---
title: "Your bank password, your liability: 3 US banks put AI-agent losses on you"
summary: "What Bank of America, JPMorgan, Wells Fargo, Citi and Schwab said and signed about AI agents in customer accounts, 13 October to 24 November 2026, and what replaces the password."
url: https://www.thetechbag.com/blog/banks-ai-agents-your-password-your-liability
format: Analysis
desk: "AI in the enterprise"
published: 2026-10-29
facts_checked: 2026-10-29
author: TechBag (The TechBag Journal)
tags: ["AI agents","banking","Bank of America","JPMorgan Chase","Wells Fargo","Mastercard Agent Pay","Poppy","UPI Circle","NPCI","RBI","passkeys"]
cover: https://www.thetechbag.com/blog/covers/banks-ai-agents-your-password-your-liability.png
---

# Your bank password, your liability: 3 US banks put AI-agent losses on you

*What Bank of America, JPMorgan, Wells Fargo, Citi and Schwab said and signed about AI agents in customer accounts, 13 October to 24 November 2026, and what replaces the password.*

Analysis · AI in the enterprise · By TechBag · Published 2026-10-29 · Facts checked 2026-10-29 · Canonical: https://www.thetechbag.com/blog/banks-ai-agents-your-password-your-liability

The short version

- Give an AI agent your banking password and, under terms three of America’s largest banks put in writing this month, whatever it does is yours. Bank of America told customers they are “responsible for activity resulting from that access”; JPMorgan Chase’s agreement says you assume “the entire risk”; Wells Fargo’s, from 24 November, treats an agent’s transactions as “authorized directly by you, without further verification”.[1][4][5]
- The reason is mechanical, not moral. An agent that logs in with your password and one-time code looks to the bank exactly like you, so the banks are blocking credential log-ins and offering read-only access through approved interfaces instead.[2][3]
- The replacement is delegated, scoped access: an agent with its own credential, read-only by default, paying through card-network tokens with limits. India’s UPI already runs a version of this for devices and software, capped at ₹5,000 a payment. A company should adopt the same rule for its own logins now; the US terms already reach business accounts and the acts of employees’ agents.[14][4]

Consumer AI assistants can now open a banking app, read the balance and pay a bill, and in October the largest US banks said so in public. Meta reported that its Muse assistant reached ten million users on 21 October.[2] By 27 October Bank of America had emailed its customers asking them not to share their logins with one.[1] The question for anyone who uses one of these agents, or employs people who do, is simple and the answers are not yet tidy: when an agent moves money with your credentials and gets it wrong, who pays, and what should replace the password while the industry argues about it?

## An agent uses your bank the way you do: with your password

There are two routes in. In screen-driving, the assistant runs a scripted browser, signs in with the password and one-time code the customer gave it, and clicks through the app as a person would. In the aggregator route, the customer authorises a connector such as Plaid and the agent reads balances through it. JPMorgan told CNBC on 13 October that the second route stays open, read-only, and the first is closed: outside agents cannot log in with a customer’s credentials, send money or pay a bill.[6]

The first route is the problem, because the bank cannot see it. “They also mimic the behavior of actual human users, so it’s really hard to detect,” Mickey Boodaei, chairman of Transmit Security, told American Banker. Some banks block traffic from the addresses of AI providers such as Anthropic or Meta; Transmit’s chief executive, Matt Thompson, said agents get through proxies.[3] Andre Durand, chief executive of Ping Identity, put the bank’s two unanswered questions plainly to USA TODAY: how to detect “that it is an agent and not a human asking”, and then “how do we know that the agent is acting on the authority of the human?”[2]

**Figure: To the bank, a screen-driving agent is the customer: same password, same code, same clicks**

*How a consumer AI agent reaches a bank account by credential sharing, as described by banks and fraud vendors, October 2026*

1. 01The customer hands over the keysUsername, password, and often the one-time code or the inbox it arrives in, given to a consumer assistant.
2. 02The agent drives the appA scripted browser signs in from the provider’s cloud or through a proxy, and reads, clicks and types as a person would.
3. 03The bank sees a valid sessionRight password, right code, human-like behaviour. Address blocks catch some agents; proxies defeat them.
4. 04The contract says it was youInstructions that arrive with your login credentials are treated as genuine and authorised by you.

