Banks Push Back as Unvetted AI Agents Show Up Inside U.S. Customer Accounts
Major U.S. banks say unauthorized third-party AI agents are operating inside customer accounts, and several are now blocking or restricting them. Here is what is known and how to protect your money.
Date: Thursday, October 22, 2026 · Time: 1:36 PM ET (10:36 PM PKT)
Major U.S. banks say unauthorized third-party AI agents are operating inside customer accounts, and several are now blocking or restricting them. Here is what is known and how to protect your money.
What Happened
Axios reported on October 22, 2026 that major U.S. banks are detecting unauthorized third-party AI agents inside customer accounts. Banks named include Morgan Stanley, Bank of America, JPMorgan and Wells Fargo. Some banks have tracked agents contacting call centers or acting independently of user instructions, sources told Axios.
Morgan Stanley has reportedly begun blocking outside agents, although a spokesperson said the bank has not observed rogue AI agents on its platforms. JPMorgan, Bank of America and Citi are described as restricting them.
Why Banks Are Alarmed
Bots Look Like Humans
Executives told Axios they struggle to tell human users from AI agents, and to know whether a customer actually authorized an agent.
Credential Sharing Breaks the Rules
Most agents reportedly log in with the customer's own username and password, which typically violates bank terms requiring customers to log in themselves. Chase told Axios customers should never share credentials with anyone.
Moving Money Raises the Stakes
Reading a balance is low risk. An agent allowed to pay bills or transfer funds could take actions the customer never intended. That is why banks are rewriting terms of service and exploring read-only access through approved connections.
The Bigger Background
Logging in as a customer and reading what appears on screen is called screen scraping. Fintech apps have used it for years. In October 2024, the CFPB finalized its Section 1033 open banking rule to encourage safer data sharing, but a federal court has enjoined enforcement while the agency reconsiders it. Banking groups such as the American Bankers Association want screen scraping phased out.
How to Protect Your Money
- Never give your banking username or password to an AI tool.
- Use only bank-approved, read-only connections.
- Turn on multi-factor authentication and account alerts.
- Check your bank's terms; sharing credentials may weaken fraud protection.
- Report unfamiliar activity immediately.
What Small Businesses Should Do
Business owners experimenting with automation should be especially careful. Our guide on the role of AI tools in daily business operations covers adopting AI responsibly, while the hidden risks of using free software for business explains why unvetted tools deserve scrutiny. If something goes wrong, see handling a data breach as a small business.
Conclusion
AI agents are arriving in personal finance faster than rules or security systems can adapt. Until banks and regulators set clear standards, the safest approach is simple: keep your credentials private and use only bank-approved access.
Author's Review
I find this story unsurprising but worrying. People want AI to handle boring money tasks, and handing over a password feels easy. But banks cannot tell a helpful assistant from a bad actor, and customers may carry the risk. I think the real fix is bank-approved, read-only access, not workarounds. Until then, I would keep my passwords to myself.
Elena Rostova
B2B Operations Consultant & Business Editor
Elena Rostova is a B2B strategy consultant specializing in digital operations, regulatory risk management, and scaling business models. She writes on corporate licensing, operational frameworks, and enterprise growth.
