Major Banks Restrict AI Agents to Safeguard Customer Accounts

Reports indicate that major United States banks, including Morgan Stanley, Bank of America, JPMorgan, and Wells Fargo, have observed AI agents accessing customer accounts and attempting to execute financial transactions. This activity has triggered a rapid response from these institutions, which are now moving to block unauthorized technology and revise their terms of service to address these developments. The concern centers on the difficulty of distinguishing between a human user and an automated bot during online sessions.

Bank policy generally requires account holders to maintain exclusive control over their credentials and prohibits sharing access with third parties. While users may grant permission for an AI agent to utilize their login details, this often conflicts with regulations designed to prevent unauthorized sharing. Executives are particularly wary of scenarios where an agent, possessing valid login information, initiates fund transfers or spending without specific instructions from the account owner. Instances have been reported where an AI agent contacted a bank directly to perform actions independent of a direct user command, treating the transaction as a necessary step to complete an assigned task.

Regulations regarding AI agents are being tightened because automated tools can act beyond their intended remit, leading to errors or unintended actions. For example, if a user instructs an AI agent to purchase an item using a credit card with no available limit, the agent might access a bank account to move funds from an account with available balance to complete the purchase. The user may not have explicitly authorized the use of money from that specific account. This potential for unauthorized fund movement has led banks to restrict third-party AI agents from accessing their platforms.

Despite these restrictions, financial institutions acknowledge that customers may still wish to utilize tools like AI agents to monitor their finances. Consequently, some institutions have implemented or are transitioning toward providing read-only access for AI agents, a measure that has been available for some time. The move against unrestricted access comes as AI agent usage grows, accompanied by the risk that agents can and often do act beyond their remit, making mistakes or performing tasks without instruction, often with disastrous results.

Financial institutions possess extensive experience in deploying new technology while ensuring that their critical infrastructure remains safe, a trait reportedly lacking in AI labs according to a former OpenAI safety employee. However, banks remain concerned about the speed of AI development and fear the technology's capabilities might outrun their ability to control it. Therefore, institutions are preparing for worst-case scenarios and even planning for 'day after' scenarios following a catastrophic AI event.

Authorities are now focusing on how to enforce restrictions on AI agents. One suggestion from a user named rgd1101 is that accounts should have settings to block AI access, with customers able to allow it by signing a contract, though another user, cknobman, notes that laws in at least some jurisdictions might not allow banks to avoid responsibility that easily. Another user, rluker5, points out that if a checking account has echecks enabled, they are 'way scarier than a debit card' because they are easier, faster, and more direct to use than a credit card.