Summary
Bank of America is advising customers not to give usernames or passwords to outside services, including AI tools and agents that offer to act on their behalf. As banks explore agentic payments, credential exposure, account controls and responsibility for automated actions remain unresolved issues.
A warning aimed at a growing AI habit
Bank of America is reminding customers not to share their online banking usernames and passwords with other people or outside services. In a customer email titled “Protecting your finances in the AI World,” the bank specifically included AI-enabled tools and agents that offer to act on a customer’s behalf.
The warning addresses a behavior that is becoming more plausible as consumer AI assistants move beyond chat and content generation. Users increasingly expect software to carry out multi-step tasks, potentially including researching a purchase, arranging a payment or handling a digital service on their behalf. In a financial setting, however, the difference between helping a user and controlling an account can become difficult to define if the assistant is given the same credentials used by the account owner.
Traditional online banking passwords were generally designed to authenticate a person into a broad account environment. They were not designed to express that an automated system may perform one limited task, at one time, with one merchant, under a specific spending limit. Giving an AI assistant the full login credential can therefore create a much wider permission set than the user intended to grant.
Why credential sharing creates several risks
The most direct risk is that an assistant with valid credentials may be able to do more than the user expects. A customer might want an AI system to complete a single task, but a username and password can provide continuing access to account information and financial functions. The distinction between a one-time instruction and an ongoing account capability is not necessarily enforced by the credential itself.
The warning also points to the possibility that an AI assistant could do something with a customer’s finances without the customer’s knowledge. That outcome would not require a malicious model. An assistant could misunderstand an instruction, interpret context incorrectly, follow a poorly configured workflow or act on information that the user did not intend to authorize. In ordinary software, an automation error may be inconvenient. In a bank account, the consequences can be immediate and difficult to reverse.
There is also a monitoring problem. Banks may identify an unusual automated login or transaction pattern as evidence that someone else is attempting to access the account. The result could include a security intervention or a lockout, even if the customer originally authorized the assistant. In that situation, a system intended to make banking more convenient may instead create friction between the customer, the bank and the software performing the task.
A separate risk comes from the AI service itself. If an assistant, its storage system or a connected third-party component has a security flaw, banking credentials could be exposed elsewhere. Attackers who obtain those credentials may then have a route into the customer’s account. The concern is not limited to the model’s behavior; it includes how credentials are collected, stored, transmitted and made available to other services.
Agentic payments require narrower authorization
The broader industry discussion is not simply about whether AI should be allowed to interact with financial accounts. Banks, payment providers and processors are reportedly exploring how customers might use AI tools for agentic payments, in which software could complete purchases according to conditions established by the user.
That model is fundamentally different from handing over an unrestricted online banking password. A customer may want an agent to operate only for a particular purchase, within a defined amount, at an approved merchant or during a limited time window. A full password does not naturally encode those restrictions. It authenticates access, but it does not clearly specify the boundaries of the agent’s authority.
This shifts the central question from “Who has the password?” to “What exactly is the agent authorized to do?” A safer architecture would need to separate identity verification from task authorization and transaction execution. The implementation will vary across banks and payment networks, but relevant controls could include limited permissions, expiration times, transaction caps, explicit confirmations, activity notifications and records that show what the agent attempted to do.
Revocability is particularly important. If a customer changes their mind or detects suspicious activity, they should be able to withdraw the agent’s access without necessarily changing every other banking credential. Auditability matters as well: customers, banks and service providers need a reliable record of the instruction, the authorization granted, the action taken and any subsequent intervention.
Banks must distinguish authorized automation from account takeover
For financial institutions, agentic activity may look different from ordinary customer behavior. An AI system could log in or initiate tasks at unusual times, follow a more complex sequence of actions, or move information between multiple services. Security systems need to determine whether that activity reflects a customer-approved workflow or an account takeover.
That is a difficult problem because stronger defenses can also disrupt legitimate automation. If a bank blocks every unfamiliar automated pattern, authorized agents may be unusable. If it accepts too much automation without additional checks, stolen credentials or flawed instructions could cause greater harm. The industry therefore needs authentication and authorization methods that communicate more information than a basic password can provide.
The issue is also relevant to institutional wallets and custody environments, where several employees, administrators, service providers and automated systems may participate in a single financial operation. In those settings, a shared credential makes it difficult to identify who approved an action, which system executed it and whether the action stayed within policy. Role-based permissions, transaction-level approvals and durable audit trails can be more useful than simply adding another login step, although the precise controls depend on the institution and the underlying system.
Responsibility may remain with the customer
One of the most consequential parts of the warning concerns liability. The source report notes that account agreements at many banks may hold customers responsible for anyone to whom they give their login information. That means a customer may not be able to assume that an AI assistant’s action will be treated the same way as an entirely independent and unauthorized intrusion.
The distinction matters because users may view an AI assistant as a tool acting on their instructions, while a bank may view the voluntary disclosure of credentials as the decisive event. If the assistant makes an error, misinterprets a request or exposes the password, responsibility may still be disputed under the account agreement. The presence of an AI system does not automatically change those contractual expectations.
Customers evaluating an AI-based financial service would therefore need to understand how it connects to a bank. There is a material difference between an officially supported authorization method and a service that asks users to type their banking password into an external interface. Other practical questions include whether access can be revoked, whether individual actions require confirmation, what alerts are generated, how credentials are protected and how disputes are handled.
The industry is still defining the operating model
Bank of America’s message should not be read as proof that banks have abandoned AI-related financial applications. The reported industry work on agentic payments suggests the opposite: financial institutions and payment companies are trying to determine how these systems can be useful without weakening account security.
But the warning does show that consumer convenience is moving faster than the rules and controls needed to support it. Before an agent can safely act on a customer’s behalf, the market must establish clearer answers about identity, authorization, monitoring, revocation and loss allocation. Those questions apply to consumer banking, payments and institutional custody alike.
The immediate principle is straightforward: an AI assistant should not need a customer’s complete banking password merely to perform a narrowly defined task. The longer-term challenge is to build a permission model that lets a customer specify what an agent may do, for how long and under what conditions, while giving the bank enough information to assess the action.
Agentic finance will ultimately be judged less by whether software can complete a payment than by whether users can understand and control that payment. Bank of America’s warning puts the issue in its simplest form: until safer authorization mechanisms are broadly available, sharing a full banking credential with an outside AI service can create risks that the customer, rather than the service, may be expected to bear.
Source: link