Bank of America warns customers: don't share logins with AI agents

The warning lands at an awkward moment for banks. Personal AI assistants are growing more popular, and customers are increasingly handing over their log-ins, even as banks reportedly grapple with unauthorized agents accessing customers’ money. Bank of America’s email tries to draw a bright line before that habit hardens: credentials should never go to another person or an outside service, and that explicitly includes an AI-enabled tool or agent offering to act on your behalf.

The risks the bank names are concrete. An assistant could do something with your finances without your knowledge, the bank could mistake the activity for someone raiding your account and lock you out, or a security flaw in the assistant could leak your credentials elsewhere — giving financially motivated hackers a way in. The liability question is already settled in the fine print: account agreements at most banks hold customers responsible for anyone they give their log-in to.

At the same time, the industry has not settled on a safer alternative. As discussed onstage at TechCrunch Disrupt, banks, payment providers, and processors are still trying to figure out how to let customers access their accounts through AI tools, such as agentic payments that let people set agents to buy things autonomously at the best price or the right time. Until that plumbing exists, the bank’s message is essentially that the risk sits with the customer.