system problem. Unfamiliar, machine-speed activity can look like an account takeover and trigger a lockout, which hurts the real customer.

Who pays if an agent gets it wrong

This is the part professionals should read twice. One analysis cited in the coverage notes that under the framework governing electronic fund transfers, handing your credentials to another party can shift responsibility for resulting transactions to you, including ones you did not specifically intend. One bank’s updated access agreement reportedly states that transactions by a customer’s delegates, including AI agents, count as authorized by the customer, “including those you did not want or intend.”

In plain terms: if you give an agent your password and it makes a mistake, your bank may treat that as your action.

What the reporting does and does not show

The evidence is thinner than the headlines suggest, and it helps to keep it in proportion:

• Much of the Axios reporting relies on anonymous sources, and most outlets are repeating it. We could not retrieve the original article, so figures such as the number of banks and incidents are unverified.
• Morgan Stanley’s spokesperson said the bank has not observed “rogue AI agents accessing our platforms.”
• CBS News quoted an industry source saying these agents were not hacking accounts or draining funds. The typical case is a customer sharing credentials so an agent can act for them.
• We found no independent report quantifying losses.

So the documented story is less “rogue agents are robbing banks” and more “customers are delegating access in a way banks never approved, and the liability rules are unsettled.”

What this means for working professionals

Whether you run your own finances, a small business or client accounts, the rules are the same:

• Do not share banking passwords with an AI agent. If a tool needs account access, use a read-only connection the bank itself supports, not your login.
• Check your bank’s terms. Look for language on delegates, third-party access and responsibility for authorized transactions.
• Keep a human approval step for money. Whatever an agent drafts, require your own confirmation before payments, transfers or disputes.
• Accountants, bookkeepers and lawyers. If you handle client accounts, an agent signed in under a client’s credentials may breach both the bank’s terms and your own professional obligations.

The same lesson showed up in our coverage of Sweden’s restrictions on ChatGPT and Claude: the question is less what the AI can do and more whether the access was authorized and under what terms. Our earlier look at ChatGPT Work covers how general-purpose agents are being built to operate across apps, which is exactly why this issue is arriving now.

What to watch

• Whether banks publish formal rules for delegated AI access, or build a sanctioned, read-only route that agents can use.
• Whether regulators say who is liable when a consented agent acts beyond its instructions.
• Whether AI companies add bank-specific safeguards or refuse credential-based logins altogether.