Should your AI agent get your bank password?
This week the front door became the fight. Reuters reported on Thursday, citing an Axios investigation, that major U.S. banks are detecting and removing third-party AI agents operating inside customer accounts — agents that logged in with the customer's own username and password, and that in some cases appeared to try actions the customer never asked for. The banks are not arguing about whether AI is useful. They are arguing about who, exactly, just walked into the vault.
The timeline is short. On October 13, on JPMorgan's third-quarter earnings call, JPMorganChase CEO Jamie Dimon said outside agents would not be allowed inside the bank, warning against rogue agents, according to Fortune's report of the call. Within a week, PYMNTS reported, JPMorganChase, Citigroup, Bank of America and Charles Schwab had all said AI agents cannot move customer money.
The enforcement is already routine. Charles Schwab CEO Rick Wurster said the firm is blocking unauthorized AI agents a double-digit number of times every week, according to PYMNTS, and summaries of the Axios reporting put the figure in the dozens. Citigroup said it does not let third-party agents log into accounts or transact. Bank of America CEO Brian Moynihan said a human should stay in the loop to approve money moving out of an account. PNC chairman and CEO William Demchak, on an October 15 earnings call reported by PYMNTS, called agents transacting inside customer accounts incredibly unsafe, and said money movement by agents would require laws on liability shifting, secure connections, authentication and a human in the loop.
Two facts keep this honest. First, read-only access mostly survives: the same banks still allow agents to view balances through sanctioned connections, according to PYMNTS. Second, the blocks so far are preventive — no completed unwanted transaction by an agent has been reported, according to the Axios reporting summarized this week.
This is the technical core of the banks' case, and it is hard to argue with. Fraud controls are built to tell a customer from a criminal. An agent signing in with valid credentials, from a plausible device, doing plausible things, passes as the customer — it has no way to declare what it is, what it was asked to do, or where its permission ends. A password is all-or-nothing: the same login that checks a balance can wire the savings.
The liability problem is worse. Under U.S. Regulation E, protection against unauthorized transfers generally does not cover a transfer made by someone the customer furnished with access, unless the customer has told the bank that access is revoked — a reading of the rule, set out in analysis of the October restrictions, that lawyers are now testing against the question of whether an AI agent counts as a person the customer furnished. In plain terms: hand your agent your password, and you may have handed away your fraud protection with it. The banks did not create that trap, but they are the ones who would have to pay out — or refuse to — when it springs.
The other side starts from ownership. The account belongs to the customer; an agent the customer directed is the customer exercising a choice, not an intruder. According to the Axios reporting, former White House AI czar David Sacks argued banks should back user-directed agents that let people grant, limit and revoke access, with read-only access as an interim step, and called treating user-authorized agent activity as a cyberattack irresponsible.
There is also a motive worth naming. PYMNTS reported on October 8 that agents could soon move household cash out of low-interest checking accounts into accounts paying higher rates — exactly the idle deposits large banks profit from holding. Critics cited in coverage of the restrictions argue the safety story is convenient cover for deposit defense: an agent that shops for yield is a threat to the bank whether or not it is a threat to the customer. And a block with no legitimate alternative does not end agent access; it selects for agents that imitate humans well enough to slip past the filters.
Look at what both camps already accept. The banks accept read-only agent access through sanctioned, open-banking connections — JPMorgan says it supports customer-authorized data sharing that way while blocking credential-based logins, according to Fortune. Sacks, from the other camp, proposes read-only as the interim step too. Bank of America and Demchak both put a human approval on money movement, however the agent connects. The shape of the settlement is visible: the agent gets its own identity, not yours — a delegated, scoped token that names the agent, states what it may do, and expires or can be revoked; read access by default; a human confirmation, such as a passkey, before money moves; and a record of the request, the approval and the permission that a dispute can be settled from.
Early versions are already being built. A Personal Agent Protocol announced by Meta and Sierra on October 6 would let a customer choose read-only or write access for an agent on standard OAuth sessions, according to reporting summarized this week, and an ING, Worldline and Visa test in Germany earlier this year ran a live agent payment in which the customer set the conditions and confirmed with a passkey and biometrics. What is still missing is the liability law Demchak pointed to: until a rule says who pays when a properly badged agent goes wrong, expect the banks to keep the badge desk slow — and expect customers to keep handing out passwords in the meantime.