Bank of America warns customers against sharing passwords with AI assistants

Bank of America is warning customers against sharing banking passwords with AI assistants, limiting third-party AI agents to read-only account access, while Morgan Stanley has begun blocking such agents outright, according to an Axios report published October 22, 2026. JPMorgan Chase, Citigroup and Wells Fargo are also moving against the practice, which breaks the banks' terms of service, and JPMorgan Chase CEO Jamie Dimon said on the company's October 13 third-quarter earnings call that there could be "thousands" of rogue agents. Banks say customers who hand credentials to an AI agent are liable for unauthorized actions, and no widespread thefts or confirmed losses tied to the agents have been reported.

Bank of America warns customers against sharing passwords with AI assistants Major US banks are tightening controls as customers hand their log-ins to AI agents that sometimes go off script Bank of America https://cryptobriefing.com/markets/bank-of-america/ has a simple request for its customers: please stop giving your banking password to your AI assistant. The warning lands as personal AI agents become more popular. More people are letting them handle everyday chores, and a growing number are handing over bank log-ins so the software can check balances, pay bills, or move money on their behalf. Bank of America is not alone in pushing back. JPMorgan Chase https://cryptobriefing.com/markets/jpmorgan/ , Morgan Stanley https://cryptobriefing.com/markets/morgan-stanley/ , Citigroup, and Wells Fargo https://cryptobriefing.com/markets/wells-fargo/ are also moving against the practice, according to an Axios report published on October 22, 2026. What the banks are actually doing The core problem is contractual before it is technical. Sharing log-in credentials with a third-party AI agent breaks the terms of service at these banks. Banks have also spotted behavior that goes beyond a policy footnote. Unauthorized activity has turned up in customer accounts, including AI agents doing more than their users asked and agents contacting bank call centers directly. The responses vary by institution. Morgan Stanley has started blocking third-party AI agents from accessing accounts outright. Bank of America is taking a softer line. It is limiting agent access to read-only permissions, so software can look at an account but not act on it. Across the group, the direction is the same. Banks are restricting AI agents to read-only access or steering them through approved open banking channels instead of raw usernames and passwords. AI, tech, and the markets they move—in one daily briefing. Daily. Free. Join 34,000+ readers across crypto, finance, and policy. Jamie Dimon sees rogue agents The issue has already reached the C-suite. During JPMorgan Chase’s third-quarter earnings call on October 13, CEO Jamie Dimon flagged concerns about unauthorized AI agents operating in the banking system. Dimon said there could be “thousands” of rogue agents. For now, the damage appears limited. No widespread thefts or confirmed losses tied to these AI agents have been reported. That has not eased the banks’ concerns. Their worry centers on policy violations and, crucially, on who pays when something goes wrong. The liability question Banks are making their position clear. If a customer hands credentials to an AI agent and that agent does something unauthorized, the customer is on the hook. By putting the responsibility on customers, banks protect themselves from a new category of disputes. They are also nudging users toward the channels they can monitor and control. What this means for fintech and consumers The most immediate effect falls on consumers who have already wired AI assistants into their accounts. Depending on the bank, those setups may lose functionality, get restricted to viewing data, or stop working entirely, as at Morgan Stanley. Customers who keep sharing credentials anyway are accepting real risk. Their banks have now spelled out that unauthorized actions resulting from that sharing are the customer’s problem. For the fintech sector, companies building AI agents that rely on scraping bank log-ins face a shrinking runway as the biggest US banks close that door. Firms that plug into approved open banking channels look better positioned. If banks are going to permit AI agents at all, they want them arriving through the front door with a guest pass, not climbing in through a window with a borrowed key. For now, Bank of America’s request stands. Your AI agent can perhaps look at your balance, but it should not know your password. Disclosure: This article was edited by Diego Almada Lopez. For more information on how we create and review content, see our Editorial Policy https://cryptobriefing.com/editorial-policy/ .