🔍 Read the full analysis: The Smart Way To Let AI Help With Money Tasks on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Bank of America has warned customers not to share banking passwords with AI tools, saying customers are responsible for activity resulting from access they provide. The warning comes as financial firms report growing use of AI agents for payments and trading, while legal protections and liability for agent actions remain unsettled.
Bank of America warned customers this week not to share their banking usernames and passwords with AI agents, saying customers who do so are responsible for activity resulting from that access. The warning lands as Visa identifies trust as a major barrier to AI-powered payments and Robinhood says customers have placed more than $250 million in accounts used by AI trading agents.
The bank’s email, titled “Protecting your finances in the AI World,” says login credentials should never be shared with another person or an outside service, including an AI-enabled tool or agent acting on a customer’s behalf. A customer posted the email on Bluesky; TechCrunch reported it on October 27, and a Bank of America spokesperson confirmed its authenticity to the publication. The bank also said it is “excited about what AI used responsibly can deliver.”
Bank of America’s warning focuses on the access a password grants: an agent logging in with a customer’s credentials may be able to do what that customer can do, while the bank may have difficulty distinguishing the agent from the account holder or an intruder. That can create risks both of unwanted transactions and of a bank flagging activity and restricting access.
The source article describes alternatives that grant less authority: read-only access, requiring approval for each payment, setting a limit on a virtual card, or using a payment token restricted to a merchant, amount and time period. A separate account with only a limited balance is another possible safeguard. These controls can limit exposure, but they do not by themselves establish who is legally responsible if an agent makes a mistake or is manipulated.
Before your agent touches money
Give it a valet key, not the master key
Logging in with your password makes the agent you. A credential made for the agent can do only the job you gave it, and you can take it back.
- What it opensEverything you can do: transfers, payees, settings, statements
- LimitsNone that the agent cannot get around by logging in as you
- What the bank seesYou, or a thief. It cannot tell which
- If a web page tricks itThe trick reaches your whole account
- To take it backChange your password everywhere it was used
- If money goes missingUS rules can exclude transfers by someone you gave access to; Bank of America: “you’re responsible”
- What it opensOnly what you allowed: read-only, one card, one pot of money
- LimitsBuilt in: amount, merchant, time window, approval on your phone
- What the bank seesAn identified agent acting for an identified person
- If a web page tricks itThe damage stops at the limit
- To take it backDisconnect the agent or delete its card. Your password never moved
- If money goes missingDepends on the terms. Read them first: some still put all risk on you
A comparison of two set-ups, not a measurement. Which limits exist depends on your bank, card and app.
Sources: Bank of America customer email, confirmed to TechCrunch (27 Oct 2026); 12 CFR 1005.2(m); OWASP LLM01. Comparison: Thorsten Meyer.
Powered by Thorsten Meyer AI
Why Full Account Access Raises Stakes
Giving an agent a banking password can turn a task-specific request into broad account access. A tool asked to pay one invoice may have more authority than needed, and a bank may see its login as the customer’s own activity. That makes it harder to prevent mistakes, detect misuse or resolve a dispute.
The financial consequences may depend on circumstances and jurisdiction. The source article says U.S. Regulation E excludes certain transfers initiated by someone given account access by the consumer, while EU payment rules require customers to take reasonable steps to protect security credentials. How those provisions apply to AI agents has not been decided by a regulator or court, according to the article. The practical message is to check the service’s permissions and terms before connecting an agent, rather than assuming ordinary fraud protections will cover its actions.
For financial firms, the issue is not only whether an AI can complete a transaction. They must also decide how to authenticate the user, restrict an agent’s authority, respond to suspicious activity and allocate responsibility when something goes wrong. The contrast between Visa’s stated trust concern and Robinhood’s reported adoption shows that use is developing even as safeguards and customer expectations are still being worked out.
