Major Banks Restrict AI Agents Amid Fears of Unauthorized Transactions

Major Banks Restrict AI Agents Amid Fears of Unauthorized Transactions

Okay, all. It’s time to go full Ron Swanson.

Sources told Axios that major U.S. banks have detected unauthorized AI agents inside customer accounts.

These banks allow access to third-party apps such as Quicken so customers can budget their money.  Most banks, though, require humans to log in to move money or pay bills.

Some of those agents supposedly try “to take actions that appear to be independent of user instructions.”

These banks include Bank of America, JPMorgan, Morgan Stanley, and Wells Fargo. However, when you dig deeper, the freakout appears to be about protecting the business and the consumer:

Driving the news: Banks including Morgan Stanley, Bank of America, JPMorgan, Wells Fargo and others are racing to contain agent risks. Some are aware of unauthorized access, people familiar with the issue said.

• These are generally situations when an agent or AI assistant accesses a human’s account with the user’s permission and login credentials. Even if permitted by the user, this goes against the guidelines of most banks requiring that humans log in to their own accounts.
• This presents significant security risks: Banking executives fear the steps agents with login access might take, especially if a user has granted purchase authority or the ability to shift funds.
• In other instances, some banks have tracked activity when agents — programmed to fulfill requests or complete tasks on a user’s behalf — contact call centers or appear to take actions independent of user instructions, the people said.

The banks cannot act fast enough because employees have a difficult time “distinguishing between a human and an unauthorized bot.” The trouble forces them to shut down technology and rewrite the terms of service.

Banks have started restricting third-party AI agents from gaining access, fearing those “agents could drain deposits by moving idle cash in search of higher returns.”

Citigroup and Bank of America restricted access just last week.

Bank of America CEO Brian Moynihan told CNBC that the company hired 1,000 contractors to patch software to prevent AI agents from exposing any vulnerabilities.

“We strongly believe there should be a human in the loop to authorize money moving out of your account,” explained Moynihan. “We’re working with the agentic agent providers to say ‘hey, you really don’t want consumers coming back and say money moved over from my account and I don’t know why and I don’t know where it went and the agent did it.’”

With so many tools on the market, humans struggle to distinguish between user-authorized agents and agents that go rogue.

Apparently, giving consumers this ability might harm the banks:

A report from Apollo’s chief economist, Torsten Slok, amplified the concerns, with the economist warning that AI assistants could automatically sweep household cash into accounts paying 3.3 to 5 per cent instead of the 0.1 per cent national average on checking accounts.

JPMorgan, Bank of America and Wells Fargo hold $1.6tn of non-interest-bearing deposits — 16 per cent of their liabilities. Paying a 3 per cent rate on those would cost them $47bn a year, almost half of their collective annual earnings.

If banks are forced to pay higher interest rates on retail deposits to keep them from seeking a higher rate elsewhere, it could put a big dent in their profits.

“If every household used AI agents to optimise the return on their cash balances, banks could lose a large share of the cheap deposits they rely on to make loans, which would be a problem for the entire financial system,” he wrote.

Executives have told Federal Reserve regulators they have concerns about “the sharp rise in consumers using AI agents to carry out financial transactions on their behalf.”

JPMorgan Chase CEO Jamie Dimon mentioned the risk rogue agents could pose to the customers:

JPMorgan Chase chief executive Jamie Dimon said this week that the bank would restrict AI agents from accessing client’s accounts “because you don’t want rogue agents and there could be thousands of them”.

“We have to make sure we protect our customers in the right way. So, we’re building tools to do that, too,” Dimon said on a call for the bank’s third-quarter results. “In the meantime, we’re not going to allow just any outside agent to come inside the company because that’s just too risky for clients and for JPMorgan.”

JPMorgan also blocked outside AI agents from acting on customers’ behalf last month.

“Protecting our customers is our top priority. Because it is not safe, we do not permit third parties to access accounts by obtaining customers’ banking credentials and logging in on their behalf,” a JPMorgan spokesperson told CNBC.

The banks need “legal clarification over how customers authorise autonomous technology to carry out financial transactions on their behalf and who is liable if something goes wrong.”

“If people are using them, they should understand the risk,” said Dimon. “They should understand there’s a liability transfer.”

We know common sense no longer exists. People will try to blame the banks, file lawsuits, and waste more time and money. Hence the need for legal clarification.

The moves taken by the banks mean that, for now, the AI agents can access customer data “in a read-only fashion.” The agents cannot send money or pay bills.

Donations tax deductible
to the full extent allowed by law.