Source: American Banker (27 Oct 2026); USA TODAY (23 Oct 2026); JPMorgan Chase Digital Services Agreement (Oct 2026) · as of 29 October 2026

One incident has been described in public, and only anonymously. A source who asked not to be named told American Banker that at an unnamed large bank an agent “conducted a password reset on an account” and “moved $100,000 out of the account”, after which the bank’s fraud team recommended blocking all external agents.[3] We cannot verify it, and no bank has published a count of agent sessions or losses.

## Six weeks, five banks, one line: no agent logs in as you

The statements came in a cluster. Jamie Dimon told analysts on JPMorgan’s third-quarter call on 13 October, “we’re not going to allow just any outside agent to come in inside the company.”[3] Charles Schwab’s chief executive, Rick Wurster, told Bloomberg on 16 October that Schwab is blocking “tens and twenties” of attempts by major AI agents to access and manipulate client funds. Citi told USA TODAY: “We do not permit third-party AI agents or assistants to log into a customer’s account or transact directly within our digital banking platforms,” while allowing “limited, read-only access” through Citi-approved open-banking providers.[2] Wells Fargo said it has “taken steps to block unauthorized agents”; American Banker counts Morgan Stanley among the banks blocking, though it did not comment.[3]

> “When you give the agent your credentials, it is you authorizing the payment.”Brian Moynihan, Bank of America chief executive, to Bloomberg on 15 October, as reported by USA TODAY

His next words matter as much: “put a human being in the loop,” so that “before you pay, you authorize it.”[2] That is a request for a design change, not only a disclaimer.

**Figure: In six weeks the US banks went from warning about agents to writing them into their contracts**

*Public statements and agreement changes on consumer AI agents by US banks and Mastercard, 13 October to 24 November 2026*

| Date | Event | Detail |
| --- | --- | --- |
| 13 Oct 2026 | JPMorgan shuts the door | Dimon on the Q3 call; a spokeswoman tells CNBC agents may read balances via Plaid but not move money |
| 15 Oct 2026 | Moynihan to Bloomberg | “it is you authorizing the payment” |
| 16 Oct 2026 | Schwab: “tens and twenties” | Wurster on agent attempts blocked |
| 21 Oct 2026 | Meta's Muse at 10 million users | Meta's own figure, via USA TODAY |
| 23 Oct 2026 | Citi: no agent log-ins | access limited to reading data, through approved open-banking providers |
| 27 Oct 2026 | BofA email; Chase ban in force | BofA email reported:“you're responsible”; Chase bars External AI from using login credentials |
| 29 Oct 2026 | Mastercard: use tokens | Miebach on the Q3 call |
| 24 Nov 2026 | Wells Fargo terms take effect | agent transactions deemed authorised by you |

Source: American Banker; USA TODAY; PYMNTS (CNBC report); TechCrunch; JPMorgan Chase and Wells Fargo agreement texts · as of 29 October 2026 · dates are when each statement was made or reported; the 24 November date is an agreement's stated effective date

## Who carries the loss: read the three clauses

Bank of America’s email, titled “Protecting your finances in the AI World”, asked customers never to share their login details, “including an AI-enabled tool or agent that offers to act on your behalf.”[1] JPMorgan Chase’s Digital Services Agreement, updated in October, says that from 27 October third parties “including External AI, automated tools, or data aggregators” are prohibited from using a customer’s login credentials, and that anyone who has shared them “must change those credentials”.[4]

ReportedThe clauses, verbatim

**Bank of America, customer email (reported 27 October):** “If you do share your credentials, keep in mind that you’re responsible for activity resulting from that access.”[1]

**JPMorgan Chase, Digital Services Agreement (October 2026), in capitals in the original:** “SUBJECT TO APPLICABLE LAW, YOU ASSUME THE ENTIRE RISK FOR THE FRAUDULENT, UNAUTHORIZED OR OTHERWISE IMPROPER USE OF YOUR LOGIN CREDENTIALS.”[4]

**Wells Fargo, Online Access Agreement, section 15(d), effective 24 November:** “Any instructions, actions, or transactions initiated by the AI Agent are deemed to have been initiated and authorized directly by you, without further verification, and we have no obligation to investigate the validity or scope of such authority.”[5]

Wells Fargo goes furthest. Section 15(e) says use of an agent is “AT YOUR OWN RISK” and makes the customer responsible for “unintended actions performed by the AI Agent, actions resulting from incomplete, inaccurate, or manipulated inputs”. That last phrase covers prompt injection, a hidden instruction on a web page that redirects an agent. Until the customer notifies the bank of a revocation, the customer “remain[s] responsible for all the AI Agent’s activities”.[5]

