🔍 Read the full analysis: What To Check Before An AI Agent Handles Your Money on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Bank of America has warned customers not to share banking credentials with AI tools, while firms including Robinhood and Visa signal that AI-driven payments and trading are already developing. Before connecting an agent, check what it can access, how payments are approved, what limits apply and who may bear losses if something goes wrong.
Bank of America warned customers not to give banking usernames or passwords to AI tools, saying customers may be responsible for activity resulting from shared credentials. The warning comes as Visa discusses trust as a barrier to AI-agent payments and Robinhood says customers have placed more than $250 million in accounts used by AI agents, raising questions about access, safeguards and responsibility for transactions made by an agent.
Bank of America’s email, titled “Protecting your finances in the AI World,” says credentials should not be shared with another person or an outside service, including an AI-enabled tool or agent acting on a customer’s behalf. The bank adds that customers who share credentials are “responsible for activity resulting from that access.” A spokesperson confirmed the email was authentic to TechCrunch, which reported on it October 27 after a customer posted an image of it on Bluesky. The bank also said it is “excited about what AI used responsibly can deliver.”
The practical issue is the breadth of a password. An agent signing in with a customer’s credentials may appear to the bank as that customer, rather than as a separate program with permission for one limited task. It could gain access beyond the specific action the user intended. The same login can also prompt a bank to flag activity as suspicious and restrict an account, one of the weak spots to identify before an agent is deployed.
There are narrower ways to grant access, depending on what a bank or service supports: read-only permissions, requiring approval for each payment, a virtual card with a spending cap, or a separate account with a limited balance. A scoped token could be restricted to a particular merchant, amount and period. These controls can reduce potential exposure, but they do not by themselves settle who is legally responsible for a loss.
Before your agent touches money
Give it a valet key, not the master key
Logging in with your password makes the agent you. A credential made for the agent can do only the job you gave it, and you can take it back.
- What it opensEverything you can do: transfers, payees, settings, statements
- LimitsNone that the agent cannot get around by logging in as you
- What the bank seesYou, or a thief. It cannot tell which
- If a web page tricks itThe trick reaches your whole account
- To take it backChange your password everywhere it was used
- If money goes missingUS rules can exclude transfers by someone you gave access to; Bank of America: “you’re responsible”
- What it opensOnly what you allowed: read-only, one card, one pot of money
- LimitsBuilt in: amount, merchant, time window, approval on your phone
- What the bank seesAn identified agent acting for an identified person
- If a web page tricks itThe damage stops at the limit
- To take it backDisconnect the agent or delete its card. Your password never moved
- If money goes missingDepends on the terms. Read them first: some still put all risk on you
A comparison of two set-ups, not a measurement. Which limits exist depends on your bank, card and app.
Sources: Bank of America customer email, confirmed to TechCrunch (27 Oct 2026); 12 CFR 1005.2(m); OWASP LLM01. Comparison: Thorsten Meyer.
Powered by Thorsten Meyer AI
Permission Limits Shape Financial Risk
The distinction between a master login and limited permission matters because an agent can act quickly, while a bank may have difficulty distinguishing an authorized instruction from a compromised credential. Customers could face unwanted transactions, account freezes or disputes over whether an action was authorized. The outcome may depend on the account terms, the type of transaction and the circumstances of the access.
Rules cited in the source material do not clearly resolve every case involving AI agents. In the United States, Regulation E excludes certain transfers initiated by a person given access by the consumer. Whether that provision applies to an AI agent or its provider is an interpretation, not a settled ruling. In the European Union, PSD2 requires customers to take reasonable steps to protect personalised security credentials; whether sharing them with an agent amounts to gross negligence has not been tested in court, according to the source.
These uncertainties make permission settings and contract terms relevant to account holders. A spending limit can restrict the amount at risk, but does not guarantee reimbursement. Before linking an account, customers should check what data and actions are permitted, how to revoke access and which party handles disputed transactions.
