Banks are blocking external AI agents. Is this sustainable?

• Key insight: Large banks are blocking external AI agents due to security and fraud risks.
  
• Expert quote: "Agents aren't going anywhere, and firms on all sides of this transaction will need to adapt to give clients what they want in a secure and managed way. As banks try to block AI agents, "the agents will go and open accounts for consumers at other firms that are not as restrictive." —Jeff McMillan, founder of McMillanAI

A large bank was monitoring the behavior of an ordinary-looking AI agent when it saw something shocking: The agent conducted a password reset on an account, accessed the account, changed the approved accounts to which money could be transferred, and moved $100,000 out of the account.
The bank's fraud team went to the CEO and recommended a policy of immediately blocking all external AI agents. The anecdote was shared with American Banker by a source who spoke under condition that the bank's identity not be disclosed.

Processing Content

Similar scenarios have been playing out across the industry, as five of the largest U.S. banks — JPMorganChase , Citi, Bank of America , Wells Fargo and Morgan Stanley — are blocking external AI agents from accessing their customers' accounts. On Wall Street, leaders at Charles Schwab have said they're actively blocking Meta's AI agent, Muse, and similar autonomous AI tools from accessing customer accounts or moving money.

Financial executives have raised concerns over account security, handing bank passwords to third-party software and the lack of clear liability if an AI agent makes a financial error or an unauthorized transfer.

"We've got to make sure our customers are not hurt by [agentic AI], and so that is of concern," JPMorganChase CEO Jamie Dimon said during the company's Oct. 13 earnings call. "Think of it as an AI agentic concern, which is heightened because you don't want rogue agents, and there could be thousands of them."

Consumers using AI agents need to understand the risk, Dimon said. "There's a liability transfer, they should understand the liability transfer. If that is being misused, they should understand it's being misused. So we have to make sure we protect our customers in the right way … we're not going to allow just any outside agent to come in inside the company because that's just too risky for clients and for JPMorgan."

The bank's digital services agreement states in all caps that when customers let AI agents access their accounts, "you assume the entire risk for the fraudulent, unauthorized or otherwise improper use of your login credentials."

A Wells Fargo spokeswoman confirmed that the bank has taken steps to block unauthorized agents from accessing customer accounts. Its online access agreement also holds customers responsible for the actions of their AI agents. If customers provide an AI agent with their login credentials or otherwise authorize an AI agent to act on their behalf, "any instructions, actions, or transactions initiated by the AI agent are deemed to have been initiated and authorized directly by you, without further verification, and we have no obligation to investigate the validity or scope of such authority," the agreement states.

Morgan Stanley and Bank of America did not respond to requests for comment. Citi declined a request for comment.

Rhea Rajwani, head of AI and emerging banking solutions risk at M&T Bank, declined to say whether her bank is blocking external AI agents.

"What matters most is trust and control," Rajwani said, "and it is important to know what is accessing your environment, what sort of permissions does it have, what actions could it take, what is exposed to this risk and then decide to move forward."

Many banks have set up agentic AI war rooms, according to Matt Thompson, CEO of Transmit Security and former senior director of identity services at Capital One Financial. "I don't want to be alarmist about it, but some of the behaviors that we're seeing by these consumer agents in banking applications and fintech applications is alarming," he said.

Banks have legitimate reasons to block AI agents, according to Jeff McMillan, who until March was head of firmwide AI at Morgan Stanley and now runs the consultancy McMillanAI.

"Payment law still applies, but there are no agreed standards yet for how a bank verifies an agent, what the customer authorized it to do, or who is liable when it goes wrong," McMillan told American Banker. "Until those exist, blocking agents that log in with a customer's password is reasonable."

Consumers are worried about agentic AI manipulating their bank accounts, too. On Tuesday, the American Bankers Association will release the results of a survey of more than 4,000 American adults, that found that 77% are concerned about giving an AI agent permission to move money, make payments or carry out other financial transactions for them.

The situation feels similar to 10 years ago, when Plaid and Mint were logging into bank accounts using their fintech clients' customers' credentials to screen-scrape their account information. At first, some banks thought these automated screen scrapers were fraudsters or cybercriminals and blocked them. Then banks started signing agreements with the major data aggregators to share customer data through application programming interfaces using authentication standards.

If history repeats itself, banks and tech companies will hammer out agreements on identity, authentication and liability protocols, and then banks will lift their bans on external AI agents.

Risks of external AI agents

External AI agents, working at the behest of customers or bad actors, present an array of security and account-takeover risks. They can be malicious and set out to steal money or information. They can start out innocently and suddenly go rogue, accessing data they shouldn't, or finding credentials and attacking other companies.

