Bank of America tells customers not to give AI tools their banking passwords

What the bank told customers

As finance.technews.tw reported, citing TechCrunch, Bank of America sent customers an email titled "Protecting your finances in the AI World." It asks them never to share a username and password with outside services, including AI tools or agents that claim to act for them.

The message adds that if customers share credentials anyway, they should remember that activity through that access is on them. TechCrunch notes that most banks' account terms already make customers responsible for whoever they give their login to. Bank of America did not immediately respond to a request for comment.

Three risks of sharing a login

TechCrunch lists three dangers. An agent could spend your money without you knowing. The bank might think your account has been hacked and lock you out. And if the AI tool itself has a security hole, your bank credentials could leak to criminals.

An AI agent here means software allowed to take actions for you, such as shopping at the best price or time.

Banks are closing the door

American Banker reports that at least five large US banks are blocking outside AI agents: JPMorganChase, Citi, Bank of America, Wells Fargo and Morgan Stanley. An anonymous source described one agent that reset a password, logged in, changed the approved accounts money could go to, and moved 10萬美元. The bank's fraud team then urged its chief executive to block outside agents entirely.

Per Axios, as cited by TechNewsWorld, many banks are moving to read-only access, where an agent can see data but cannot move money or change settings.

Will blocking last?

Security executives say banks cannot tell an agent's intent from the customer's, since both use the same valid login. Others say read-only access still leaks details. One example given is that transaction history can reveal an employer, medical spending, travel and income.

Jeff McMillan, formerly Morgan Stanley's firmwide head of AI, called blocking reasonable until standards exist for verifying agents, customer permissions and responsibility. But he warned agents will not go away and may simply open accounts at banks with fewer limits. American Banker compared this to a decade ago, when banks first blocked Plaid and Mint from using customer logins, then later moved to API-based agreements.