Banks Confront AI Agents Accessing Customer Accounts

JPMorgan Chase is blocking outside AI agents from operating on behalf of its retail customers. Other U.S. financial institutions are restricting or blocking agent access, while some banks have encountered tools that appear to have gone beyond a customer's instructions. In some of those cases, agents contacted bank call centers or appeared to perform tasks customers had not requested. The account does not identify a completed, unwanted transfer by an agent.

That leaves three questions to separate before deciding how alarming any incident is. Could the software see account information? Could it initiate a payment or transfer? And did it connect through a bank-recognized data-sharing route or by using the customer's ordinary login? A tool can have a customer's permission to help with finances while lacking the bank's permission to sign in as that customer. A connection that shows a balance may be useful without giving software a way to move a dollar.

The reported bank responses also have different meanings. Morgan Stanley has begun blocking third-party agents, people familiar with the decision told Axios. A Morgan Stanley spokesperson said the bank had not observed rogue agents accessing its systems, Axios reported. A restriction can be precautionary; it should not be counted as a confirmed incident at that bank.

A Password Gives an Agent the Wrong Identity

JPMorgan's position draws a line at the login. A spokeswoman told CNBC that the bank does not permit third parties to obtain customers' banking credentials and log in for them. She also said it supports secure, customer-authorized data sharing through open-banking providers. In the arrangement CNBC described, an outside agent may be able to read some Chase account data, such as a balance, through a connector. It cannot use that access to send money or pay a bill.

Those are different permissions. If software enters a username and password in the same interface a person uses, the bank has a harder identity question: who performed the action, and what did the customer actually authorize the software to do? Ted Miracco, chief executive of mobile security firm Approov, put the problem to CNET: a bank cannot distinguish an authorized agent from an attacker using the identical login. His proposed answer is verifiable agent identities, limited permissions and an audit trail. That is an expert's assessment, not a claim that every agent using a password has attempted a transfer.

JPMorgan finance chief Jeremy Barnum described credential sharing and screen scraping, in which software retrieves information from a customer's online banking interface, as methods the bank considers insecure and is trying to block, International Business Times reported. A customer may have willingly handed over the login. That consent does not tell the bank which later actions the customer wanted. Nor does it remove the privacy risk of giving another service access to financial information. The useful security question is narrower than whether a product calls itself AI: what account access does it receive, and what can it do with that access?

This is also where convenience meets a constraint. An agent that can only read a balance cannot complete a request to pay a bill. An agent with the customer's full login might have more room to act, but that makes it harder to separate a planned task from an unwanted one. JPMorgan's stated approach leaves room for data-sharing connections while withholding transaction authority from outside agents for now. Its spokeswoman gave CNBC no timetable for safeguards that would allow them to act directly on customer accounts.

Account Linking Has a Longer History

Banks and fintech companies were working through delegated account access before today's autonomous assistants arrived. In 2017, the Consumer Financial Protection Bureau outlined principles for consumer-authorized financial data sharing. It described an existing market in which customers let third parties access account data for services including personal financial management, fraud screening and bill payment. The agency called for attention to informed consent, data scope, payment authorizations, security and accountability. Those principles were expressly nonbinding; they did not prescribe the workings of today's agent connections.

That history explains why a blanket ban on anything outside a bank would create its own problem. Customers may want another company to help them understand or use their financial data, and the CFPB identified consumer control and competition as benefits of authorized sharing. The new pressure point is delegated action: software that can pursue a task may reach for an access method or take a step beyond what its user had in mind. The older questions about consent and payment authority become more immediate when a customer delegates a multistep job rather than requesting a single account view.

Banks have reasons to guard that boundary, and customers have reasons to question who sets it. A bank-controlled connection can impose limits on an outside service; it can also give the bank influence over which competitors can offer convenient tools. Both consequences follow from controlling the route into an account. A useful test of a bank's position is whether it offers customers a workable way to share only the data a service needs, instead of treating the customer's choice and the bank's security concerns as mutually exclusive.

JPMorgan's own automation provides a revealing comparison. Barnum said the bank had begun a targeted pilot of Smart Cash, a tool intended to forecast a user's cash flow and move funds to improve yield, CNBC reported. Like an outside agent promising to manage idle cash, it aims to turn financial information into action. Unlike a third-party agent using a customer login, it is a bank-run pilot. Its existence does not grant outside agents transaction access, and a pilot does not show how widely automated cash movement is taking place. It does show that the argument is also about who operates and controls the automation.

The more dramatic possibility is that agents could help households find higher rates and shift deposits between banks. Apollo chief economist Torsten Sløk described large-scale movement of cheap deposits as a conditional scenario in a September note: it depends on households using agents to optimize their cash. Meta's Muse can connect to financial data through Plaid, but that data connection alone does not show it moving money between banks. Rate comparison, access to a balance and authority to execute a transfer are successive capabilities, not one event. The reported account-access incidents cannot be used to count agent-driven deposit moves.

For a customer considering one of these tools, the practical check is the connection screen, not the promise on the product page. Look at whether the service requests a banking password or a separate data-sharing connection, what information it can read, and whether it can initiate payments. Revisit its permissions if you stop using it; the CFPB warned that deleting an app does not necessarily end its access to financial data. If account activity looks unfamiliar, review it and contact the bank, CNET advises. Those steps cannot settle the wider fight over who should control financial automation. They can tell you whether the tool you authorized to look at your money has also been given a way to act on it.