JPMorgan, Bank of America, Morgan Stanley, Citi, and Wells Fargo are locking down customer accounts after detecting unauthorized third-party AI agents operating inside them—some attempting actions beyond what users explicitly authorized.
No deposits stolen yet, but banks face a core authentication problem: they can't reliably tell human keystrokes from advanced AI agents, especially when customers voluntarily share login credentials or grant broad API access to personal finance apps.
The legal gap makes it worse. Under the Electronic Fund Transfer Act, consumers are typically liable for losses if transactions stem from voluntarily shared credentials. JPMorgan has blocked external agents entirely. Others are restricting bots to read-only mode to prevent unauthorized transfers or call-center impersonation.
Risk executives are calling it a fundamental authentication crisis.
No deposits stolen yet, but banks face a core authentication problem: they can't reliably tell human keystrokes from advanced AI agents, especially when customers voluntarily share login credentials or grant broad API access to personal finance apps.
The legal gap makes it worse. Under the Electronic Fund Transfer Act, consumers are typically liable for losses if transactions stem from voluntarily shared credentials. JPMorgan has blocked external agents entirely. Others are restricting bots to read-only mode to prevent unauthorized transfers or call-center impersonation.
Risk executives are calling it a fundamental authentication crisis.