Bank of America is telling customers not to share their online banking usernames and passwords with AI tools and agents, warning that anyone who does so will be held responsible for activity carried out using those credentials. TechCrunch reported the warning on 27 October, and a bank spokesperson confirmed the authenticity of the customer email circulating on social media.
The email, titled 'Protecting your finances in the AI World', extends the bank's existing advice against sharing login details to cover AI-enabled tools and agents.
It reminds customers who hand over their credentials to 'keep in mind that you're responsible for activity resulting from that access.' The wording reflects the bank's general guidance, rather than a determination of liability in any particular dispute.
Shared Credentials Can Expose More Than You Intended
Giving a service a banking password does not restrict its access to the task a customer wants completed. Bank of America's published guidance says third parties given login details can have the same access to account information as customers themselves, who usually cannot choose how much information those services can see.
The exposure can also last beyond a single request. Some services store login details, creating a risk that a security breach could compromise them, and can continue accessing information after a customer stops actively using the service.
For customers who have already shared their credentials, the bank identifies changing their password as the safest way to remove that access.
Trying to disconnect through the outside app is another option, but stopping future access does not necessarily remove information the service already holds. That information remains subject to the third party's privacy and retention policies.
Bank Backs 'No Password' Data Sharing Instead
The bank's guidance describes another route for participating services to obtain account information without receiving the customer's banking password. Customers log in directly with Bank of America and give consent to share their data, rather than handing their login details to the outside provider.
Under that method, the amount of data available to the provider is reduced, and the provider does not need to store or use the customer's credentials. Customers also gain visibility into the specific information being shared, making the arrangement different from giving a service access through their own login.
Customers can view participating third-party services through mobile or online banking and revoke permission for future access. These controls concern the sharing of account information: the guidance does not describe them as permission for an outside AI agent to make payments or move money.
Banks Push for Clear Authority Before AI Agents Act
Banks restrict outside agents while trying to establish whose instructions they are following. Axios reports on 22 October that agents are entering accounts using credentials supplied with customers' permission, even where that access conflicts with banks' guidelines. Permission from a customer therefore does not necessarily make the method acceptable to the bank.
Banking sources also describe difficulty distinguishing user-directed agent activity from actions that appear independent of a customer's instructions. Those reports concern the industry; they do not establish a specific Bank of America customer loss or rogue-agent incident.
Brian Moynihan, the bank's chief executive, calls for human confirmation before payment in comments to Bloomberg on 15 October, reproduced by USA TODAY. 'So before you pay, you authorize it, so that we know that you know you're paying for something.'
His comments identify a separate control from the data-sharing arrangements described in the bank's guidance. A service can receive approved access to financial information without receiving authority to spend: permission to read an account is not, by itself, permission to move its money.
