The bank’s warning
Bank of America sent its customers a communication entitled “Protecting your finances in the AI World,” in which it recommends not providing usernames and passwords to any other person or to an external service, including AI-powered tools or agents that offer to operate on the user’s behalf. The news is reported by TechCrunch, which cites the content of the email and requested comment from the bank without receiving an immediate response.
According to the report, the message insists on a contractual point: if credentials are shared, the user remains responsible for the activities arising from that access. The bank provided no further clarification to the source, which notes that the contracts of most institutions place responsibility on the customer for anyone who receives their login credentials.
Why delegated access is a risk
The material outlines three risk scenarios associated with sharing credentials with an AI assistant: the agent could carry out financial transactions without the account holder’s knowledge; the bank could interpret that activity as unauthorized access and block the account; or a vulnerability in the assistant could leak the credentials, opening the way to financially motivated malicious actors.
The bank’s concern fits into a broader picture described by the source: institutions are still studying how AI agents can be integrated into financial services, but they must contend with unauthorized agents accessing customers’ money. Banks, payment providers, and processors, according to what was discussed by TechCrunch at the Disrupt conference, are trying to define ways to allow access to accounts through AI tools, including agentic payments that make it possible to instruct an agent to purchase autonomously at the best price or at the most suitable time.
What remains to be clarified and how to read the notice
The email is a customer communication, not a new technical rule: the source does not report changes to contracts, new features for blocking agents, or technical measures announced by the bank. Nor is it known, based on the material, how far the notice responds to concrete incidents of access via AI agents or is instead a preventive measure.
The significance of the notice lies in the tension between two trends described by the source: on the one hand, the growing spread of personal assistants to which users entrust their credentials; on the other, the attempt by institutions to maintain control over account access. The bank’s message makes clear that, at present, the burden of security falls on the customer: until authorized channels for agents are defined, sharing credentials means assuming the risk of the transactions that result.
