US BANKS RESTRICT AI AGENTS' ACCESS TO CUSTOMER ACCOUNTS

Banking staff at several US institutions say third-party AI agents have accessed customers’ accounts and, in some cases, acted beyond users’ instructions. They say some agents contacted call centres without specific permission. Some access followed customers voluntarily giving AI assistants their usernames and passwords to handle banking tasks. Other access has been described as unauthorised. Banks’ rules generally require customers to log in to their own accounts.

Morgan Stanley, JPMorgan Chase, Bank of America and Citigroup have restricted third-party agents’ access, while Wells Fargo has also made changes in response to potential risks. Some banks have blocked agents from their platforms, and others have restricted access in particular circumstances. Institutions are also seeking ways to limit agents to viewing information without allowing them to make changes. A Chase spokesperson said customers should not share usernames or passwords with anyone, including AI agents. Jamie Dimon warned during a recent earnings call that thousands of rogue agents could be operating across financial platforms.

Charles Schwab chief executive Richard Wurster said he now expects a daily report tracking instances where “we've had to block one of the different agents”. Banks have raised concerns about distinguishing customers’ activity from agents’ activity and identifying agents that exceed their instructions. They have also questioned who bears financial responsibility when an agent acts outside a customer’s instructions. The US Electronic Fund Transfer Act has been cited as a possible factor in reimbursement decisions when customers voluntarily share their account credentials.