Should you give an AI agent your bank password? Bank of America says no

AI assistants are moving from answering questions to doing things: booking tables, filling forms and, increasingly, handling payments. Some ask you to hand over login details so they can act on your behalf. In late October 2026, Bank of America told its customers plainly not to share their username and password with anyone, "including an AI-enabled tool or agent that offers to act on your behalf".

Why banks are worried

• Security: an agent that stores or processes your banking credentials becomes a new place they can leak from. If the agent provider has a flaw, your account is exposed.
• Fraud detection: an agent logging in from a data centre, at odd times, behaves differently from you. Banks may flag it as suspicious and lock your account.
• Mistakes: agents can misunderstand instructions and buy the wrong thing or pay the wrong person.
• Liability: reports note that if you gave the agent your credentials, the bank may treat payments it made as authorised by you. Getting money back can be much harder.

Banks are also working on ways to tell human logins from agent logins, and some are blocking outside agents entirely while rules catch up.

The safer pattern: permission, not passwords

There is a better model than handing over your password. Many banks and payment services let you connect apps through official, limited permissions: the app can see a balance or start a payment, but you approve it in your banking app, and you can revoke access at any time. This is how open banking works in the UK and EU. If an AI tool supports that kind of connection, it is far safer than typing your password into it.

Practical rules for AI and money

1. Never type your banking password, PIN or one-time codes into a chatbot or agent.
2. Use the bank's own app for payments, even if an AI helped you plan them.
3. If you try an agent for shopping, use a virtual or low-limit card where your bank offers one, and keep payment confirmation switched on.
4. Check your statements and app notifications more often while you experiment.
5. Be suspicious of any "AI money assistant" you found through an advert. Fake AI apps are a common way to steal credentials.

For IT teams

The same question is arriving at work: staff connecting AI agents to email, finance systems and SaaS tools with their own credentials. Set a clear policy, offer approved tools with proper delegated access, and monitor for new OAuth grants and unusual sign-in locations. Our notes on safe AI use at work and identity and access management cover the basics.

The bottom line

AI agents will get better, and safer ways for them to handle payments are being built. Until your bank offers an official way to connect them, keep your password to yourself.

Sources

• TechRadar: Bank of America tells customers to stop sharing banking passwords with AI agents
• this week in security, 1 November 2026 edition