Banks Are Locking AI Agents Out of Your Accounts

Bank of America, Schwab and four Canadian banks are blocking customer AI agents at the login. From the bank's side of the glass, a logged-in agent and a stolen session are the same thing, and banks block what they cannot tell apart.

Bank of America emailed customers a message titled "Protecting your finances in the AI world," telling them not to share passwords with AI agents. Charles Schwab says it blocks agent login attempts "30, 40, 50 times" a week.

The agent economy's first hard border is the bank login. A bank cannot tell an agent holding your password from a thief holding it, so it refuses the login and leaves you responsible for whatever slips through.

Banks found agents inside customer accounts, then blocked the login

An Oct 22 Axios scoop, relayed by CBC, reported that major U.S. banks, among them Morgan Stanley, Bank of America, JPMorgan and Wells Fargo, "have detected unauthorized third-party AI agents operating inside customer accounts, and in some cases taking actions that appear to be independent of user instructions." The agents are consumer tools such as Meta's Muse, which can connect to accounts with a customer's authorization to monitor balances and transactions.

Why a bank cannot tell your agent from a thief at the login

A login checks one thing: whether the password matches the one the bank has on file. The customer, the customer's agent and a criminal with a phished password all present the same proof.

From the bank's side, your agent's login is a correct password from a device the bank has never seen. That is the profile of a stolen session, and the one defense available at that door is to refuse it.

Schwab's CEO says the firm is "keeping rogue agents from being able to log in on the client's behalf," and that in a given week it might see an agent try "30, 40, 50 times". The blocks show the bank can see the traffic. A blocked attempt still says nothing about whose agent it was, because the password is all the form carries. Both wordings in the receipts fit at once, Schwab's rogue-agent blocks and Axios's detected agents, because traffic can be flagged as agent-like even when its owner cannot be verified; this is our reading of the evidence, and no bank states it in these words. Visa's Michael Jabbara adds the fraud side: criminals build fake agents to steal credentials, so the questions that matter are "who the agent is, who the agent is acting on behalf of". A login form has no way to ask either question.

The account agreement then makes the loss yours

Bank of America's email tells customers they are "responsible for activity resulting from that access." As AI News summarizes it, Wells Fargo's updated Online Access Agreement, effective Nov 24, says that subject to applicable law, transactions from an agent given a customer's login details or authority "can be treated as the customer's own without further verification." The bank can see only the login, so the contract treats whatever the login did as the customer's act.

What you can do today: give agents read-only access the bank approves

Read-only is the lane banks are leaving open, and it is the best evidence for the mechanism above. Axios reported that most banks have authorised, or are moving toward, read-only access that lets an agent view account information without moving money. Schwab plans to let outside AI models check balances and research through its own MCP servers: "We control the authentication experience." Each of these agents arrives through a path the bank built, so the bank can recognize it and the identity question never comes up. That last distinction is ours to draw: internal agents arrive with an identity the bank issued, while customer agents arrive on the customer's password.

Where each bank stands

Per reporting through Nov 1:

Moving money needs credentials issued to the agent, and the rule that would build them is frozen

An agent a bank could admit would carry a credential of its own, scoped to specific permissions, revocable without touching your login, with liability set in advance. Two familiar designs show the shape: OAuth-style tokens, which let an app act for you within a limited scope you can cancel without changing your password, and card tokenization, where a phone pays with a stand-in number the issuer can cancel.

Banks are building a version. Bank of America, BBVA, Synchrony and Wells Fargo have joined the Personal Agent Protocol, built on OAuth, where the customer decides whether an agent gets read-only or write access. The US rule meant to force the plumbing is stuck: a federal court has enjoined the CFPB from enforcing its Section 1033 open banking rule, and a revised proposal had gone to White House review by August 2026 without being published. "With the rule on hold, there is no regulated route for AI agents into bank accounts", as AI News put it.

Until a bank can issue an agent credentials of its own, the login stays the first hard border of the agent economy, because an agent on your password still looks like a stolen session. Watch two things:

• Whether Bank of America or Wells Fargo accept write-capable agents under the protocol, since membership signals a commitment to agent identity and a customer-chosen write option.
• Whether the revised Section 1033 rule gets published, since it would give agents a regulated way in without a password.

Sources: Axios (Oct 22, via CBC News and AI News), CBC News (Oct 29), TechCrunch (Oct 27), InvestmentNews (Oct 28), CNBC (Nov 1), AI News (Oct 30, relaying American Banker, Reuters and Bloomberg).