Products Worth Considering
Trezor Safe 7 Crypto Hardware Wallet
Ledger Flex + Folio Crypto Hardware Wallet
Trezor Safe 5 Crypto Hardware Wallet with Color Touchscreen, Black Graphite
As an affiliate, we earn on qualifying purchases.
Banks Confront Agent Logins
The warning follows reports that banks are encountering third-party AI agents inside customer accounts. Axios reported October 22, citing unnamed sources, that major U.S. banks had found agents logging in with customers’ own passwords. The report said banks often could not tell whether the activity reflected the customer’s intent. The claims were attributed to those sources; the material provided here does not include a public bank-by-bank accounting.
Companies are also signaling that agent-enabled financial activity is moving beyond a hypothetical use case. Visa told investors that trust is the biggest barrier to AI agents making payments, while Robinhood said customers had put more than $250 million into accounts that AI agents trade. Those statements indicate activity and industry concern, but do not establish how many customers are involved, how the money is allocated or what outcomes the trades have produced.
Agent systems can also be influenced by instructions hidden in material they read, such as web pages, emails or files. This attack is known as prompt injection. OWASP lists prompt injection as a leading risk for AI applications. The source does not establish that such an attack caused a specific banking loss; it is a reason to limit what an agent can do and what it can trust.
““If you do share your credentials, keep in mind that you’re responsible for activity resulting from that access.””
— Bank of America, in its customer email
Liability Rules Remain Untested
No cited court or regulator ruling establishes how the U.S. Regulation E provision applies when a customer gives an AI agent or its operator account access. The source author’s reading is that the rule could affect coverage, but labels that application as an interpretation. In the EU, the source likewise says courts have not determined whether giving credentials to an AI agent would count as gross negligence under PSD2. This is not legal advice, and customers’ rights can depend on their jurisdiction and facts.
The source material also does not give details about the Robinhood accounts, the number of customers, the agents involved or the performance of their trades. It does not describe the specific controls available across all banks and payment services, or establish whether existing safeguards would cover losses caused by an agent or a prompt-injection attack. The scope of banks’ reported agent-access problems is also unclear.
Check Controls Before Connecting
Before connecting an AI agent to a financial account, read the service’s permissions and terms. Check whether access can be limited to viewing information, whether each payment or trade requires approval, and whether a card, transaction or account limit is available. Confirm how to revoke access and whether the agent stores or passes credentials to another service. If the provider does not clearly explain what the agent can do, do not assume that the connection is limited to the task requested.
Read the bank’s and agent provider’s terms for responsibility, dispute procedures and exclusions. Ask the bank how it treats transactions made through third-party tools, and keep records of the permissions granted and approvals given. For companies building agent payments, the source material points to controls such as merchant-, amount- and time-limited tokens, clear user approval and ways to shut off access. Future developments to watch include guidance from financial institutions and regulators, and further information from providers about safeguards and responsibility. Until then, losses remain possible and financial activity carries risk.
Key Questions
Should I give an AI agent my bank password?
Bank of America advises customers not to share their usernames or passwords with AI tools. A password may give an agent broad account access, and the bank says customers may be responsible for activity resulting from shared credentials.
Does a spending limit guarantee I will get my money back?
No such guarantee is established in the source material. Limits can restrict how much an agent can spend, but safeguards and liability are separate issues; check the relevant service and bank terms.
Could I lose fraud protection if an agent makes a transaction?
It is not settled for every AI-agent situation. The source discusses U.S. and EU rules that may be relevant, but says how they apply to AI agents has not been determined by a court or regulator.
What is a safer way to authorize an agent?
Where available, use limited permissions such as read-only access, approval for every transaction, a capped virtual card, a separate account with a limited balance or a token restricted by merchant, amount and time.
What is prompt injection?
Prompt injection is an attempt to steer an AI system through instructions embedded in content it reads, such as a web page, email or file. Limiting an agent’s access can reduce the potential impact, but the source does not quantify the risk for any particular service.
Source: ThorstenMeyerAI.com
