🔍 Read the full analysis: A Guide To Safer Financial Automation With AI Agents on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Bank of America has warned customers not to share banking passwords with AI tools, saying customers are responsible for activity resulting from shared credentials. The warning comes as financial firms grapple with AI agents accessing accounts and making transactions, while liability rules and safer access standards remain unsettled.
Bank of America has warned customers not to share their usernames or passwords with AI agents, saying they are responsible for activity resulting from access they grant. The warning comes as financial companies report customers using agents to trade or pay, raising questions about account security, consumer protections and who bears losses when an agent acts.
The email, titled “Protecting your finances in the AI World,” was posted by a customer on Bluesky and reported by TechCrunch on October 27. A Bank of America spokesperson confirmed to TechCrunch that the email was authentic. It says credentials should not be shared with another person or provided to an outside service, including an AI-enabled tool or agent acting on a customer’s behalf. The bank also says that if customers share credentials, they are responsible for activity resulting from that access, while expressing support for AI used responsibly.
The warning lands amid competing signs of rapid adoption. According to the source report, Visa told investors this week that trust is the biggest barrier to AI agents that make payments. Robinhood said customers have put more than $250 million into accounts that AI agents trade. Those figures do not, by themselves, establish how many users are involved or how much trading activity agents have carried out.
A separate Axios report dated October 22, citing unnamed sources, said major U.S. banks are finding third-party AI agents inside customer accounts, often logged in with customers’ own passwords. The report said banks may struggle to distinguish activity the customer intended from activity they did not authorize. These accounts of bank activity are attributed to Axios; the source material provides no independent figures on the scale of the issue.
Before your agent touches money
Give it a valet key, not the master key
Logging in with your password makes the agent you. A credential made for the agent can do only the job you gave it, and you can take it back.
- What it opensEverything you can do: transfers, payees, settings, statements
- LimitsNone that the agent cannot get around by logging in as you
- What the bank seesYou, or a thief. It cannot tell which
- If a web page tricks itThe trick reaches your whole account
- To take it backChange your password everywhere it was used
- If money goes missingUS rules can exclude transfers by someone you gave access to; Bank of America: “you’re responsible”
- What it opensOnly what you allowed: read-only, one card, one pot of money
- LimitsBuilt in: amount, merchant, time window, approval on your phone
- What the bank seesAn identified agent acting for an identified person
- If a web page tricks itThe damage stops at the limit
- To take it backDisconnect the agent or delete its card. Your password never moved
- If money goes missingDepends on the terms. Read them first: some still put all risk on you
A comparison of two set-ups, not a measurement. Which limits exist depends on your bank, card and app.
Sources: Bank of America customer email, confirmed to TechCrunch (27 Oct 2026); 12 CFR 1005.2(m); OWASP LLM01. Comparison: Thorsten Meyer.
Powered by Thorsten Meyer AI
The Risks of Giving Agents Account Access
Sharing a password can give an agent the same broad access as the account holder, rather than permission for one specific task. If an agent is meant only to read balances or pay a particular invoice, a full login may expose other financial functions and make it harder for a bank to tell the difference between a customer, a delegated agent and an intruder.
That distinction may matter when a transaction goes wrong. The source report notes that U.S. Regulation E excludes from its definition of an unauthorized transfer one initiated by someone the customer furnished with an access device, subject to the rule’s terms. The author’s view that this could apply to an AI agent is an interpretation, not a ruling by a regulator or court. In the EU, PSD2 requires customers to take reasonable steps to keep personalized security credentials safe; whether giving credentials to an agent could amount to gross negligence has not been tested in court, according to the source.
There is also a technical risk: agents process outside material such as web pages, emails and files, which may contain instructions designed to manipulate their behavior. The source identifies this as prompt injection and says it is ranked as the top risk on OWASP’s AI application list. Limiting what an agent can access or spend can reduce the potential consequences, but it does not automatically settle responsibility for a loss.
Products Worth Considering
Bose QuietComfort Wireless Bluetooth Headphones with Active Noise Cancellation, Mic, USB‑C Charging, Deep Bass, 24‑Hour Battery – White Smok
Logitech MX Master 4 for Mac, Ergonomic Bluetooth Mouse with Haptic Feedback, Ultra-Fast Scrolling, USB-C Charging, for MacOS, iPadOS, Windo
LG UltraGear 27-Inch QHD OLED Gaming Monitor, 240Hz, 0.03ms, G-SYNC Compatible, FreeSync Premium Pro, HDMI 2.1
As an affiliate, we earn on qualifying purchases.
Banks Face an Agent Access Problem
The central problem is that a bank login is designed to authenticate a person or device, not necessarily to express limited permission for an AI system. When an agent uses a customer’s password, its actions can appear to the bank as the customer’s own activity. Banks may then have difficulty deciding whether to block suspicious actions, allow them, or investigate after a complaint.
The source recommends treating credentials as a master key, not as a convenient way to connect an agent. More restricted alternatives include read-only access, approval before each payment, virtual cards with spending caps, tokens limited to a specific merchant, amount and time window, or a separate account holding only funds the agent is allowed to use. These are proposed safety patterns in the source, not a claim that every bank or agent currently supports them.
“Your username and password “should never be shared with another person or provided to an outside service, including an AI-enabled tool or agent that offers to act on your behalf.””
— Bank of America, in the customer email
Liability Rules Are Not Settled
No regulator or court ruling identified in the source determines whether sharing a banking password with an AI agent falls under the U.S. access-device rule or how responsibility would be divided among a customer, bank and agent provider. The source’s discussion of Regulation E and PSD2 is an interpretation of the texts, not legal advice or a definitive account of how a case would be decided.
It is also unclear how widespread unauthorized agent access is. The October 22 Axios report relied on unnamed sources, and the source material offers no count of affected accounts, losses or blocked transactions. It does not provide detailed terms for Visa’s or Robinhood’s statements, or explain how Robinhood’s separate account and limits work in practice. The extent to which safer access options are available across banks and agent products is not specified.
What Customers and Providers Can Do
For customers, the immediate step supported by the warning is straightforward: do not give an AI agent a banking password. Before connecting any financial tool, check what permissions it receives, whether payments require approval, what limits apply, how access can be revoked and what the provider says about responsibility for losses. A separate, capped pool of funds may reduce exposure compared with connecting a primary account, but it is not a guarantee against loss.
Financial firms and agent providers will need to make permission controls and liability terms clear if they want customers to trust automated transactions. The source points to narrowly scoped tokens, read-only access and per-payment approvals as safer design choices, but gives no announced implementation timetable or common industry standard. Until those details emerge, customers should treat access controls and contractual terms as separate questions: safeguards may limit what an agent can do without deciding who pays when something goes wrong.
Key Questions
What did Bank of America tell customers?
It warned customers not to share banking usernames or passwords with people or outside services, including AI agents. The email says customers are responsible for activity resulting from credentials they share.
Does sharing a password mean a customer loses fraud protection?
That is not established by a court or regulator in the material provided. The source discusses U.S. and EU rules that could be relevant, but says how they apply to AI agents remains untested.
What is safer than giving an agent a full bank login?
Options described in the source include read-only access, approval for each payment, a virtual card with a spending cap, a token restricted by merchant, amount and time, or a separate account with limited funds. Availability depends on the bank and service.
What is prompt injection?
It is an attempt to steer an AI agent through instructions placed in material it reads, such as a web page, email or file. The source identifies it as a risk for agents that handle financial tasks.
Source: ThorstenMeyerAI.com
