- Customers are increasingly enlisting AI agents to handle banking jobs for them
- Banks are struggling to distinguish between human, legitimate AI and rogue activity
- Many are now preparing for worst-case scenarios when AI does go rogue
Several major US banks have detected third-party AI agents accessing their customers' bank accounts, sometimes even attempting to carry out actions beyond what users actually wanted them to do.
New Axios reporting has claimed banks are now said to be struggling to even distinguish between legitimate human activity and agentic activity – but especially between authorized and rogue AI agents.
Importantly, the concern isn't so much disconnected, rogue AI going after system vulnerabilities to obtain customer information – banks are currently worrying about AI agents that human users themselves are setting off on their behalves.
Banks are struggling to deal with an influx of customer-authorized AI activity
In many cases, customers are voluntarily providing their banking usernames and passwords to AI assistants to hand over some workflows and processes to them, however while customers may be prepared to share these sensitive details, it can often violate banks' policies – which require the customers themselves to log into the accounts.
Morgan Stanley, JPMorgan Chase, Bank of America and Citigroup have all started to restricted third-party agent access. Well Fargo is also said to be responding to potential threats.
Besides a lack of visibility and account security, banks are also worried about financial liability, because it's still unclear who's responsible for AI agents' activity if things go wrong.
Charles Schwab CEO Richard Wurster explained that he now expects a daily report about "how many times we've had to block one of the different agents" so that the bank has "control over authentication and the experience."
Looking ahead, banks are now likely scrambling to prepare for worst-case scenario events. With huge parts of the internet recently shut down due to outages and vulnerabilities, banks are now preparing to quickly shut down customer accounts in the event of unwarranted access – and restore them post-incident.
