Bank of America tells customers not to share banking logins with AI assistants

In an email titled "Protecting your finances in the AI World," Bank of America told customers not to give their username and password to another person or an outside service, including an AI tool or agent that offers to act on their behalf. The message comes as customers increasingly hand log-in details to personal AI assistants.

The article notes several risks. An assistant could move money without the customer knowing, the bank could lock the account after mistaking the activity for an intrusion, and a security flaw in an assistant could leak credentials to attackers. Banks are still working out how agentic payments, where agents buy things autonomously, should connect to customer accounts.

Bank of America did not respond to a request for comment. The email says that if customers do share credentials, they are responsible for activity resulting from that access, and the article adds that most account agreements hold customers liable in the same way.

Agents that need banking access should not be built around collecting customer usernames and passwords, since the bank treats that sharing as the customer's liability. Developers should look for bank-sanctioned connection methods instead.

Agent builders should expect banks to flag or lock accounts that show automated log-in activity. Handling credential storage and access scope carefully matters more as a result.