Major US banks block AI agents from accessing customer accounts

Major US banks are blocking third-party artificial intelligence (AI) agents from accessing customer accounts and making transactions after reports that some automated tools tried to take actions beyond users’ instructions.

Two people familiar with the situation confirmed the restrictions to Reuters on Thursday, October 22, following an Axios report that banks were detecting AI agents operating inside customer accounts.

Morgan Stanley, JPMorgan Chase, Bank of America and Wells Fargo are among the financial institutions dealing with the issue, according to Axios.

Some AI agents reportedly attempted actions that appeared to go beyond what customers had asked them to do. Banks worry that such tools could make purchases or transfer funds without users fully understanding or approving the actions.

How are AI agents getting into bank accounts?

In some cases, customers have given AI assistants their banking usernames and passwords so the tools can access their accounts.

Unlike ordinary chatbots, AI agents can carry out tasks on users' behalf, including navigating websites, retrieving information, and interacting with online services.

The problem arises when an AI tool uses those credentials to log into a bank’s website.

Although a customer may have permitted the access, the bank may not have approved the tool. Many financial institutions require customers to log into their accounts themselves or use authorised third-party services.

A banking industry source told Reuters that banks typically spot and block transactions involving agents using customer credentials.

The source also cautioned that such activity cannot automatically be described as unauthorised if the account holder voluntarily shared the login details.

Axios reported that some banks had also detected AI agents contacting customer service centres or apparently taking actions independently of user instructions.

No confirmed reports show customers losing money as a result of the activity described in the Reuters and Axios reports.

What are JPMorgan and Morgan Stanley doing?

Morgan Stanley has started blocking third-party AI agents from accessing its platforms.

However, a spokesperson told Axios that the bank had not observed rogue AI agents accessing its systems.

JPMorgan Chase is also restricting outside agents.

During the bank’s third-quarter earnings call earlier this month, chief executive Jamie Dimon said the lender was developing safeguards against the risk of AI agents carrying out tasks independently.

He said allowing unrestricted access to outside agents would pose risks to both customers and the bank.

Charles Schwab is taking similar precautions.

Chief executive Rick Wurster said the financial services company already blocks unauthorised agents trying to log in on clients' behalf.

Wurster said he receives daily reports on blocked attempts, although the numbers remain relatively small.

Will banks allow AI tools to access accounts?

Banks are not ruling out AI-assisted financial services altogether.

Several institutions already allow approved third-party applications to retrieve account information, such as balances and transaction histories, without giving those services permission to transfer money.

For example, Citi has said it does not allow third-party AI agents to log directly into account holder accounts or conduct transactions through its digital banking platforms.

However, customers can still authorise limited access to their information through certain approved providers.

Schwab is also developing ways for customers to connect AI tools to its services through controlled systems, while restricting higher-risk activities such as moving money.

For now, the concern is how banks can tell whether an AI agent is following a customer’s instructions or attempting something the customer never intended.

The reports also highlight the risks of sharing banking passwords with AI tools that financial institutions have not approved.