An AI agent could read a consumer's emails, see one that appears to be an investment offering from a financial institution, "decide this is really great and start to even convince you that this is a good offer and you should accept," Mickey Boodaei, co-founder and chairman of Transmit Security, told American Banker.

"If it has the mandate to go and do things on your behalf, which I believe eventually they will, because no one wants to look at every single thing that they're doing on an account, you're just going to trust them that they're going to do the right thing. This is the world that we're moving to."

AI agents also present a competitive risk. Consumers could use Muse, ChatGPT, Claude or some other agentic AI assistant to move their deposits to banks or fintechs with higher-yield accounts or lower fees.

The latest generation of AI agents have "figured out customer experience," Boodaei said. "So you communicate with it over WhatsApp or iMessages, and it's very similar to a financial advisor or personal assistant. It's much less interactive in terms of asking for permissions, and it's much more independent in the way that it works."

Boodaei has been using Muse and Instinct, another personal AI assistant, to book flights and reserve hotel rooms and make restaurant reservations.

"It's so convenient that for the past month or so, I haven't accessed a single website for an airline or hotel chain or anything like that," he said. His 86-year-old father is doing the same.

Blocking AI agents is not easy

Though some banks are trying to block external AI agents, they're aware that they can't block them all.

"They're blocking agents that are self-identifying, but they all recognize that there are still agents getting through," Thompson told American Banker.

Blocking is technically extremely hard to do, he said. External AI agents tend to operate through web browsers built using open-source Chromium code created by Google, and they tend to be stripped of identity information.

"They also mimic the behavior of actual human users, so it's really hard to detect," Boodaei said. For instance, they can quickly learn to copy the typing and clicking patterns of human customers.

Some banks try to detect AI agents by their IP addresses, for instance blocking those coming from Anthropic or Meta, but they can come in through proxies, he said.

The software that banks use today for authentication, know-your-customer checks and identity verification is designed to identify human users and human behavior, Thompson said.

"All of this has to be rethought, redone, because the agents are much more adaptable," he said. "They're trying to complete a task, and they will adapt to get the task done as quickly and efficiently as possible."

Read more:

• As fintechs nab bank charters, what's happening to BaaS?
• Overheated data center knocked 23 credit unions offline
• Chris Britt still says banking is broken, but Chime can fix it
• Credit unions bulk up a business that banks long dominated

Banks typically use device identification as one way of verifying that an incoming user is truly the account owner.

But "this all goes away with agents because they are coming from their own devices in the cloud, and they keep changing devices every time they access," Boodaei said.

Many banks also use behavioral biometrics that analyze the way the user types, moves their mouse, holds their phone and other behavior patterns to determine whether the user is the original account owner. This also goes away with agents gaining access to accounts, he said, because the agents can quickly learn to mimic their human counterparts.

AI agents also mess with a classic method of detecting fraud — transactional profiling, or analyzing transaction patterns and red-flagging those that are out of character for the customer.

"You'll start seeing transactions and behaviors inside the application for a specific customer that are generated by the agent, and they do not match any previous profile for that user," Boodaei said.

There's talk of making AI agents register or declare themselves. Boodaei said this is unlikely to be successful because most agents don't have an incentive to comply.

"As long as they can evade, it's better for them to evade and not identify themselves," he said. "Because if they identify themselves, then enterprises and applications can put controls around them, and this will lead to not a great customer experience."

Even when a bank can correctly differentiate between legitimate and rogue agents, "they can't tell what the customer actually authorized, and that is what the infrastructure still lacks," McMillan said. "The idea of agentic validation is a big one that people will be talking about a lot more. Essentially, companies want to know who the agent is, what tasks it can perform, and who owns it and takes the blame if it doesn't do what it's supposed to. None of this is currently defined or agreed upon."

Proposals have been floated. Lead Bank, for example, has put forward a liability framework for external AI agent-led transactions that go awry. Bank of America and Wells Fargo are design partners on Poppy, the protocol Meta and Sierra introduced this month for agents to identify themselves and get customer permission. On Monday, the Financial Data and Technology Association released a white paper that offers recommendations for handling liability and authorization of agentic AI transactions.

Blocking is not sustainable

As consumers continue to use AI assistants for more tasks, including finding accounts and financial providers and managing their money, experts agree banks may not be able to fend them off forever.

"Agents aren't going anywhere, and firms on all sides of this transaction will need to adapt to give clients what they want in a secure and managed way," McMillan said. As banks try to block AI agents, "the agents will go and open accounts for consumers at other firms that are not as restrictive," he said.

Over time, financial firms will have to balance their desire for growth against the risks and speed of agentic AI development, Boodaei said.

"We're in this agentic era, and it's going to require them to not take such rigid positions," he said.