🔍 Read the full analysis: How To Use An AI Agent For Financial Tasks Without Sharing A Login on ThorstenMeyerAI.com
Get the little things that make your day delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Bank of America has warned customers not to share banking credentials with AI tools, saying customers are responsible for activity resulting from access they provide. The report also describes safer alternatives, including read-only permissions, transaction approvals and capped virtual cards, while noting that the legal treatment of AI-agent activity has not been tested in court.
Bank of America warned customers this week not to give their banking usernames or passwords to AI tools or agents, saying customers who share credentials are responsible for activity resulting from that access. The warning comes as financial companies confront AI agents operating in customer accounts and handling payments, raising questions about security, fraud protections and who bears the cost when an agent makes a mistake.
The email, titled “Protecting your finances in the AI World,” says customers should never share their login details with another person or an outside service, including an AI-enabled tool or agent acting on their behalf. A customer posted an image of the email on Bluesky; TechCrunch reported on it October 27, and a Bank of America spokesperson confirmed to the publication that it was authentic. The bank also said it is “excited about what AI used responsibly can deliver.”
The warning does not mean that every AI tool has access to bank accounts. The risk arises when a customer provides credentials or connects an agent in a way that lets it act through the customer’s account. With a shared login, the agent may have the same access as the customer, while the bank may have difficulty distinguishing its activity from the customer’s or from an intruder’s.
The report outlines alternatives that give an agent narrower authority: read-only access, requiring the customer to approve each payment, a virtual card with a spending cap, or a separate account holding only money set aside for the task. Where available, a scoped token could limit an agent to a particular merchant, amount and time period. These controls limit potential exposure, but they do not by themselves settle who is liable for a loss.
Before your agent touches money
Give it a valet key, not the master key
Logging in with your password makes the agent you. A credential made for the agent can do only the job you gave it, and you can take it back.
- What it opensEverything you can do: transfers, payees, settings, statements
- LimitsNone that the agent cannot get around by logging in as you
- What the bank seesYou, or a thief. It cannot tell which
- If a web page tricks itThe trick reaches your whole account
- To take it backChange your password everywhere it was used
- If money goes missingUS rules can exclude transfers by someone you gave access to; Bank of America: “you’re responsible”
- What it opensOnly what you allowed: read-only, one card, one pot of money
- LimitsBuilt in: amount, merchant, time window, approval on your phone
- What the bank seesAn identified agent acting for an identified person
- If a web page tricks itThe damage stops at the limit
- To take it backDisconnect the agent or delete its card. Your password never moved
- If money goes missingDepends on the terms. Read them first: some still put all risk on you
A comparison of two set-ups, not a measurement. Which limits exist depends on your bank, card and app.
Sources: Bank of America customer email, confirmed to TechCrunch (27 Oct 2026); 12 CFR 1005.2(m); OWASP LLM01. Comparison: Thorsten Meyer.
Powered by Thorsten Meyer AI
Limiting an Agent’s Financial Reach
The practical issue is not simply whether an AI agent can perform a task, but how much authority it receives. A login password can grant broad account access for a narrow request, such as paying one bill. If the agent misunderstands an instruction, encounters malicious content, or acts in a way the customer did not intend, broad access can make the consequences harder to contain.
There is also a difference between a technical safeguard and a promise of reimbursement. The source report says Robinhood has built a separate account and spending limits for AI-agent trading, but that its terms say customers “assume all risk” for trades made by their agents. That example underscores why customers should check the terms attached to an agent’s access and read what the provider says about responsibility before enabling automatic actions.
For consumers, narrower permissions can reduce the amount an agent is able to read or spend. For banks and payment companies, the challenge is identifying activity that a customer authorized without treating every automated action as either legitimate or fraud. Approval steps and spending limits can reduce exposure, but the report does not establish that any particular setup guarantees protection from losses.
Products Worth Considering
Levoit Vital 100S-P Air Purifier with Washable Pre-Filter
Garmin Forerunner 70 GPS Running Smartwatch, 43 mm, Black
TheraGun Relief Massage Gun – 3 Speed, Black
As an affiliate, we earn on qualifying purchases.
