Overview
- Banks have detected third‑party AI assistants logging into retail accounts after customers gave them usernames and passwords, which can violate bank rules and widen the attack surface for credential theft.
- Financial firms are actively blocking unvetted agents and shifting many external connections to read‑only modes so tools can analyze transactions but not move money.
- Banks are warning customers that sharing login details can make them responsible for any activity those agents perform and advising use of bank‑approved connectors instead of pasting passwords into general AI tools.
- Vendors and payments firms are prototyping scoped permissions, agent identities, and continuous monitoring while U.S. regulators and security teams investigate technical causes and potential policy responses.
- The changes could force consumers to use bank‑approved integrations for automated help, reduce the risk of unauthorized payments, and potentially reshape how banks, AI vendors, and regulators negotiate access and liability.