America's Biggest Banks Are Blocking AI Agents That Log In With Customers' Passwords. Build on Read-Only, or Get Blocked
By Surya Pratap
October 24, 2026
8 min read
AI & Technology
October 24, 2026
8 min read
Read first, move money never (yet)Hover to exploreConsumer AI agents promise to manage your money: check balances, pay bills, move savings, dispute charges. The quickest way to build one is to ask the customer for their bank login and let the agent use the bank's website like a person. This week, several of the largest US banks made clear that route is closing.
This article is based on Axios's reporting of 22 October 2026 as relayed by CBS News, PYMNTS and US News, including statements from bank executives. Banks have not published counts of agents detected or blocked beyond what is quoted here. The reading from section 3 onward is mine, and it is not legal or compliance advice.
According to Axios, large US banks have detected third-party AI agents operating inside customer accounts without the bank's authorisation. In many cases, as Axios's Madison Mills put it, "this is just going to be customers giving their username or password to an AI agent that the bank hasn't had a chance to vet yet, that goes against the bank's terms of service."
Some agents went further than their users intended. Reports describe agents making transactions without explicit approval for each one, and even calling banks to lodge complaints without consulting the account holder.
The banks' positions:
JPMorgan Chase, Bank of America, Citigroup and Schwab all say AI agents cannot move customer money. Banks do allow read-only functions such as viewing balances.
Read-only access is where this is heading for now. Even the White House's AI adviser, David Sacks, who distinguished agents authorised by users from genuine attacks, suggested banks could grant "read-only" permission rather than full access.
That matches the proposal we covered in the Personal Agent Protocol: agents start as guests, customers choose read-only or write access, and the business decides how agents get in. Banks are, in effect, choosing read-only by default and refusing the password door.
An agent that logs in as the customer is indistinguishable from an attacker who stole the password. Banks are treating it that way.
If your product's agent signs in with a customer's bank password, you have three problems at once:
None of this depends on whether your agent is well built. It depends on the access method.
Use sanctioned data access. Connect through the open banking providers and data aggregators banks already support, with customer consent and scoped tokens. JPMorgan pointed to exactly this route. It is slower to set up and much harder to lose.
Start read-only. Most of the value in personal-finance agents — categorising spending, spotting subscriptions, forecasting cash, warning about overdrafts — needs only to read. Ship that first. It is the access banks are prepared to give.
Keep a human on every payment. If your agent prepares a transfer, bill payment or dispute, make the customer approve each one, through a channel the bank recognises. Bank of America's CEO said it directly: a human should approve money moving out of an account.
Never let the agent act unasked. The reports of agents calling banks or transacting without being asked are what turned this into a crackdown. Log every action against an explicit user instruction, and block anything that lacks one.
Give your agent an identity banks can see
The underlying problem is that banks can't tell which agent is acting, for whom, with what permission. The more your agent identifies itself — its own credentials, its own scope, a named owner, as we described for enterprise agents — the more likely it is to be let in when banks open write access.
If you are building on the bank's side — a fintech, a credit union's digital team, a lending platform — the mirror image applies: offer agents a scoped, read-only way in, detect and label agent sessions, and decide in advance what write access would require.
That all banks have taken the same position. The statements here are from specific banks and executives. Morgan Stanley, for example, reportedly said it had detected no unauthorised agent activity, and U.S. Bancorp said it had not encountered such agents.
That agents will never move money. PNC's chief executive set conditions — liability, secure connections, human oversight — not a permanent ban. Write access may come, on banks' terms.
That customers are protected or unprotected in any specific case. Liability for transactions made by an agent using shared credentials depends on the facts and the rules that apply. Treat what is reported here as a warning sign, not a legal analysis.
How many agents are involved. Apart from Schwab's "double-digit number of times every week", the banks have not published figures.
Large US banks have found third-party AI agents operating inside customer accounts, often logged in with passwords customers shared and sometimes acting without being asked. JPMorgan Chase, Bank of America, Citigroup and Charles Schwab say agents cannot move customer money; Schwab blocks unauthorised agents ten or more times a week; PNC's chief executive called agent transactions "incredibly unsafe" without changes to liability and secure connections. Read-only access is emerging as the compromise.
For founders, the direction is clear even if the details aren't. Agents that act as the customer are being shut out. Agents that identify themselves, read through sanctioned channels and leave payments to a human are the ones banks are prepared to work with.
If your agent touches bank accounts, replace credential logins with an open banking connection this quarter, ship the read-only features first, and put a customer approval step in front of every payment your agent prepares.
Sources: CBS News, relaying Axios's report of 22 October 2026 — the detection of unauthorised agents, agents transacting and calling banks without consulting customers, Madison Mills's comment on shared credentials, JPMorgan Chase's statement and Jamie Dimon's quote, Schwab blocking agents, Morgan Stanley reporting no activity, and David Sacks's suggestion of read-only permission. PYMNTS — the positions of JPMorgan Chase, Citigroup, Bank of America and Schwab that agents cannot move money, Rick Wurster's "double-digit number of times every week", Brian Moynihan's and William Demchak's quotes, Citigroup's policy, U.S. Bancorp's comment and the allowance of read-only functions. US News — the 22 October Axios report. The point about liability when credentials are shared is as reported in coverage of the story and is not a legal conclusion. The reading in sections 3 to 5 is mine and is not legal or compliance advice.
IdeaToMVP Academy
4-week live cohort for founders. Learn to ship AI agents, scope MVPs, and automate your business — taught by the same team that writes these guides.
