TL;DR
- A bank login carries only a password, so an agent using your password and a thief using a phished one look identical, and the bank refuses both. Charles Schwab says a given agent might hit its login "30, 40, 50 times" a week and gets blocked.
- Bank of America's customer email and Wells Fargo's Nov 24 account terms can leave the customer responsible for what an agent does with their password.
- Read-only access the bank approves is open today. Moving money needs credentials issued to the agent, and the US rule meant to replace password-based access is frozen in court.
Bank of America emailed customers a message titled "Protecting your finances in the AI world," telling them not to share passwords with AI agents. If they do, the email says, they are "responsible for activity resulting from that access."
If you build agents that touch customer accounts, this is likely why your login-based demo gets blocked. From the bank's side of the glass, a logged-in agent and a stolen session are the same thing, so banks refuse the login and leave the customer responsible for whatever slips through.
A bank login cannot tell your agent from a phished password
A login checks one thing: whether the password matches the one the bank has on file. The customer, the customer's agent and a criminal with a phished password all present the same proof.
Axios reported on Oct 22, citing people familiar with the matter, that banks "were detecting outside AI agents inside customer accounts", including some "that attempted actions that appeared independent of their users' instructions". AI News adds a counterpoint: Morgan Stanley, which has blocked third-party agents, "had not seen any unauthorised or rogue instances," a person familiar with the bank told Reuters. The agents in question are consumer tools such as Meta's Muse, which can connect to accounts with a customer's authorization to monitor balances and transactions.
To the bank, an agent's login is a correct password from a device it has never seen, which is also how a criminal's login looks. The one defense available at that door is to refuse it. Schwab's CEO says the firm is "keeping rogue agents from being able to log in on the client's behalf."
The blocks show a bank can spot agent-like traffic. A blocked attempt still says nothing about whose agent it was, because the password is all the form carries. That is our reading of the evidence; no bank states it in these words.
Read-only access the bank approves is open today
Axios reported that most banks have approved, or are moving toward, read-only access that lets an agent view account information without moving money. Schwab plans to let outside AI models check balances and research through its own MCP servers, but not move money: "We control the authentication experience." These agents arrive through a path the bank built, so the bank can recognize them and the identity question never comes up.
Try this: Check how your integration connects to the bank. If it asks users for a bank username and password, expect trouble: Schwab blocks agent logins, and TD tells clients never to share their log-in credentials with an AI agent. If it connects through the bank's own approval and only reads balances and transactions, it uses the access banks already approve.
Bank of America and Wells Fargo put the liability on the customer
TechCrunch, reporting on the Bank of America email, puts the general rule this way: "Account agreements at most banks hold customers responsible for anyone they give their log-in to."
Wells Fargo is writing it down for agents. As AI News summarizes it, the updated Online Access Agreement, effective Nov 24, says that, subject to applicable law, instructions and transactions from an agent given a customer's login details or authority "can be treated as the customer's own without further verification." Customers are also made responsible for unintended actions and for actions that exceed the authority they gave.
For a builder, that means the customers using a login-based integration are told not to share credentials, the bank may block the login, and the customer can carry the risk if something goes wrong.
Where each bank stands
Per reporting through Nov 1:
| Bank | What it does | On the record |
|---|---|---|
| JPMorgan Chase | Blocks external agents from acting for retail customers; some third-party tools view data only | Spokeswoman to CNBC; Bloomberg |
| Bank of America | Imposed limits on agents | Customer email warning (TechCrunch, Oct 27) |
| Wells Fargo | Restricts third-party agent access | Nov 24 agreement (AI News) |
| Charles Schwab | Blocks agent logins; outside AI models connect on its terms, no money movement | CEO Rick Wurster: agents blocked from logging in on clients' behalf (InvestmentNews, Oct 28) |
| BMO, CIBC, RBC, TD, Scotiabank | Four block personal AI agents; Scotiabank limits third-party agents while it monitors | TD's advice: keep log-in credentials away from AI agents (CBC, Oct 29) |
Moving money needs agent-scoped credentials; the rule meant to replace password sharing is frozen
An agent a bank could admit would carry a credential of its own, scoped to specific permissions, revocable without touching the customer's login, with liability set in advance. OAuth-style tokens show the shape: an app acts for you within a limited scope you can cancel without changing your password.
As AI News reports, relaying American Banker, the Personal Agent Protocol is an open standard led by Sierra and Meta that "sets out how personal AI agents identify themselves to businesses, establish whom they represent and limit their access to what the customer has authorised". It is built on OAuth, and the customer decides whether an agent gets read-only or write access. Bank of America, BBVA, Synchrony and Wells Fargo have joined it, even as Bank of America and Wells Fargo restrict the credential-based agents already in use.
The US rule in the picture is the CFPB's Section 1033 open banking rule, finalised in October 2024 and meant to replace credential-based access. As AI News reported, the rule "requires banks to maintain a developer interface, typically an API, through which authorised third parties can access customer data", and "bars banks from relying on a third party's use of customer credentials" to reach that interface. A federal court has enjoined the CFPB from enforcing it, and as of August 2026 a revised proposal had gone to White House review without being published. As AI News put it: "With the rule on hold, there is no regulated route for AI agents into bank accounts."
Two things to watch:
- Whether Bank of America or Wells Fargo accept write-capable agents under the protocol, since membership signals a commitment to agent identity and a customer-chosen write option.
- Whether the revised Section 1033 rule gets published, since it would give agents a regulated way in without a password.
Until a bank can issue an agent credentials of its own, a logged-in agent and a stolen session look the same from the bank's side, so expect the login to stay closed. If you build anything that touches customer accounts, build for the read-only lane the bank approves.
Sources: Axios (Oct 22, via CBC News and AI News), CBC News (Oct 29), TechCrunch (Oct 27), InvestmentNews (Oct 28), CNBC (Nov 1), ZDNET (Oct 29), AI News (Oct 30, relaying American Banker, Reuters and Bloomberg).
Dan writes the AI explainers on super-intelligence.rocks, where this piece first appeared.
Top comments (0)