Banks Are Quietly Locking AI Agents Out of Your Checking Account

For months, big US banks let the AI-agent question sit in the theoretical column. This week it became operational. Axios reported that major banks have been finding third-party AI agents inside customer accounts that behave unpredictably — logging in with a customer's own credentials, contacting call centers, and in some cases taking actions that look disconnected from what the user actually asked for. Banks told Axios they often cannot tell whether a given login is a sanctioned agent, an unauthorized one, or simply a breach in progress. One executive used the word 'horrifying.'

What's actually changing

The response, confirmed separately by Cybernews and FSTech, is concrete rather than rhetorical. Citi now explicitly bars third-party AI agents or assistants from logging into a customer's account or transacting on its digital platforms, though it still permits limited read-only access through vetted open-banking providers. JPMorgan Chase says it does not allow third parties to authenticate with a customer's banking credentials at all. On the bank's Q3 earnings call, CEO Jamie Dimon framed the policy in blunt terms, warning that 'rogue agents' acting outside any agreement with the bank could eventually number in the thousands and that letting 'just any outside agent' operate inside Chase's systems is too risky for both customers and the bank. Bank of America CEO Brian Moynihan took a similar line, arguing there 'should be a human in the loop' before money leaves an account, while his bank works out liability protocols for AI-authorized payments. Morgan Stanley says it hasn't seen rogue agents on its own platforms but is restricting access anyway.

It's worth separating the stated security rationale from the commercial one, because the two are tangled together here. Banks genuinely don't have a reliable way to distinguish an agent a customer deliberately authorized from one that gained access through stolen credentials or a scraped session — and 2025's SitusAMC vendor breach, which exposed customer data at several institutions, is still fresh enough to shape how seriously executives treat any new access vector. But the timing also lines up with Meta's September launch of Muse, a personal AI agent pitched explicitly as something that can browse, fill out forms, and make purchases on a user's behalf, with Meta offering reimbursement coverage up to $1,000 for mistaken transactions. FSTech's reporting ties the bank pushback directly to concern that agents like Muse could start automatically sweeping idle, non-interest-bearing deposits into higher-yielding accounts elsewhere. That risk is still hypothetical, not realized: Apollo economist Torsten Sløk estimates that if JPMorgan, Bank of America, and Wells Fargo had to pay 3% interest to keep the roughly $1.6 trillion they collectively hold in such deposits from fleeing to AI-managed, higher-yield accounts, it would cost them a combined $47 billion a year — a conditional exposure figure, not money already lost, and one that doesn't include Citi, whose account-blocking policy is a separate matter from this specific deposit-flight estimate.

There should be a human in the loop to authorise money moving out of your account.

The regulatory question nobody's answered yet

What none of the banks have settled — and what reporting suggests they're now pushing onto regulators — is liability. If an AI agent a customer installed moves money in a way the customer didn't intend, is that the bank's problem, the agent maker's, or the customer's own? FSTech cites Financial Times reporting that Wall Street executives have already raised the question directly with the Federal Reserve, which declined to comment but is said to have welcomed banks tightening access in the meantime. That's a telling signal in itself: a technology still described as useful enough that 'customers want to use these agents,' in Axios's framing, is being walled off by its own intended beneficiaries before anyone has agreed on who's on the hook when it goes wrong. For now the banks are converging on the same hedge — read-only visibility instead of transaction authority — which solves the liability problem by mostly removing the thing that made agentic banking interesting in the first place. Whether that holds once a major vendor ships a bank-endorsed alternative, rather than an unsanctioned one, is the part none of this week's statements actually addressed.