Featured Article : AI Agents Raise Risks For Your Bank Account
AI agents accessing bank accounts are raising concerns about software acting beyond customers’ instructions, highlighting the risks of giving automated assistants financial authority and the safeguards businesses need before trusting them with money.
What Has Prompted The Concern?
Some US banks have reportedly detected outside AI agents accessing customer accounts, with concerns that certain tools were attempting actions beyond users’ instructions. In some cases, it seems customers had given the software their login details so it could help manage their finances.
The big concern, however, is what happens once that access has been granted. For example, someone asking an assistant to review their spending may not want to let it move money or change account settings, yet their login could give it access to those functions. Banks therefore need to distinguish between what an agent can technically do and what the customer has actually authorised.
Some institutions are responding by blocking or restricting outside agents. However, Morgan Stanley recently said it hadn’t identified unauthorised or rogue AI activity on its platforms, perhaps showing that some restrictions are precautionary. The worrying reports clearly raise some serious questions about control and oversight, but don’t establish that every bank taking action has experienced customer losses.
Why Are AI Agents Different?
An ordinary chatbot can suggest a budget or explain a statement, but an agent can use connected tools to actually carry out tasks, potentially navigating websites, contacting organisations or initiating transactions where its access permits.
That ability could save time, but it changes the consequences of a mistake. An inaccurate recommendation can be checked before anyone acts. Software with transaction permissions may put the same mistake into practice before the customer notices.
The important distinction is therefore between giving an agent information and giving it authority. Permission to analyse spending should not automatically provide the ability to move funds or change payment details.
What Are Banks Saying?
JPMorgan’s published earnings transcript actually provides an account of its position. For example, during the 13 October call, chief executive Jamie Dimon said the bank uses agents internally but would restrict outside access because of risks to customers and the institution.
He explained, “we’re not going to allow just any outside agents to come in inside the company”. Chief financial officer Jeremy Barnum identified credential sharing and screen scraping, where software retrieves information through a customer’s banking interface, as methods the bank considers insecure and is blocking where possible.
It’s worth noting here that banks also have a commercial interest in how these tools develop. Barnum acknowledged that personal AI agents could help customers find better returns and move their money more easily between providers. Banks therefore face pressure to protect accounts while competing to keep customers’ deposits.
How Could An Agent Go Wrong?
A financial agent doesn’t need malicious intentions to cause harm. For example, it might misunderstand a task, overlook a restriction or treat an instruction encountered in external material as something it should follow.
Attackers can also try to manipulate an agent by hiding instructions in a webpage, email or document it reads. Known as prompt injection, this could trick the software into sharing confidential information or attempting a transaction the customer never requested, depending on what it has permission to do.
There is no confirmation that this caused the reported banking incidents, but it may help to explain why telling an agent to follow the rules is not enough. The UK’s National Cyber Security Centre advises organisations to limit what agents can access and do, monitor their actions and keep a reliable way to stop them if something goes wrong.
Could AI Become Harder To Monitor?
Researchers also warn that AI could become harder to monitor if models use unreadable shorthand (essentially their own language) or produce fewer written reasoning steps. In banking, this could make unexpected actions harder to investigate, reinforcing the need for payment limits and approval checks that work independently of the AI’s explanations.
Can AI Payments Be More Controlled?
It should be noted here that AI can help customers make payments without being given broad access to their bank accounts. For example, Sierra and Stripe have introduced a service that lets someone discuss a bill with an AI telephone agent and then choose to pay during the same call.
Sierra says healthcare billing company Cedar is already using the integration. When the customer is ready, they enter their card details using the telephone keypad, Stripe processes the payment and the agent confirms the result. The customer remains involved at the point of payment, rather than leaving an assistant to decide when and how to move their money.
This offers a more controlled way to use AI, although protecting card details is only part of the process. The payment must still match the amount, recipient and purpose the customer has agreed to.
What About UK Customers?
For UK customers, the distinction between viewing financial information and authorising payments is already part of open banking. Some services can retrieve balances and transactions to help with budgeting, while others can initiate payments with the customer’s consent. The Financial Conduct Authority says providers must have the appropriate registration or authorisation for the activities they carry out.
Connecting a financial tool therefore doesn’t necessarily mean handing over a banking password or giving it unrestricted access. Businesses should check who provides the service, what permissions it requests and whether those permissions are necessary for the task.
They should also check the terms covering mistakes and disputed transactions. Comments from US banking executives about customer responsibility should not be treated as a definitive statement of UK rights, which depend on the circumstances and applicable rules.
What Does This Mean For Your Business?
For businesses considering AI to help manage their finances, a useful first step may be to trial a specific task, such as preparing a cash-flow summary, with access limited to reading account information. Staff can then check whether the results are accurate and useful before deciding whether the software needs permission to do more.
If the service can make payments, the payment system itself should enforce approval requirements and limits on amounts and recipients. These safeguards shouldn’t depend on the AI remembering instructions. Businesses also need a straightforward way to stop transactions and records showing what was requested, who approved it and what the software actually did.
With those controls in place, AI could reduce routine administration and help businesses make better-informed financial decisions. A named person should remain responsible for reviewing its access, checking its work and taking action if it does something unexpected.
The banks’ response in this whole story shows how quickly financial services are having to adapt as AI moves from offering advice to taking action. The challenge is to make useful automation available while ensuring that permission to help never becomes permission to do whatever the software decides. Confidence will depend on customers understanding what they have authorised and having reliable controls over what happens next.
