All About Cookies is an independent, advertising-supported website. Some of the offers that appear on this site are from third-party advertisers from which All About Cookies receives compensation. This compensation may impact how and where products appear on this site (including, for example, the order in which they appear).
All About Cookies does not include all financial or credit offers that might be available to consumers nor do we include all companies or all available products. Information is accurate as of the publishing date and has not been provided or endorsed by the advertiser.
The All About Cookies editorial team strives to provide accurate, in-depth information and reviews to help you, our reader, make online privacy decisions with confidence. Here's what you can expect from us:
AI agents have grown by leaps and bounds. They can now find the best deals for you, book flights and hotels, fill out forms, and even execute transactions on your behalf. But to do that, many of these agents ask for your login credentials, and that’s where banks are drawing the line.
Bank of America has warned its customers against allowing AI agents access to their banking accounts. In case of any financial mishap, the liability could ultimately fall on you, leaving you responsible for the losses.[1]
Here’s everything you should know about the latest Bank of America warning and the steps you should take to stay safe while using AI agents.
Bank of America warns customers against sharing their usernames and passwords with third parties, including AI agents that offer to act on their behalf. The warning was sent in an email titled “Protecting your finances in the AI World” and shared by Brian Toporek on Bluesky.
This comes just days after the bank published a joint report titled “Building Trust in Agentic Commerce” alongside ASB Bank, Capital One, Commonwealth Bank of Australia, ING, and NatWest, outlining steps to make AI-powered shopping safer.
Then there’s the question of liability. If something goes wrong, who should take the fall? Should it be the customer who shared their login credentials, the makers of the AI agent, or the banking institutions? Bank of America, in its email, has explicitly stated that customers will be responsible for activity resulting from such AI access.
While there are several AI tools that can analyze your spending transactions and help you draft a budget, some even offer to authorize and execute transactions on your behalf. However, there’s always a possibility of an AI assistant executing transactions without your knowledge or approval.
We’ve already seen this happen. Geoffrey Fowler, a Washington Post columnist, asked an AI agent to find cheap eggs. The agent, however, went on to spend $31.43 on a dozen eggs using Fowler’s credit card, all without any instructions or approval.
Plus, banks are also struggling to identify whether agents are legitimately authorized by the account owner or are being controlled by malicious threat actors. This is why several major U.S. banks have started restricting the use of such AI agents.
Morgan Stanley has started blocking such agents, Citi is actively restricting access, and JPMorgan Chase has discouraged customers from sharing their logins with such AI agents. Your bank may think that an unauthorized party is raiding your account and lock you out of your own account.
Lastly, there’s also the risk of an AI agent failing to identify a fake shopping app and handing over your personally identifiable information, such as credit card details, email address, or home address, to threat actors who can then use it to orchestrate financial fraud schemes, send very convincing phishing messages, or even attempt identity theft.
Guardio Labs ran some controlled tests on Perplexity’s Comet browser, which included a fake Walmart store and a live Wells Fargo phishing page. The agents overlooked the obvious telltale signs that the store was fake, completed the purchase, and handed over payment details. This is exactly the kind of AI agent behavior that Bank of America has warned customers against.
That said, users still have protections under federal law, including the Electronic Fund Transfer Act and Regulation E, in cases of genuinely unauthorized electronic transfers. However, the extent of these protections can depend on the circumstances, particularly when customers have voluntarily shared their login credentials with a third party, such as an AI agent.
You should limit the amount of information you share with AI agents. While it's fine to use them to analyze your finances, spending patterns, and habits, or even draw up your weekly and monthly budgets, make sure you're the one who authorizes the final transactions.
Additionally, consider using a reliable third-party antivirus program with real-time web protection to flag suspicious pages and links before you or your AI agent interact with them.
With Bank of America’s latest warning against giving away your bank passwords to AI agents, it’s high time to think about the extent of control you’re willing to hand over to AI assistants.
In case of any financial or transactional mistakes, the liability could ultimately fall on you, as Bank of America has clearly stated. Other banks, such as Morgan Stanley, Citi, and JPMorgan Chase, have also started restricting or discouraging the use of AI agents on their banking portals.
You may still continue to use these agents to analyze your finances, spending patterns, and draft budgets. However, it’s recommended that you refrain from allowing these agents to execute transactions on your behalf.
ID theft protection that monitors your SSN, bank accounts, credit cards, and brokerage and retirement accounts for suspicious activity
Every plan includes the full feature set, so no additional cost to unlock monitoring, insurance, or restoration
Bundles data removal with identity theft protection, antivirus, VPN, and a password manager in one subscription
/images/2023/12/01/omniwatch_review.jpg)
/images/2026/06/04/best_lifelock_alternatives.jpg)
/images/2026/11/04/bank-of-america-ai-agent-liability.jpeg)
/images/2026/10/29/no_price_posted__target_shopper_questions_missing_prices_on_tags._are__FG8eh28.png)
/images/2026/10/28/cisa-confirms-active-php2shell-attacks.jpeg)
/images/2026/10/26/google-gmail-photos-personalized-ads.jpeg)
/images/2026/10/26/samsung-tv-privacy-tracking-risks.jpeg){kind=tracking}
/images/2026/10/23/smart-tv-tracking-privacy-opt-out.jpeg){kind=tracking}
/authors/krishi_chowdhary_headshot.jpg){kind=small}
/authors/kalleigh-lane-new.jpg){kind=small}
/images/2023/05/25/logo-aura.png){kind=logo}
/authors/krishi_chowdhary_headshot.jpg)