🔍 Read the full analysis: How To Give An AI Agent Limited Money Access on ThorstenMeyerAI.com
Prime made for students and young adults
- Fast, free delivery for dorm and study essentials
- Prime Video and Amazon Music included
- Member-only deals
TL;DR
Bank of America has warned customers that sharing banking credentials with AI tools could leave them responsible for activity conducted through that access. The warning comes as financial firms report growing use of AI agents for money-related tasks. Read-only permissions, transaction approvals, capped virtual cards and separate accounts can limit exposure, but they do not by themselves settle who is liable for losses.
Bank of America warned customers this week not to give their banking usernames or passwords to AI agents, saying customers who share credentials are responsible for activity resulting from that access. The warning comes as banks confront third-party agents entering customer accounts and financial firms report growing interest in AI-driven transactions, raising questions about how to limit an agent’s access—and who bears the loss if it makes a mistake.
The email, titled “Protecting your finances in the AI World,” said credentials should never be shared with another person or outside service, including an AI-enabled tool or agent acting on a customer’s behalf. Bank of America also said it was “excited about what AI used responsibly can deliver.” TechCrunch reported the email on Oct. 27 after a customer posted it on Bluesky; a bank spokesperson confirmed to TechCrunch that the message was authentic.
The warning follows an Axios report published Oct. 22, citing unnamed sources, that major U.S. banks are finding third-party AI agents inside customer accounts, often signed in using the customer’s own password. The report said banks may have difficulty distinguishing activity a customer intended from activity they did not. Separately, Visa told investors this week that trust is the main barrier to AI agents paying for purchases, while Robinhood said customers had placed more than $250 million into accounts that AI agents trade. Those figures and statements show activity in the sector, but do not establish how broadly consumers use agents or how safely they operate.
Sharing a password gives an agent access associated with the customer’s login, rather than limiting it to one task. A narrower arrangement could use read-only access, require customer approval for each payment, or set a virtual card’s spending cap. Other options described in the source material include a token restricted to a particular merchant, amount and time window, or a separate account with only a limited balance. These controls can reduce potential exposure; they do not guarantee that an agent will behave as intended or decide who is legally responsible.
Before your agent touches money
Give it a valet key, not the master key
Logging in with your password makes the agent you. A credential made for the agent can do only the job you gave it, and you can take it back.
- What it opensEverything you can do: transfers, payees, settings, statements
- LimitsNone that the agent cannot get around by logging in as you
- What the bank seesYou, or a thief. It cannot tell which
- If a web page tricks itThe trick reaches your whole account
- To take it backChange your password everywhere it was used
- If money goes missingUS rules can exclude transfers by someone you gave access to; Bank of America: “you’re responsible”
- What it opensOnly what you allowed: read-only, one card, one pot of money
- LimitsBuilt in: amount, merchant, time window, approval on your phone
- What the bank seesAn identified agent acting for an identified person
- If a web page tricks itThe damage stops at the limit
- To take it backDisconnect the agent or delete its card. Your password never moved
- If money goes missingDepends on the terms. Read them first: some still put all risk on you
A comparison of two set-ups, not a measurement. Which limits exist depends on your bank, card and app.
Sources: Bank of America customer email, confirmed to TechCrunch (27 Oct 2026); 12 CFR 1005.2(m); OWASP LLM01. Comparison: Thorsten Meyer.
Powered by Thorsten Meyer AI
Limiting an Agent’s Financial Reach
The distinction between a password and a limited payment permission matters because an agent may read instructions and act across digital services. If it can log in as the customer, the bank may see activity that looks like the customer’s own—or like a stolen credential. That can create two different problems: an unintended payment may be difficult to dispute, or a bank may flag legitimate agent activity and restrict the account.
Controls limit the amount an agent can do, while liability rules determine who pays if something goes wrong. Those are separate questions. A spending cap or approval step can reduce the possible cost of an error, but customers and companies still need to understand what happens when the agent exceeds its instructions, is manipulated by outside content, or triggers a fraud review. For people considering agent-enabled financial services, the terms governing authorization and loss are as important as the advertised convenience.
Popular right now
Shark Navigator Lift-Away Upright Vacuum (NV360)
Dreame L50 Ultra Robot Vacuum and Mop
Samsung 42-Inch Class OLED S90F 4K Smart TV (2025)
As an affiliate, we earn on qualifying purchases.
The Password and Liability Gap
U.S. Regulation E defines an unauthorized electronic transfer to exclude, in specified circumstances, a transfer initiated by someone the consumer furnished with access to the account, unless the consumer has told the bank that the access is no longer authorized. The source article argues that this language could be relevant when a customer gives an AI agent credentials, but makes clear that applying it to an AI agent or its operator is an interpretation, not a court or regulator ruling.
In the European Union, the Payment Services Directive requires payment-service users to take reasonable steps to keep personalized security credentials safe. The article notes that whether sharing a password with an AI agent would count as gross negligence under the directive has not been tested in court, based on the author’s research. The legal outcome can depend on facts, applicable rules and contract terms; the cited provisions do not settle every agent-related dispute.
There is also a technical risk: agents can be influenced by instructions embedded in webpages, emails or files, a type of manipulation known as prompt injection. The source identifies this as a risk recognized by the OWASP project. That possibility strengthens the case for limiting permissions, but does not establish that every agent or transaction is vulnerable.
““If you do share your credentials, keep in mind that you’re responsible for activity resulting from that access.””
— Bank of America, in its customer email as reported by TechCrunch
Liability Rules Still Unsettled
No court or regulator ruling identified in the source determines whether sharing banking credentials with an AI agent triggers the cited U.S. or EU liability provisions. The source author presents the legal application as their reading, not legal advice. Customers should not treat the warning or the cited laws as a definitive answer for every case.
It is also unclear how common unauthorized agent access is, how often agents have caused financial losses, and how banks will distinguish customer-approved actions from unwanted ones. The Robinhood account figure does not specify in the source material how many customers or trades it represents, or the period over which funds were deposited. The details of Visa’s comments and the banks’ reported responses are likewise limited in the material provided.
Watch for Safer Payment Controls
Customers considering AI-assisted payments can check whether a service offers limited permissions, transaction-by-transaction approval, a capped virtual card or a separate account, and read its terms for responsibility when an agent acts incorrectly. They should also check whether access can be revoked and what steps the bank requires if credentials have already been shared. These are practical safeguards, not a guarantee against loss.
Banks and payment companies will need to explain how their controls work and how they handle disputed agent activity as these services develop. The source material does not identify a scheduled policy change, regulatory decision or product launch as the next milestone. For now, the key distinction is between giving an agent a broad login and authorizing a narrowly defined task.
Key Questions
The bank’s email says credentials should not be provided to outside services, including AI agents, and warns customers they are responsible for activity resulting from shared access. A password can give an agent access associated with the customer’s account login rather than one limited task.
What are safer ways to let an AI agent make payments?
Options described in the source include read-only access, approval for each payment, a virtual card with a spending cap, a token limited by merchant, amount and time, or a separate account with a restricted balance. The availability of these controls depends on the service.
Will a bank reimburse a payment made by an AI agent?
That cannot be answered categorically from the source material. The application of U.S. and EU payment rules to credentials shared with an AI agent has not been settled by a court or regulator identified in the article. Check the bank’s terms and applicable rules for your circumstances.
What is prompt injection, and why does it matter here?
Prompt injection is an attempt to steer an AI system through instructions placed in content it reads, such as a webpage, email or file. If an agent can take financial actions, limiting its permissions and requiring approval can constrain what it can do if it is misdirected.
Source: ThorstenMeyerAI.com
