Banks Block AI Agents From Customer Accounts

Major U.S. banks are restricting third-party AI tools from accessing customer accounts as autonomous software creates a new security challenge for the financial industry: determining whether an action was actually authorized by a human.

Morgan Stanley, JPMorgan Chase, Bank of America, Citi and Wells Fargo are among the institutions taking steps to block or limit outside AI agents, according to reports from Axios, Reuters and USA TODAY.

The concern goes beyond conventional cyberattacks. In some cases, customers themselves have provided AI assistants with usernames and passwords, allowing the software to enter financial accounts and perform tasks on their behalf.

Banks are now confronting a difficult question: if an autonomous agent has valid credentials, how can a financial institution determine whether each action reflects the customer’s actual intent?

That problem could become increasingly important as AI moves from answering questions to independently shopping, transferring information, communicating with companies and potentially managing financial transactions.

Why Banks Are Blocking AI Agents

Traditional banking security systems are designed around a relatively straightforward assumption: when valid credentials and authentication are presented, the person controlling the session is generally the account holder or an explicitly authorized party.

Agentic AI complicates that model.

An autonomous assistant can potentially receive a broad instruction — such as reducing monthly expenses, finding a better savings rate or paying a bill — and then perform multiple steps without requiring the user to approve every individual action.

According to Axios, some banks have detected third-party agents operating inside customer accounts, including cases in which software appeared to attempt actions beyond the user’s specific instructions.

However, the word “unauthorized” requires context.

Reuters reported that some customers voluntarily shared login IDs and passwords with agents. In such circumstances, activity cannot automatically be classified as an unauthorized transaction simply because a bank did not approve the software.

This creates an unusual security problem: the credentials may be legitimate while the intent behind a particular action remains unclear.

JPMorgan Chase is among the institutions taking a restrictive approach to outside agents.

CEO Jamie Dimon said in October that the bank would not allow arbitrary external agents inside its systems because of the risks to customers and JPMorgan.

The bank is not rejecting agentic technology itself.

JPMorgan is already developing and deploying AI internally. The distinction is between systems operating within controlled environments and outside software entering customer accounts through ordinary login credentials.

JPMorgan CFO Jeremy Barnum has also highlighted concerns about credential sharing and screen scraping, where third-party services retrieve account information through the same interface designed for human customers.

The bank considers those approaches insecure and is working toward more controlled connections.

This distinction could shape the future of agentic banking.

Instead of giving an AI assistant a username and password, customers may eventually authorize specific capabilities through APIs or open-banking systems — for example, permission to read balances but not transfer funds.

Citi Favors Controlled Read-Only Access

Citi has adopted a similar distinction.

The bank told USA TODAY that third-party AI assistants are not permitted to log directly into customer accounts or transact within its digital banking platforms.

However, customers can authorize limited, read-only access through certain Citi-approved open-banking providers.

That model offers a possible compromise.

An assistant could analyze spending, identify recurring subscriptions or compare account balances without receiving authority to move money.

Read-only access is already familiar within financial technology. Budgeting and personal-finance applications have long relied on permissioned access to banking data.

Agentic systems raise the stakes because they are designed to take actions rather than merely display information.

The key architectural question is therefore becoming not simply whether an agent has access, but exactly what that agent is authorized to do.

Bank of America Wants Humans in the Loop

Bank of America CEO Brian Moynihan has emphasized another important principle: keeping humans involved when money actually moves.

Speaking to Bloomberg in October, Moynihan said the industry is working with technology companies on protocols that would require users to authorize payments before they are completed.

That approach separates delegation from final authorization.

An agent might search for a product, negotiate a price, fill in payment information or prepare a transaction. But before funds leave the account, the customer would explicitly approve the payment.

For high-risk financial actions, that model could become a critical safeguard.

It would also address one of the most difficult questions surrounding autonomous financial software: how much decision-making authority should a person be able to delegate?

The Authentication Problem

Andre Durand, founder and CEO of identity-security company Ping Identity, described the current period as a “window of vulnerability.”

His argument points to a fundamental weakness in existing identity systems.

Banks need to determine not only whether a request contains valid credentials but whether it comes from a human or an automated agent — and, if it is an agent, whether the agent has valid authority for that specific action.

Passwords alone are poorly suited to solving that problem.

An autonomous assistant with access to a customer’s browser, password manager or email may potentially have access to several layers of conventional authentication.

Durand argues that passkeys and biometrics could play a larger role because they can establish that a human is present when a sensitive action is authorized.

In an agentic financial system, authentication may therefore need to evolve from “Who has the password?” toward “Who authorized this specific action, for what purpose, and with what limits?”

Wells Fargo Highlights the Liability Question

Security is only part of the issue. Liability may prove even more complicated.

Wells Fargo has updated its online access agreement with language addressing third-party AI agents.

The agreement, scheduled to take effect November 24, says customers who allow an AI agent or another third party to access the service accept risks associated with that access.