The legal spine is older than AI. Under the US Regulation E, a transfer is not “unauthorized” if it was initiated by a person “who was furnished the access device to the consumer’s account by the consumer”, until the consumer tells the bank that person is no longer authorised.[11] Moynihan’s sentence is that rule in plain English. Whether a court reads an AI agent as such a person has not, as far as we found, been tested, and every clause above is hedged with “subject to applicable law”. Jeff McMillan, former head of firmwide AI at Morgan Stanley: “there are no agreed standards yet for how a bank verifies an agent.”[3]

**Figure: Most Americans do not want an agent moving their money, and one in five say an agent has already asked for their login**

*Share of US adults, Morning Consult survey for the American Bankers Association (more than 4,000 adults), released 27 October 2026*

77%

Concerned about giving an AI tool or agent permission to move money

27%

Likely to let an agent manage cash balances on its own

61% unlikely

19%

Say an AI agent has already asked them for login credentials or card numbers

Source: ABA Banking Journal (27 Oct 2026); sample size from American Banker (27 Oct 2026) · as of 27 October 2026 · field dates and margin of error were not published in the pages we could read

One adult in five already reports being asked for the very credentials that, once handed over, move the loss onto them.[7]

## What replaces the password: an agent with its own key

The banks are not banning agents; they are banning agents that borrow the customer’s identity. Chase’s agreement permits third-party tools “including External AI, to access customer account data through approved application programming interfaces” with the customer’s authorisation.[4] This has happened before: about a decade ago Plaid and Mint signed in with customers’ passwords to scrape data, some banks blocked them, and the fight ended in API data-sharing agreements.[3]

For payments, the card networks want tokens. Mastercard’s Michael Miebach said on 29 October it is “in everybody’s best interest to use Agent Pay and equivalents”, and that one-time virtual card numbers used as a front for an agent’s purchase “fundamentally break the transaction”; he would accept them only as a stopgap. Visa Intelligent Commerce and American Express’s Intent Intelligence take the same token-based route.[8] For identity, Meta and Sierra have published Poppy, the Personal Agent Protocol: an agent identifies itself, and the customer decides whether it can view an account, make changes, or both. Bank of America and Wells Fargo are design partners, and BBVA joined on 13 October. Poppy does not yet cover payments.[9][10]

**Figure: The fix is not a ban on agents; it is an agent with its own credential, its own limits and its own off switch**

*Credential sharing against delegated, scoped access for consumer AI agents, as set out by US banks and card networks, October 2026*

Credential sharing (today)

- The agent holds your full password, and can reset it
- It can do everything you can, including adding payees
- The bank cannot tell it from you
- Revoking it means changing your password
- Under the clauses above, the loss is yours

Delegated, scoped access (what is being built)

- The agent gets its own grant through an approved interface
- Read-only by default (Citi, JPMorgan today)
- Payments through network tokens that carry intent and limits
- The agent says who it is; you choose view or change (Poppy, no payments yet)
- One grant revoked without touching your password

Source: JPMorgan Chase Digital Services Agreement; Citi via USA TODAY; American Banker (29 Oct 2026); PYMNTS on Poppy (12 Oct 2026) · as of 29 October 2026

Our view

Our view: the clauses shift risk to the party least able to judge it, and they are fair only once a better route exists. When a bank offers an agent a token with a limit and an off switch, a customer who still hands over a password has made a choice. Until then, mostly, the customer has not been offered one.

## The same problem sits in every company’s browser

None of this is limited to consumers. Wells Fargo’s agreement governs Wells Fargo Business Online as well as personal banking.[5] Chase’s indemnity clause makes the customer answer for third-party claims arising from the acts of “any employee or agent, such as AI agents or agentic AI”, including “actions that were not within the scope of your agent’s authority”, and for a business it extends to “your employees, consultants, and agents, including AI agents and agentic AI.”[4] An employee who pastes the treasury login, the payroll portal password or a SaaS admin credential into a browser agent has made the company the guarantor of whatever the agent does. The attacker’s side of the same habit, agents that find a credential and reuse it, is in [our piece on CERT-In’s two Critical advisories](https://www.thetechbag.com/blog/cert-in-ai-agents-no-victim-noticed).

