Banks Cannot Tell an AI Agent From an Attacker, So the Agents Are Locked Out

Major US banks have detected third-party AI agents operating inside customer accounts, some attempting transactions. With no way to verify who authorized an agent, the industry's answer is a locked door and read-only access.

For two years the pitch has been the same: the agent is the new interface. You stop clicking through apps; you tell a program what you want and it goes and does it, including the part where money moves. This week that pitch met an institution that does not do vibes.

At Money20/20 in Las Vegas, Naveed Anwar, global head of AI, digital and data platforms inside Citi's services business, explained how a $2.6 trillion-asset bank is handling software that wants to act for a customer. Citi has "blocked anything that is trying to access our walls agentically," he said, beyond the read-only open banking connections it has offered for years. "As of right now, no one is connecting to Citi agentically, because we just don't know what those models will be able to do."

Days earlier, Axios reported that major US banks had already detected unauthorized third-party agents operating inside customer accounts. Some agents attempted transactions. Others contacted call centers, or appeared to act independently of user instructions. Morgan Stanley, Bank of America, JPMorgan Chase and Wells Fargo were described as racing to contain the risk, and Morgan Stanley had begun blocking third-party agents outright. A Morgan Stanley spokesperson told Axios the bank has not observed "rogue AI agents accessing our platforms," which is the sort of denial that leaves the rest of the sentence doing the work.

These are mostly not intrusions in the classic sense. In the cases described, the agent got in the ordinary way: the customer handed over their username and password. That violates nearly every retail banking agreement, which requires the account holder to be the one logging in. In contract terms, giving an agent your credentials is giving a stranger your keys, and banks have spent decades treating credential sharing as a reason to disown a fraudulent transaction rather than reimburse it. An agent that transacts "for" you is, from the fraud department's chair, you behaving in an unusual pattern with no human to call.

Which is the actual technical problem, and it is not really about AI. "When agents use your login info, a bank cannot tell an authorized agent from an attacker using the exact same login," Ted Miracco, chief executive of the mobile security firm Approov, told CNET. "That is more of an identity failure than an AI failure. Until agents carry verifiable identities, scoped permissions and an audit trail, blocking them is the best defensible control a bank has."

That sentence explains the whole week. Banks are not blocking agents because the models are bad. They are blocking them because the account system has no primitive for "a program acting on my behalf with exactly this much authority, for exactly this long." A password is binary: you have it or you do not. There is no scoped token for "may read balances, may not move money, expires Friday," no signed assertion of which human delegated which task, no log a bank can audit to separate a shopping agent from a credential-stuffing bot wearing the same login.

The counts are no longer hypothetical. Charles Schwab chief executive Rick Wurster told Bloomberg his bank blocks clients' agents "in the tens and twenties, per week." JPMorgan's Jamie Dimon, on the bank's October 13 earnings call, framed it as a contract problem rather than a model problem: "There's a liability transfer. You don't want rogue agents, and there could be thousands of them."

What banks will accept is narrower than what agents promise. Most are moving toward read-only access, the same plumbing that has let budgeting apps like Quicken see balances for years, where an agent can look but not touch. Citi's Anwar wants a "know your agent" regime analogous to know-your-customer, with the agent itself identified, registered and bounded before it comes near an account. The alternative being built in parallel is the bank's own assistant: Schwab's Charley, and Fifth Third's plan, described by chief executive Tim Spence, to fold every useful agentic feature into the bank's app behind what he called "bank-grade information security as a perimeter."

Not everyone is panicking. Fifth Third chief financial officer Bryan Preston called concerns about AI-driven cash optimization "likely overblown," noting that the bank's median household checking balance is about $3,000, so there is not much idle cash to optimize. PNC's Bill Demchak took the harder line, saying agent-only transactions inside accounts "will never happen," because "no bank is going to let people transact inside of accounts without a human in the loop." Meta, OpenAI and the rest, he suggested, are "kids in a room with a new toy and they're messing around with money."

Strip out the security framing and there is a balance sheet underneath it. A personal agent that watches your accounts and sweeps idle balances into higher-yield instruments is, functionally, a slow run on the least profitable and most valuable funding banks have: cheap retail deposits. The same capability that makes an agent useful to a customer makes it a quiet threat to the deposit franchise. Security is the honest objection and also the convenient one.

The resolution will not be dramatic. It will look like an API: agents that carry verifiable identity, narrow scopes and an audit trail, admitted through a front door the bank controls, allowed to read widely and transact narrowly, with a human in the loop above some threshold. Until that exists, several trillion dollars of deposits sit behind a door that says no, and the agents that were sold as the interface to everything have found their first hard boundary. It is not a limit on what the models can do. It is an account that cannot tell who is asking.

Sources: Tom's Hardware, Banking Dive — Citi, Banking Dive — PNC, Banking Dive — Fifth Third, CNET