Your bank password, your liability: 3 US banks put AI-agent losses on you

01An agent uses your bank the way you do: with your password

There are two routes in. In screen-driving, the assistant runs a scripted browser, signs in with the password and one-time code the customer gave it, and clicks through the app as a person would. In the aggregator route, the customer authorises a connector such as Plaid and the agent reads balances through it. JPMorgan told CNBC on 13 October that the second route stays open, read-only, and the first is closed: outside agents cannot log in with a customer’s credentials, send money or pay a bill.⁶

The first route is the problem, because the bank cannot see it. “They also mimic the behavior of actual human users, so it’s really hard to detect,” Mickey Boodaei, chairman of Transmit Security, told American Banker. Some banks block traffic from the addresses of AI providers such as Anthropic or Meta; Transmit’s chief executive, Matt Thompson, said agents get through proxies.³ Andre Durand, chief executive of Ping Identity, put the bank’s two unanswered questions plainly to USA TODAY: how to detect “that it is an agent and not a human asking”, and then “how do we know that the agent is acting on the authority of the human?”²

One incident has been described in public, and only anonymously. A source who asked not to be named told American Banker that at an unnamed large bank an agent “conducted a password reset on an account” and “moved $100,000 out of the account”, after which the bank’s fraud team recommended blocking all external agents.³ We cannot verify it, and no bank has published a count of agent sessions or losses.

02Six weeks, five banks, one line: no agent logs in as you

The statements came in a cluster. Jamie Dimon told analysts on JPMorgan’s third-quarter call on 13 October, “we’re not going to allow just any outside agent to come in inside the company.”³ Charles Schwab’s chief executive, Rick Wurster, told Bloomberg on 16 October that Schwab is blocking “tens and twenties” of attempts by major AI agents to access and manipulate client funds. Citi told USA TODAY: “We do not permit third-party AI agents or assistants to log into a customer’s account or transact directly within our digital banking platforms,” while allowing “limited, read-only access” through Citi-approved open-banking providers.² Wells Fargo said it has “taken steps to block unauthorized agents”; American Banker counts Morgan Stanley among the banks blocking, though it did not comment.³

“When you give the agent your credentials, it is you authorizing the payment.”

His next words matter as much: “put a human being in the loop,” so that “before you pay, you authorize it.”² That is a request for a design change, not only a disclaimer.

03Who carries the loss: read the three clauses

Bank of America’s email, titled “Protecting your finances in the AI World”, asked customers never to share their login details, “including an AI-enabled tool or agent that offers to act on your behalf.”¹ JPMorgan Chase’s Digital Services Agreement, updated in October, says that from 27 October third parties “including External AI, automated tools, or data aggregators” are prohibited from using a customer’s login credentials, and that anyone who has shared them “must change those credentials”.⁴

Wells Fargo goes furthest. Section 15(e) says use of an agent is “AT YOUR OWN RISK” and makes the customer responsible for “unintended actions performed by the AI Agent, actions resulting from incomplete, inaccurate, or manipulated inputs”. That last phrase covers prompt injection, a hidden instruction on a web page that redirects an agent. Until the customer notifies the bank of a revocation, the customer “remain[s] responsible for all the AI Agent’s activities”.⁵

The legal spine is older than AI. Under the US Regulation E, a transfer is not “unauthorized” if it was initiated by a person “who was furnished the access device to the consumer’s account by the consumer”, until the consumer tells the bank that person is no longer authorised.¹¹ Moynihan’s sentence is that rule in plain English. Whether a court reads an AI agent as such a person has not, as far as we found, been tested, and every clause above is hedged with “subject to applicable law”. Jeff McMillan, former head of firmwide AI at Morgan Stanley: “there are no agreed standards yet for how a bank verifies an agent.”³

One adult in five already reports being asked for the very credentials that, once handed over, move the loss onto them.⁷

04What replaces the password: an agent with its own key

The banks are not banning agents; they are banning agents that borrow the customer’s identity. Chase’s agreement permits third-party tools “including External AI, to access customer account data through approved application programming interfaces” with the customer’s authorisation.⁴ This has happened before: about a decade ago Plaid and Mint signed in with customers’ passwords to scrape data, some banks blocked them, and the fight ended in API data-sharing agreements.³

For payments, the card networks want tokens. Mastercard’s Michael Miebach said on 29 October it is “in everybody’s best interest to use Agent Pay and equivalents”, and that one-time virtual card numbers used as a front for an agent’s purchase “fundamentally break the transaction”; he would accept them only as a stopgap. Visa Intelligent Commerce and American Express’s Intent Intelligence take the same token-based route.⁸ For identity, Meta and Sierra have published Poppy, the Personal Agent Protocol: an agent identifies itself, and the customer decides whether it can view an account, make changes, or both. Bank of America and Wells Fargo are design partners, and BBVA joined on 13 October. Poppy does not yet cover payments.⁹¹⁰

05The same problem sits in every company’s browser

None of this is limited to consumers. Wells Fargo’s agreement governs Wells Fargo Business Online as well as personal banking.⁵ Chase’s indemnity clause makes the customer answer for third-party claims arising from the acts of “any employee or agent, such as AI agents or agentic AI”, including “actions that were not within the scope of your agent’s authority”, and for a business it extends to “your employees, consultants, and agents, including AI agents and agentic AI.”⁴ An employee who pastes the treasury login, the payroll portal password or a SaaS admin credential into a browser agent has made the company the guarantor of whatever the agent does. The attacker’s side of the same habit, agents that find a credential and reuse it, is in our piece on CERT-In’s two Critical advisories.