**Figure: A company's agent policy fits on one page: no shared logins, scoped grants, human approval for money**

*Five controls for AI agents that touch corporate banking and SaaS logins, TechBag's sequence, October 2026*

Step 1 of 5

1. No shared logins, written down

No employee gives a bank, payroll, finance or SaaS admin credential to an AI agent or agent browser extension. Put it in the acceptable-use policy; the bank terms already put the loss on the company.

Source: TechBag analysis of the JPMorgan Chase and Wells Fargo agreement terms; Ping Identity via USA TODAY · as of 29 October 2026

TechBag countTechBag count: the identity tools authenticate people better than agents

Of the 30 products in TechBag’s IAM, SSO and MFA guide, 20 document FIDO2 or passkey sign-in, which covers step four. Only 3 document service-account and workload authentication as a capability, which is step two. We counted the phishing-resistant and machine-authentication fields on each product card.[17] Step two usually lives in privileged-access and secrets tooling.

If you are buying this in India

India has stated the principle the US banks are now trying to fit afterwards. NPCI’s chairman, Ajay Kumar Choudhary, at the Global Fintech Fest in Mumbai on 10 September: “Decision making and execution must remain separate.” And: “AI may recommend, but authentication and final settlement must follow deterministic auditable rules.” He said NPCI is “examining the protocols that may be required to identify and authorise digital agents”.[12] A “Unified Agent Protocol” for UPI was reported by Business Standard in July; NPCI has published no specification.[12]

The plumbing for scoped delegation already exists. UPI Circle (NPCI circular OC 201, August 2024) lets a primary user delegate to up to five secondary users; under partial delegation the “primary user shall complete UPI transaction with UPI PIN”, and apps must make a passcode or biometric mandatory for every secondary user.[13] Circular OC 201-B (8 October 2025) extended Circle to devices and software: only NPCI-authorised devices, merchant payments only, ₹15,000 a month and ₹5,000 a payment per device, a ₹5,000 cap in the first 24 hours, and the issuer bank validating both the device ID and the user ID before any debit.[14] That is an agent with its own key and its own limit, which is what Section 4 describes the US building.

On liability, the RBI’s Authentication Directions (25 September 2025, compliance from 1 April 2026) require two distinct factors, one of them dynamic, and say that if a loss arises from a transaction that did not comply, “the issuer shall compensate the customer for the loss in full without demur.”[15] A customer who hands an agent both factors, the UPI PIN included, has given away what that rule protects. RBI’s press releases from 23 to 29 October contain nothing on AI agents, and NPCI’s website could not be read, so we found no October statement from either and predict none.[16] For an Indian company the action is the policy above: no net-banking or UPI credentials to any agent, corporate payments through maker-checker, and agents kept to read-only.

How we did this

Figures as of 29 October 2026

The Wells Fargo clauses are quoted from the bank’s upcoming Online Access Agreement (version effective 24 November 2026), sections 2(d), 8(b), 15(d) to 15(f), fetched from wellsfargo.com. The JPMorgan clauses are quoted from the Chase Digital Services Agreement PDF marked “Last updated: October 2026”. Bank of America’s email is quoted as TechCrunch reproduced it. The Moynihan and Wurster remarks were given to Bloomberg and are cited to USA TODAY, which relayed them; JPMorgan’s statement to CNBC is cited through PYMNTS; Bloomberg, CNBC and Axios were not read. The ABA press release returned 403, so the sample size is American Banker’s and field dates are unknown. The $100,000 case rests on one anonymous source. UPI Circle limits come from a reproduction of OC 201 and Khaitan & Co’s summary of OC 201-B; NPCI’s pages returned 403 or 503. The IAM count is TechBag’s. Ping Identity and Palo Alto Networks survey figures were left out: no sample size was published with them.

Spotted an error? Write to us; corrections are published at the foot of the piece.

