Bank of America tells customers not to give AI agents their banking password

Bank of America sent customers an email titled "Protecting your finances in the AI World" urging them never to share their username and password with "another person or an outside service," including "an AI-enabled tool or agent that offers to act on your behalf," TechCrunch reported on October 27. The email adds that customers who do share credentials should keep in mind that "you're responsible for activity resulting from that access." A Bank of America spokesperson confirmed the email is authentic. TechCrunch listed the risks: an assistant moving money without the customer knowing, the bank locking the account as a suspected takeover, or a flaw in the assistant leaking the credentials. It also said banks, payment providers and processors are still working out how to let customers use AI tools for account access, and that most bank account agreements already hold customers responsible for anyone they give their login to.

Why it matters

Handing an agent a password is the oldest anti-pattern in delegation. The agent becomes indistinguishable from the customer, holds every permission the customer has, and cannot be revoked without changing the password. It is the problem OAuth was created to solve: letting an app act for a user without ever seeing the user's password.

The answer for banks is to give agents a sanctioned path: scoped, revocable, short-lived tokens issued through OAuth with the customer's consent, so the agent acts on the customer's behalf rather than as them, and activity can be told apart. Rich authorization requests let that grant name a specific payee or amount, and token exchange lets an agent trade it for narrower tokens downstream. The Agent Identity Standards Map 2026 tracks where those standards stand, and our guide to securing AI agent identities covers the controls.

Source: TechCrunch