An account holder who connects an AI agent to a bank account may not know everything the agent can do with that access. Technology founder and investor Shane Mac told followers on X that he found this out in early October. He had given an AI agent access to his bank accounts so it could audit his finances. Then an AI agent posted his checking account balance and a detailed breakdown of his spending in his company’s executive Slack channel, where his colleagues read it. The message appeared as if Mac himself had written it. Mac said he had not realized the agent holding his bank information could confer with the separate agent he used for work messages.
Security teams often describe people as the weakest link in cybersecurity. Mac shows the problem in its hardest form. He is a technology founder, someone with every reason to understand what an AI agent can do, and he still gave one access to his accounts without knowing where the information could travel. An account holder with no technical background will make the same mistake more easily. When that happens and the result goes wrong, the institution that holds the account is the one the account holder contacts, even though the instruction came from the account holder.
“An account holder can authorize a goal. The agent chooses the actions. The gap between the two is where disputes start.”
Two kinds of agents already reach institutions
Unauthorized agents come first. American Banker reported on Oct. 27 that an unnamed large bank watched an agent reset the password on an account, change the approved transfer destinations, and move $100,000. One anonymous source supplied the story. The bank’s fraud team recommended blocking all external agents. At least five large banks now block them: JPMorgan, Citi, Bank of America, Wells Fargo, and Morgan Stanley. Jamie Dimon said on JPMorgan’s Oct. 13 earnings call that rogue agents could number in the thousands. Comptroller of the Currency Jonathan Gould, asked twice on Fox Business whether customers would get their money back after an unauthorized agent moved it, did not say.
Authorized agents come second. Few account holders have authorized an agent to act inside an account today. No one has published a count, so that is a judgment, and it will not last. American Banker reports that an upcoming American Bankers Association survey of more than 4,000 adults found 77 percent concerned about giving an agent permission to move money. That worry describes the cautious majority. A smaller group has already begun connecting agents, and the cautious will follow if the agents prove useful.
Marketing and digital leaders at community institutions report that their security teams have begun asking what agents can do inside an account. An agent acting inside an account, authorized or not, gets in through a login. Every institution whose account holders have logins carries that exposure, whatever its size.
The exposure sits in the vague instruction
Regulators wrote Regulation E to implement a 1978 law, long before the internet reached consumers. Under the rule, a transfer is unauthorized when someone other than the account holder initiates it without actual authority and the account holder receives no benefit. Regulators treat a transfer as authorized when the account holder gave someone access and authority and has not told the institution to stop. Access gained through fraud receives different treatment. The rule and its commentary were written before software agents existed in this role.
Institutions have started answering the question in their own agreements. Wells Fargo’s agreement, effective Nov. 24, counts transactions by an account holder’s delegates, including their AI agents, as authorized by the account holder, “including those you did not want or intend.” The account holder alone supervises the agent. American Banker reports that JPMorgan’s agreement tells customers they assume the entire risk of improper use of their login credentials. Dimon calls it a “liability transfer.”
Vague instructions are the hard case. An account holder tells an agent to find the best savings rate. The agent chooses which accounts to open and which transfers to make. Whether those choices fall within the account holder’s authority has no settled answer. Jeff McMillan, who ran firmwide AI at Morgan Stanley until March, told American Banker that no agreed standard yet defines what a customer authorized an agent to do.
Institutions whose agreements say nothing about agents leave the answer to a dispute. Most account holders will never read the clause. Institutions need to explain in plain language what handing over a login means, and to explain it before the account holder connects an agent.
Blocking has limits
Blocking is the large-bank answer, and it has two limits. First, banks cannot reliably detect agents that behave like people. Executives at Transmit Security, a provider of identity and fraud prevention software, told American Banker that agents copy human typing and clicking, strip out identity data, and route through proxies. Banks catch the agents that identify themselves. Banks built device recognition, behavioral biometrics, and transaction profiling to spot humans. Transmit sells that software, so its executives have a stake in the diagnosis. Second, McMillan expects blocked agents to open accounts for consumers at firms that block less.
A precedent exists. Banks first blocked screen scrapers such as Plaid and Mint, then signed agreements with data aggregators to share data through standard connections. Similar work has begun for agents. Lead Bank has proposed a liability framework. Meta and Sierra introduced Poppy so that agents can identify themselves and get customer permission, with Bank of America and Wells Fargo as design partners. The Financial Data and Technology Association published recommendations on liability and authorization on Oct. 26. Community institutions will likely inherit whatever standards emerge through their core and digital banking providers. Until then, the work that belongs to them is disclosure and education.
Business accounts offer a model. Institutions already give accountants and bookkeepers limited access. Wells Fargo lets account owners appoint delegates at a View Only tier or a View and Transact tier, and each delegate holds a separate username and password. An institution could issue agents the same kind of credential. When an agent borrows the account holder’s login, the institution cannot tell one from the other. With a separate credential, the institution knows who is acting, can set limits for that actor alone, and can end its access with a single revocation. Sensible limits include read-only access by default, a cap on each transfer, a list of approved destination accounts, and an expiration date.
The model has gaps. An agent has no legal identity and acts at machine speed. An email can also sway an agent. Transmit executives described an agent that reads a message carrying an investment offer, decides the offer is sound, and urges the account holder to accept. Wells Fargo’s wire transfer terms warn that letting an AI agent into the service can weaken the security procedures the account holder agreed to. Even so, institutions that authenticate agents learn who is acting. Institutions that only block learn nothing about the agents that get through.
What to start now
Four tasks need attention at once. Institutions should educate account holders about what an agent can do with a login. They should rewrite disclosures to cover agents. They should press regulators and trade groups for rules on authorization and liability. They should ask their digital banking providers whether limited agent credentials are planned.
Cornerstone Advisors offers a measure of where the industry stands. In a report commissioned by Persado, Cornerstone found that 9 percent of the bank and credit union marketing executives it surveyed use agents that execute actions, and 63 percent expect to be comfortable within two years letting agents take marketing actions on their own within approved boundaries. Institutions are warming to agents that act for the institution within limits. The account holder’s agent deserves the same limits. Cornerstone tells buyers to ask vendors how an agent decides. Institutions can put the same question to the agents that reach them.
Discovery matters as much as access. An agent that compares rates never needs a login. Transmit’s Mickey Boodaei told American Banker that he has not visited an airline or hotel website in about a month, because his agent handles the booking. Cornerstone’s report argues that AI answers favor the clearest, most specific, and most accurate content over the highest bidder. An institution whose rates, products, and branch details read clearly to a machine has a better chance of appearing in the answer. Finalytics offers a Model Context Protocol (MCP) server for this purpose. It serves an institution’s public rates, products, and locations to AI assistants. A person at the institution approves everything before it goes out, and the server never sends non-public rates, applications, or sign-in pages. Account access sits outside it.
Agents will keep arriving, some with permission and some without. Institutions that decide what authorization means, in their agreements and in their credentials, set the terms on which agents arrive. Institutions that wait will learn the terms from their first dispute.
Next Steps
- Ask your digital banking provider whether it can issue limited credentials to agents.
- Read your online banking agreement for language on agents and third parties.
- Write plain-language guidance that tells account holders what handing an agent a login means.
- Name one owner for agent policy.