It also states that transactions performed by authorized representatives can be treated as authorized even when they were not what the customer wanted or intended, subject to the agreement’s terms.

That language illustrates the legal problem emerging around autonomous software.

Suppose a customer tells an agent to move $500, but a software error results in a different transaction. Who bears responsibility?

The customer?

The bank?

The company that developed the agent?

Or the service that provided the underlying AI model?

There is no simple answer, and contractual terms, applicable banking regulations and the circumstances surrounding each transaction will matter.

Expert View: Who Is Responsible When an Agent Goes Rogue?

The liability question is already drawing attention from financial regulators and fintech executives.

At an Axios event on October 20, FDIC Chairman Travis Hill noted that increasingly capable technology can make it easier for consumers to move money between institutions.

But he also raised the question of how much decision-making authority depositors will ultimately delegate to autonomous systems.

Yoshi Yokokawa, co-founder and CEO of brokerage infrastructure company Alpaca, highlighted an even more difficult scenario: determining responsibility when an agent behaves unexpectedly, engages in illegal activity or simply executes a bad trade.

Yokokawa warned against assuming autonomous software can reliably generate financial profits without human oversight.

That warning is particularly relevant as agentic technology expands from personal banking into investing and trading.

Financial mistakes can be irreversible. A chatbot producing an incorrect answer is one problem; an autonomous system executing an incorrect transaction is another.

Read-Only Access Could Become the Middle Ground

Banks do not appear to be rejecting agentic finance entirely.

Axios reports that many institutions have already authorized or are moving toward read-only models.

This approach could allow consumers to receive many of the benefits of financial AI without immediately granting transactional authority.

An agent could potentially:

analyze spending patterns;
identify unnecessary subscriptions;
compare deposit rates;
monitor account balances;
prepare budgets;
detect unusual expenses;
recommend transfers without executing them.

The user would remain responsible for approving consequential actions.

This model resembles the permission architecture already used by many financial applications but adds a stronger distinction between analysis and execution.

AI Agents Could Intensify Competition Between Banks

The technology is not only a cybersecurity issue.

It could also change the economics of consumer banking.

If a personal financial agent can continuously compare interest rates, fees and financial products across institutions, consumers may become much more responsive to price differences.

Instead of manually checking savings rates at five banks, an agent could potentially monitor them continuously and recommend moving deposits whenever another institution offers better terms.

JPMorgan’s Barnum has discussed this possibility.

Such automation could increase competition for deposits and weaken the inertia that traditionally keeps many customers with the same bank even when more attractive products are available elsewhere.

Eventually, consumers might delegate parts of cash management to software — subject to whatever regulatory, contractual and technical safeguards emerge.

That possibility explains why banks face a strategic dilemma.

Blocking every outside agent may protect today’s security architecture, but customers could increasingly demand agent-compatible financial services.

What Agentic Finance Needs Next

The current conflict suggests that agentic banking will require infrastructure designed specifically for autonomous software.

Sharing a customer’s ordinary username and password is unlikely to provide a sustainable foundation.

A more robust model would give agents narrowly defined permissions.

An agent might receive access to account balances for 30 days, permission to analyze transactions but not reveal them to third parties, or authority to prepare payments while requiring biometric approval before execution.

Financial institutions would also need reliable audit trails showing which agent requested an action, which user authorized it and what permissions existed at the time.

This resembles concepts already familiar in institutional finance and cybersecurity: least-privilege access, scoped authorization, identity verification and transaction-level controls.

Agentic AI makes those concepts relevant to ordinary consumer banking.

Why This Matters Beyond Banking

The dispute could have broader implications for digital finance.

Crypto wallets, exchanges, stablecoin platforms and tokenized financial products face many of the same questions.

An autonomous system connected to a blockchain wallet could potentially analyze assets, swap tokens, interact with smart contracts or initiate payments.

Unlike conventional bank transactions, some blockchain transactions cannot easily be reversed.

That makes explicit permissions and human authorization even more important.

As financial assets become increasingly programmable, the security model may need to become programmable as well.

An agent should not automatically receive unlimited authority simply because a user wants help managing money.

Bottom Line

The banking industry’s response to AI agents exposes a fundamental problem with the next generation of financial automation.

The question is no longer whether artificial intelligence can understand financial information.

It is whether software should be allowed to act on that information.

Major banks appear willing to explore controlled access, particularly read-only connections, but they are drawing a much harder line around unrestricted account access and autonomous transactions.

The long-term solution is unlikely to be a permanent ban.

Instead, banking infrastructure may evolve toward agent-specific identities, granular permissions, secure APIs, passkeys, biometric confirmation and explicit human approval for high-risk actions.

If that architecture emerges, personal AI assistants could become powerful financial tools without receiving the digital equivalent of handing a stranger the keys to a bank account.

Until then, the safest distinction may also be the simplest: an AI assistant can help a customer decide what to do, but moving money should require clear and verifiable human authorization.

Disclaimer: This article is for informational purposes only and does not constitute financial, legal, cybersecurity or investment advice.