Products Worth Considering
DJI Osmo Pocket 3 Creator Combo Vlogging Camera with Mic 2, 1 CMOS, 4K/120fps, 3-Axis Stabilization, 128GB Card
Logitech MX Master 4 for Mac, Ergonomic Bluetooth Mouse with Haptic Feedback, Ultra-Fast Scrolling, USB-C Charging, for MacOS, iPadOS, Windo
Jackery HomePower 1000 Plus v2 Portable Power Station
As an affiliate, we earn on qualifying purchases.
Banks Confront Agent Logins
The report says Bank of America’s message followed an October 22 Axios report citing unnamed sources. Axios reported that major U.S. banks were finding third-party AI agents inside customer accounts, generally logged in with customers’ own passwords. It also reported that banks often could not tell whether this activity had been authorized by the customer. Those details are attributed to Axios and its sources, rather than presented here as independently verified findings.
Separately, the article says Visa told investors this week that trust is the largest barrier to AI agents making payments. Robinhood said customers had put more than $250 million into accounts that AI agents trade. The source does not provide a time period or comparison baseline for that amount, so it should be read as a reported total rather than a growth rate or measure of market share.
The underlying technical concern is that agents process material such as webpages, emails and files, which may contain instructions that attempt to redirect the agent. This kind of manipulation is called prompt injection. The source identifies it as a leading risk on the OWASP list for AI applications; it does not establish that any specific bank account or payment agent has been compromised this way.
““If you do share your credentials, keep in mind that you’re responsible for activity resulting from that access.””
— Bank of America, in an email to customers
Liability Rules Remain Untested
No regulator or court ruling applying the cited U.S. or EU rules to an AI agent is identified in the source material. The author characterizes the legal interpretation as a personal reading, not legal advice. Whether a customer who shares credentials would lose protections in a specific case would depend on the applicable law and facts.
It is also unclear how widely banks are encountering agent logins, what controls different services use, and how often agents make unauthorized or mistaken transactions. The source gives no timeframe or baseline for Robinhood’s $250 million figure. It does not provide details about the accounts, the number of users, or the performance and loss record of the agents.
Finally, a smaller permission or spending limit can reduce potential exposure, but the source does not establish that any particular safeguard prevents prompt injection, account errors or disputes. Customers should not treat technical limits as a guarantee that a provider will accept liability.
Check Permissions Before Connecting
Customers considering an AI money tool can review the bank’s and provider’s terms, ask what information and actions the agent can access, and prefer limited permissions over a full login where available. Before approving payments or trading, they can check whether each action requires confirmation, whether limits can be set, and what the provider says about losses and disputes. Keeping an agent away from a primary account’s password is the clearest immediate precaution in the bank’s warning.
Financial firms’ next steps are not detailed in the source material. Banks may continue adjusting their controls and terms as they determine how to identify agent activity, while payment providers and brokerages develop systems for authorizing and limiting agent actions. The questions to watch are whether providers offer narrowly scoped access, how they notify customers about agent activity, and who bears losses when an agent acts outside the customer’s intent.
Key Questions
What did Bank of America tell customers?
The bank said customers should not share their usernames or passwords with another person or an outside service, including an AI-enabled agent. It said customers who share credentials are responsible for activity resulting from that access.
Why can sharing a password create problems?
A password may give an agent broad access, not just permission to complete one task. A bank may also be unable to tell whether a login came from the customer, the customer’s agent or someone who stole the credentials.
Are customers legally responsible for every transaction an AI agent makes?
The source does not establish a universal rule. It discusses U.S. and EU payment provisions but says their application to AI agents has not been tested by a court or regulator. The result may depend on the jurisdiction and circumstances.
What are safer ways to let an agent help with money tasks?
Options described in the source include read-only access, approval for each payment, limited virtual cards, payment tokens restricted by merchant or amount, and a separate account with a limited balance. These controls can reduce access but do not guarantee a particular legal outcome.
Has an AI agent caused the reported bank-account problems?
The source cites an Axios report that banks were finding third-party agents logging into customer accounts and struggling to tell whether the activity was authorized. It does not provide verified figures for resulting losses or establish that prompt injection caused a specific incident.
Source: ThorstenMeyerAI.com