Sources

1. [TechCrunch (Zack Whittaker): Bank of America kindly asks that you don't share your banking password with your AI assistant](https://techcrunch.com/2026/10/27/bank-of-america-kindly-asks-that-you-dont-share-your-banking-password-with-your-ai-assistant/) — 27 October 2026
2. [USA TODAY (Greta Reich), via Yahoo Finance: 'Window of vulnerability': Banks move to restrict AI agent access (relays Bloomberg interviews of 15 and 16 Oct)](https://finance.yahoo.com/technology/ai/articles/window-vulnerability-banks-move-restrict-202731426.html) — 23 October 2026
3. [American Banker (Penny Crosman): Banks are blocking external AI agents. Is this sustainable?](https://www.americanbanker.com/news/banks-are-blocking-external-ai-agents-is-this-sustainable) — 27 October 2026 Updated 28 October 2026.
4. [JPMorgan Chase, Digital Services Agreement (key changes effective 27 Oct 2026; risk, indemnity and External AI clauses)](https://www.chase.com/content/dam/legal-agreements/library/en/dsa_la/versions/dsa_la.pdf) — last updated October 2026 Fetched 29 October 2026.
5. [Wells Fargo, Online Access Agreement, version effective 24 November 2026, sections 2(d), 8(b), 15](https://www.wellsfargo.com/online-banking/online-access-agreement/upcoming/) — effective 24 November 2026 Fetched 29 October 2026.
6. [PYMNTS: Jamie Dimon Slams the Door on Rogue AI Agents (reports JPMorgan's statement to CNBC)](https://www.pymnts.com/?p=4312577) — 14 October 2026
7. [ABA Banking Journal: ABA survey: U.S. consumers wary of AI agents handling their money, bank account information (Morning Consult)](https://bankingjournal.aba.com/?p=68472) — 27 October 2026
8. [American Banker (Joey Pizzolato): Mastercard touts the importance of agentic tokens](https://www.americanbanker.com/payments/news/mastercard-touts-the-importance-of-agentic-tokens) — 29 October 2026
9. [PYMNTS: Meta and Sierra's Poppy Lets Customers Set Limits for AI Agents](https://www.pymnts.com/?p=4302401) — 12 October 2026
10. [BBVA: BBVA will help design a common protocol led by Sierra AI and Meta to connect AI agents with businesses](https://www.bbva.com/en/innovation/bbva-helps-design-a-common-protocol-led-by-sierra-ai-and-meta-to-connect-ai-agents-with-businesses/) — 13 October 2026
11. [CFPB, Regulation E, 12 CFR 1005.2(m): definition of unauthorized electronic fund transfer](https://www.consumerfinance.gov/rules-policy/regulations/1005/2/) — current version, fetched 29 October 2026
12. [MediaNama (Anjali Tripathi): AI agents can read intent, not approve payments: NPCI chairman at GFF 2026](https://www.medianama.com/2026/09/223-npci-ai-agents-upi-payments/) — 10 September 2026 Updated 29 September 2026.
13. [NPCI/UPI/OC No. 201/2024-25, Introduction of UPI Circle: Delegated Payments, via TaxGuru reproduction](https://taxguru.in/?p=929492) — 13 August 2024 NPCI's own page returned 403.
14. [Khaitan & Co, ERGO: Enabling Agentic Payments on UPI Rails (summary of NPCI OC 201-B of 8 October 2025)](https://www.khaitanco.com/sites/default/files/2025-11/ERGO%20-%20Enabling%20Agentic%20Payments%20%20on%20UPI%20Rails%20-%2020%20November%202025.pdf) — 20 November 2025
15. [RBI, Reserve Bank of India (Authentication mechanisms for digital payment transactions) Directions, 2025, RBI/2025-26/79, paras 3, 6 and 9](https://www.rbi.org.in/Scripts/NotificationUser.aspx?Id=12898) — 25 September 2025
16. [RBI, press releases listing, 23 to 29 October 2026](https://www.rbi.org.in/Scripts/BS_PressReleaseDisplay.aspx) — undated page
17. [TechBag, IAM, SSO & MFA guide: 30 product cards, phishing-resistant and machine-authentication fields](https://www.thetechbag.com/browse/identity-access/iam-sso-mfa) — October 2026

Related on TechBag: the [IAM, SSO & MFA guide](https://www.thetechbag.com/browse/identity-access/iam-sso-mfa) compares passkey support across 30 products; the [privileged access guide](https://www.thetechbag.com/browse/identity-access/privileged-access-management) covers the tools that give agents their own scoped credentials; the [BFSI obligations register](https://www.thetechbag.com/industries/bfsi/obligations) tracks the RBI duties cited here.

**Disclosure.** TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view.

Go deeper on TechBag

- [IAM, SSO & MFA guide](https://www.thetechbag.com/browse/identity-access/iam-sso-mfa) — passkey and machine-authentication support across 30 products
- [Privileged access management guide](https://www.thetechbag.com/browse/identity-access/privileged-access-management) — the tools that give agents their own scoped credentials
- [BFSI obligations: RBI, SEBI and CERT-In duties, dated](https://www.thetechbag.com/industries/bfsi/obligations) — the RBI authentication and reporting duties in context