As personal AI assistants become more popular, Bank of America is urging customers to keep their banking usernames and passwords to themselves. Its warning highlights the risks of giving an outside service access to an account, even when that service is an AI tool offering to act on a customer’s behalf.
What the bank told customers
In an email titled “Protecting your finances in the Al World,” Bank of America advised customers never to share their username and password with another person or an outside service. The warning explicitly included “an Al-enabled tool or agent that offers to act on your behalf.”
The concern is practical: once an AI assistant has banking credentials, it may be able to take actions with a customer’s finances without their knowledge. A bank could also interpret activity as an attempt to raid the account and lock the customer out.
There is another risk if the assistant itself has a security flaw. The credentials could be exposed elsewhere, potentially giving financially motivated hackers a way into the bank account. The email puts the responsibility for resulting activity on the customer: “If you do share your credentials,” it says, “keep in mind that you’re responsible for activity resulting from that access.”
Why AI agents raise new questions for banks
Banks are still exploring how AI agents might fit into financial services. At the same time, they are reportedly grappling with unauthorized agents accessing customers’ money.
One emerging use is agentic payments. These allow people to set agents to buy things autonomously, such as at the best price or the right time. For that to work with bank accounts, banks, payment providers and processors need to figure out how customers can grant AI tools access safely.
That challenge helps explain why sharing a username and password is consequential. A login can provide access to an account, but the bank’s message makes clear that handing it to an outside tool can leave the customer responsible for what follows. The email does not describe a safe credential-sharing method; it tells customers not to share those details with an AI-enabled service.
Access can carry responsibility
The warning also points to the role of bank account agreements. The source article says that account agreements at most banks hold customers responsible for anyone they give their login to. That means the consequences of an AI assistant’s actions may fall on the person who supplied the credentials.
Customers considering an AI assistant for financial tasks therefore face several connected concerns: the tool could act without their knowledge, access could trigger a bank lockout, or a flaw could expose credentials. Even when the goal is convenience, giving an agent a banking login can create consequences beyond the intended task.
A caution as financial AI develops
Bank of America did not immediately respond to a request for comment about its email. Its warning comes as financial companies continue working out how AI agents could interact with accounts and payments.
For now, the message to customers is direct: do not provide banking usernames and passwords to another person or outside service, including an AI assistant. As banks explore agent access, customers should keep in mind the responsibility the bank says comes with sharing credentials.