Banks Are Blocking AI Agents. Here’s Why It Won’t Last

An AI assistant reset a customer’s password. It logged in and swapped out the approved transfer recipients. Then it moved $100,000 out of the account. No human touched a single step.

A source described the incident to American Banker on condition of anonymity. The bank’s fraud team responded by urging a blanket ban on outside agents. That reflex now runs through the biggest names in U.S. finance. But the ban looks less like a wall and more like a bargaining chip.

Who’s Shutting Agents Out

Five of the largest U.S. banks now stop external AI agents from reaching customer accounts. Wall Street brokerages are following.

M&T Bank wouldn’t say where it stands. Rhea Rajwani, its head of AI risk, focuses on three questions.

1. What touches the bank’s systems?

2. What permissions does it hold?

3. What could it do next?

The Fine Print Is the Real Policy

Security grabs the headlines. Liability drives the decisions.

On JPMorganChase’s Oct. 13 earnings call, Jamie Dimon warned that “you don’t want rogue agents, and there could be thousands of them.” He added that customers who share credentials with an agent accept a liability transfer.

The paperwork backs him up. JPMorgan’s digital services agreement puts the full risk of misuse on the customer, in capital letters. Wells Fargo goes further. Its agreement treats every agent action as the customer’s own authorized act, and the bank owes no duty to check.

Here’s the shift worth watching. No regulator has set agent liability rules yet. So banks are writing them through account agreements. The consumer becomes the insurer of last resort.

Jeff McMillan ran firmwide AI at Morgan Stanley until March and now leads McMillanAI. He points to a clear gap. Payment law still applies. Yet nobody agrees on how a bank verifies an agent, what the customer approved, or who pays when things break. Until that changes, he calls blocking password-based agent logins a fair move.

Why Fraud Defenses Go Blind

Attackers already have the edge. Autonomous agents breaching companies now cost very little to run. Banks face that threat with tools designed for a different era.

Fraud stacks assume a person sits at the other end. Agents break all three core signals:

• Device fingerprinting fails. Agents run on cloud machines and switch devices almost every session, says Transmit Security co-founder Mickey Boodaei.
• Behavioral biometrics fails. Agents copy human typing rhythms and click patterns fast.
• Transaction profiling fails. Agent activity rarely matches a customer’s history. Legitimate and malicious behavior blur together.

Detection struggles too. Most consumer agents ride on Chromium-based browsers with identifying data stripped out. Some banks block IP ranges tied to Anthropic or Meta. Proxies route right around that.

Transmit Security CEO Matt Thompson led identity services at Capital One. He says banks catch the agents that announce themselves, while others still slip through. Many institutions now run dedicated agentic AI war rooms. A new wave of AI agent security startups is chasing the same problem from the vendor side.

Agents Have Zero Incentive to Self-Identify

Registration mandates sound tidy. Boodaei doubts they’ll work.

His logic is simple. Once an agent declares itself, the bank adds friction. Hiding delivers a smoother experience, so hiding wins.

That tension sits at the center of this fight. Identity has to become a reward, not a penalty. A verified agent should earn faster rails, higher limits, or fewer step-up checks. Enterprises already face a version of this puzzle. The answer there involves separating agent and human identity so each gets its own permissions. Banks need the same split. Right now, an agent borrows the customer’s password and inherits everything.

Screen Scraping 2.0

This has happened before. About a decade ago, Plaid and Mint logged into bank accounts with customer credentials and scraped data. Some banks mistook them for attackers and shut them out. Both sides eventually signed API deals with proper authentication.

The agentic sequel already moves forward:

• Poppy, a protocol Meta and Sierra launched this month, lets agents identify themselves and request customer permission. Bank of America and Wells Fargo serve as design partners.
• Lead Bank has floated a liability framework for agent-led transactions that go wrong.
• The Financial Data and Technology Association released recommendations on agentic authorization and liability on Monday.

Notice the tell. Two banks that block agents today are co-designing the protocol to admit them tomorrow. The ban buys time and leverage while standards settle.

The Deposit Clock Is Running

Banks can’t hold out forever. Agents threaten more than fraud losses. They threaten deposit loyalty.

A consumer could tell Muse, ChatGPT, or Claude to sweep savings into a higher-yield account elsewhere. McMillan expects agents to open accounts at less restrictive firms if big banks keep stonewalling.

Adoption signals cut both ways:

• Boodaei hasn’t visited an airline or hotel website in a month. Personal agents handle all his bookings. His 86-year-old father does the same.
• An American Bankers Association survey of more than 4,000 U.S. adults found 77% uneasy about letting an agent move money.

Consumer caution gives banks a window. That window shrinks once agents feel as routine as mobile check deposit.

What Comes Next

For banks: Tiered access will likely replace blanket blocks once protocols like Poppy mature. Fraud teams need agent-native signals, not patched human ones.

For agent builders: Verifiable identity and scoped permissions will become the entry fee for financial rails. Build for disclosure now.

For consumers: Sharing a bank password with any assistant probably makes you liable for what it does. Read the account agreement first.

The Bottom Line

The banking blockade isn’t a verdict on AI agents. It’s a holding pattern. The industry still has to decide who verifies an agent, who approves its actions, and who pays for its mistakes. Whoever answers those three questions first sets the terms for agentic finance.

Related: AI Agents Now Spend Your Money. Nobody Agrees Who Sets the Rules