Bank of America has a message for the age of the AI assistant: your password is yours, and your agent is not your bank.
The bank emailed customers this week with a warning titled "Protecting your finances in the AI World," urging them never to share their username and password with another person or an outside service — "including an AI-enabled tool or agent that offers to act on your behalf," according to TechCrunch. A Bank of America spokesperson confirmed the email is authentic.
The warning lands at an awkward moment. Personal AI assistants are getting more capable by the month, and more people are handing them their logins so the assistant can check a balance, pay a bill, or hunt for a better price. The risks, as TechCrunch lays them out, are straightforward: an agent could move money without your knowledge, the bank could read the activity as a raid and lock the account, or a security flaw in the assistant could leak your credentials to someone else entirely.
But the fine print is the real story. Account agreements at most banks hold customers responsible for anyone they give their login to, and Bank of America's email says it plainly: "If you do share your credentials, keep in mind that you're responsible for activity resulting from that access." In other words, if your agent empties your checking account, the bank's answer is that you gave it the keys.
That puts the country's biggest retail bank on the other side of a split opening up across finance. Amex has published a framework to let agents buy things safely. Walmart just opened its storefront to shopping agents. Meanwhile Bank of America is telling customers the agent era stops at the login screen — and banks are still, by TechCrunch's account, grappling with unauthorized agents reaching into customer accounts at all.
The industry wants agents that can spend. It just hasn't agreed on who pays when they spend wrong.
What to watch is whether banks build a sanctioned lane — scoped, revocable agent access that doesn't require handing over a password — or keep treating every agent login as a credential breach. Until they do, Bank of America's position is the default: the convenience is yours, and so is the liability.
— via TechCrunch