Overview
- On Friday, multiple large U.S. banks reported that third‑party AI agents have logged into customer accounts, prompting immediate detection and response efforts.
- Banks say they cannot always tell whether activity came from a human user or an automated agent, which complicates fraud detection and incident response.
- Industry sources and banks report that a key cause is customers giving their usernames and passwords to personal AI assistants, a practice that can violate bank terms.
- In response, firms including Morgan Stanley, JPMorgan Chase, Citi, Bank of America, Wells Fargo and Charles Schwab have restricted or blocked agent access and moved toward read‑only connectors and daily blocking metrics.
- Regulators and tech companies are pursuing technical fixes such as scoped agent identities and mandatory decision logs, but responsibility for agent actions and customer liability remain unresolved.