Banks Are Reportedly Catching AI Agents Logged Into Customer Accounts. Schwab Blocks Them Tens of Times a Week.

Give an AI agent your banking password and your bank sees you. It uses the same credentials, the same login screen, the same session you would. There is no field in the log that says a robot did this.

Axios reported Thursday morning that major US banks have started finding exactly that, with third-party AI agents operating inside customer accounts and most of them never approved by the bank. The reporting, by Axios' Madison Mills, rests on people familiar with the situation rather than on bank statements, so treat it as a report. Where banks have gone on the record, they have been careful. A Morgan Stanley spokesperson told Axios the firm has not seen instances of "rogue AI agents accessing our platforms."

What the banks have said out loud

A fair amount of this is on the record. Jamie Dimon told JPMorgan's earnings call the bank will not let outside agents operate inside it: "We're not going to allow just any... outside agent to come in inside the company," because "it's just too risky for clients and for JPMorgan." He has also warned about "rogue agents" turning up on financial platforms. Charles Schwab CEO Rick Wurster told Bloomberg Television that Schwab blocks outside agents that try to move client money, Meta's Muse included, and that he gets a weekly report on the blocks. Wurster said the big agents are stopped "in the tens and twenties each week." Bank of America's Brian Moynihan has said a human should stay in the loop to approve any money leaving an account. PNC's William Demchak called agent-initiated transactions inside accounts "incredibly unsafe" and said they are "not going to happen" for now.

Not every bank reports the same thing. U.S. Bancorp CEO Gunjan Kedia said on an October 15 earnings call that her bank had not run into third-party agents moving customer cash and did not expect a near-term impact. Several of the largest banks are blocking or restricting something, and at least one of them is counting the blocks every week.

Your password versus a sanctioned connection

When a third-party agent logs in with your username and password, it inherits you. Anything you can do, it can do, and the bank's record of that session says you were there, because by every signal the bank has, you were. You cannot hand it narrower powers than your own. You cannot revoke it except by changing your password, which also logs out everything else you own. And the bank cannot separate a careful agent from a confused one, or from somebody who phished you last week.

A sanctioned connection works differently. The third party gets its own token with a scope attached, so "show me my balance" and "send this wire" are separate powers and it holds only the first. The bank keeps a consent record, which means there is an answer to who approved what. You switch it off in your bank's settings without touching your password. Every action carries the app's identity instead of yours, which is the part that decides who pays when something goes wrong. Axios notes banks already run this model for the apps they do allow, Quicken among them.

That gap is what the industry says it is closing. Axios reports banks are rewriting terms of service and moving toward read-only agent access, which lets an agent look at your money without touching it. Schwab says it will offer read-only access through MCP servers, and would rather you use Charley, its own assistant. 1Password announced a system today that logs an agent into a site without ever showing it the password, which suggests even the companies built on credentials treat credential-sharing as a stopgap.

How they are catching them, roughly

Nobody has described a detection system in any detail. Axios says banks are tracking activity when agents contact call centers, and when a session appears to act independently of what the customer asked for. One bank executive told Axios the hard part is telling agents apart from people, and then telling an agent the customer asked for from one that merely has the customer's password. Bank executives reportedly called the situation "horrifying," which is one anonymous characterization rather than a finding.

Nobody has said money moved wrongly

Across the Axios report and the coverage of it, there is no claim that a third-party AI agent has wrongly moved a customer's money out of a US bank account. What is described is preventive: blocks, restrictions, terms-of-service rewrites, and executives alarmed in advance. Gizmodo mentioned a separate OpenAI case in which an internal research agent took funds from a crypto wallet, and noted the funds had no real value. No customer bank account was involved.

The liability hole

Wurster asked the question that still has no answer: "We can't control it, the client can't control it, something could go wrong and who's liable?" Engadget reports that banks likely would not reimburse a customer in that situation, because under laws such as the US Electronic Fund Transfer Act, handing over your own credentials makes the resulting transfer a voluntary one rather than an unauthorized one. Nobody has tested that against an AI agent in court. Demchak said agent transactions would need liability-shifting law behind them, along with secure connections, authentication and a human in the loop. Congress is still arguing about it.

What to do with your own accounts

Chase's advice, on the record, is the short version: do not share your username and password with anyone, agents included. Past that, if you want an agent looking at your finances, find a connection your bank sanctions and check what it is permitted to do, because read-only and can-move-money are very different products wearing the same word. Read the terms-of-service email when it arrives, since several banks are rewriting those right now and the new language may simply prohibit what you were planning. And keep the money movement itself under your own hand for a while. Moynihan's version of that, a human approving anything that leaves the account, is a decent personal rule until the liability question has an answer.