Banks Confront Agent Access
The article cites an Axios report published October 22, which said, based on unnamed sources, that major U.S. banks were finding third-party AI agents inside customer accounts, often using customers’ own passwords. According to that report, banks can have difficulty determining whether the activity reflects a customer’s instructions. These are reported industry findings, not a public accounting of how many accounts or banks are affected.
The article also points to activity elsewhere in finance. It says Visa told investors on the same Tuesday that trust is the largest barrier to AI agents making payments, and that Robinhood said customers had placed more than $250 million into accounts for AI-agent trading. Those statements indicate that agent-led financial activity is developing, but the source gives no further breakdown of the Robinhood figure, such as the number of customers or the period covered.
AI agents can also be exposed to prompt injection: instructions hidden in material they read, such as web pages, emails or files, that attempt to redirect their behavior. The source identifies prompt injection as a leading risk on the OWASP list for AI applications. That is a separate concern from account-password security, but it matters when an agent can read outside content and take financial actions without a person reviewing each step.
““Your username and password should never be shared with another person or provided to an outside service, including an AI-enabled tool or agent that offers to act on your behalf.””
— Bank of America, in the customer email confirmed as authentic to TechCrunch
Liability Rules Remain Untested
It is not clear how courts or regulators would apply existing consumer-protection rules to an AI agent given access by its customer. The source author interprets U.S. Regulation E as potentially relevant because it excludes some transfers initiated by a person furnished access by the consumer. The author says applying that provision to an AI agent or the company operating it is their reading; no regulator or court ruling on that question is identified.
In the European Union, the article cites PSD2 requirements for customers to take reasonable steps to keep personalized security credentials safe, and rules on losses where a customer acts intentionally or with gross negligence. Whether sharing credentials with an AI agent meets that standard has not, according to the source, been tested in court. This is not a settled legal conclusion, and the applicable rules can depend on the facts and jurisdiction.
The source does not specify which AI-agent products can use read-only access, scoped tokens or approval controls, nor whether particular banks will support those options. It also provides no details on the number of banks encountering agents, the frequency of losses, or how the reported Robinhood account total is measured. The consequences of sharing credentials may also depend on a bank’s account terms and the events surrounding a disputed transaction.
Check Permissions Before Connecting
Before connecting an AI agent to a financial service, customers can check whether it can operate without receiving a banking password and whether the service supports limited permissions, transaction-by-transaction approval or spending caps. They should also review the provider’s terms for responsibility when an agent acts, and confirm how to revoke access if it is no longer needed. A separate account or capped virtual card may reduce the funds exposed, where those options are available.
For companies building financial agents, the issues raised here include designing access that is limited to a specific task, protecting agents from instructions hidden in content they read, and making responsibility for mistakes clear to customers. The source does not identify a timetable for new rules or a specific policy change from Bank of America. The next developments to watch are how banks set account and access policies, what controls agent providers offer, and whether regulators or courts clarify how existing payment protections apply.
Key Questions
Should I give an AI agent my bank password?
Bank of America says customers should not share their username or password with an AI tool or agent. A login may give an agent broad account access, and the bank says customers are responsible for activity resulting from access they provide.
What can I use instead of sharing my login?
Where supported, consider read-only access, approval for every payment, a virtual card with a spending limit, or a separate account with limited funds. A token restricted by merchant, amount and time could also narrow access. Availability depends on the financial service and agent.
Will a bank reimburse me if an AI agent makes an unwanted payment?
The answer is not settled by the source report. It discusses how U.S. and EU rules may apply but says the relevant questions about AI-agent access have not been tested in court. Check your bank’s terms and contact it promptly about a disputed transaction.
What is prompt injection?
Prompt injection is an attempt to steer an AI agent through instructions placed in content it reads, such as a web page, email or file. It can pose a financial risk if an agent can take actions without the customer reviewing them.
Source: ThorstenMeyerAI.com
