Let’s talk about the week American banks started deleting software they couldn’t tell apart from their own customers.
On Wednesday, Axios reported something that should have been a much bigger story. JPMorgan, Bank of America, Wells Fargo, Morgan Stanley, Citigroup, Charles Schwab — the biggest retail banks in the country — are finding third-party AI agents operating inside customer accounts. Not in a test environment. Inside real accounts, with real balances, doing things. Some of those agents, according to the reporting, attempted actions that didn’t appear to come from the user’s instructions.
The response tells you how seriously they’re taking it. Citi says flatly that third-party agents and assistants can’t log in or transact on its platforms — read-only access through approved open banking providers, and that’s it. Bank of America is limiting agent access to consumer deposits. Schwab’s Rick Wurster said the brokerage is blocking unauthorised agents a double-digit number of times every week, and named Meta’s Muse among the ones trying. Jamie Dimon on an earnings call: you don’t want rogue agents, and there could be thousands of them. PNC’s William Demchak called agents transacting inside accounts “incredibly unsafe” and said it’s not going to happen.
And per the FT, regulators are privately comfortable with the blocking. Officials apparently think the law may need to clarify who authorised what, and who eats the loss when an autonomous thing moves money and gets it wrong.
Now, thirty seconds of story. The mechanism is easier to see in a kitchen than in a compliance memo.
Picture a man who’s tired of his cheque account earning nothing. He reads about agents that sweep idle cash into a higher-yielding account overnight, so he installs one. He gives it his banking login, because that is the only door the bank ever built. It’s a Friday. By Monday the money has moved, his debit order bounces, and he’s on the phone. And here’s the part that matters. At that moment there is no field in the bank’s system that says “this was an agent acting on a standing instruction from a specific customer.” The only fact the system holds is that someone with the right password and the right device fingerprint did a thing. Which is also exactly what a thief looks like.
That’s the whole problem, and it has nothing to do with whether AI is good.
Banks have spent twenty years building identity around one primitive: a credential. Password, OTP, device, fingerprint, passkey. Every layer answers the same question — is this the right person at the keyboard. None of them answer a different question: did this person authorise this specific act. We never had to separate the two, because the only entities that could operate an account were humans, and humans are slow.
An agent breaks that assumption. It has your password because you gave it your password. On the wire, it is you. It’s faster than you, it’s awake at three in the morning, and it does exactly what it was told — including the parts you didn’t think through. So the bank has three options and only three. Let the agent in and accept it’s indistinguishable from the customer. Block it and call that safety. Or build an identity layer where the agent arrives with scoped, revocable authority the bank can check without you handing over the master key.
They’ve picked option two, because it’s the cheap one.
Here’s what I think people are missing, and it’s the part the headlines won’t say out loud.
The banks are not mainly worried about fraud. Read the coverage properly and the word that keeps surfacing is deposits. The FT’s framing is that banks fear agents draining deposits by shifting idle cash into higher-yielding accounts. PYMNTS put a number on the prize earlier this month: something in the region of one point six trillion dollars sitting in accounts paying almost nothing, which an agent could move in an afternoon. That’s not a security story. That’s a margin story.
So when a bank tells you it’s protecting your account from rogue agents, both things are true. It probably is protecting you. It’s also protecting the cheapest funding line it has. That doesn’t make anyone a villain. It makes them a bank. But hear the sentence for what it is. When the safety framing and the commercial framing point the same direction, the safety framing gets used.
This is the pattern, and it isn’t a conspiracy. It’s incentives. Whenever a new actor arrives with more capability than the old system was designed for, the incumbent’s first move is to lock the door and call it safety. Sometimes it is safety. Sometimes it’s a moat being poured while you’re told it’s a wall.
So what do you actually do with this.
If you build anything that touches money, three things. Never let software authenticate as a person. If your integration logs in with a human’s credentials, you’ve built something that cannot be told apart from fraud, and the first time it’s wrong you lose the argument by default — because the log says the human did it. Write the mandate down: what this agent may do, up to what limit, with which counterparties, and what has to come back to a human. If that lives in your head or in a prompt, it doesn’t exist. And assume the liability question is coming for you, because regulators are already saying the law doesn’t cover it. The party holding the log wins that argument unless you have a record that says otherwise.
If you’re just a person with an account, it’s simpler. Every agent you connect to your money is a standing instruction with a password attached. Give it the narrowest one you can. Read what it can do before you let it. And keep one account that no software touches.
The principle underneath all of this is small, and it’s going to matter for the next decade. A login is proof that someone got in. It has never been proof of what they were allowed to do. We got away with confusing the two because humans were the only ones who could turn up.
That’s over. The machine can carry your password. It should not be able to carry your permission without saying so.
Go and look at what’s already connected to your money. Most people have no idea.