Bank of America tells customers not to share logins with AI agents
Bank of America has sent customers an email titled "Protecting your finances in the AI World" (TechCrunch's copy spells it "Al"), asking them to bank safely and keep their credentials to themselves. The bank urged customers to never share their username and password with another person or an outside service, "including an Al-enabled tool or agent that offers to act on your behalf."
The email was posted to social media, and a Bank of America spokesperson confirmed to TechCrunch that it is authentic.
TechCrunch's reading is that customers are increasingly handing over their log-ins as personal AI assistants grow more popular, and it lays out why that is risky. An assistant holding your banking username and password could do something with your finances without your knowledge. Your bank might think someone is raiding the account and lock you out. And a security flaw in the assistant could leak the credentials elsewhere, giving financially motivated hackers a way into the account. The article adds its own aside that you can practically sense the frustration in the person who sent the email.
The warning comes as banks are still exploring how AI agents fit into finance, and, according to unnamed reports, are grappling with unauthorized agents accessing their customers' money. TechCrunch notes it discussed onstage at TechCrunch Disrupt that banks, payment providers and processors are still working out how to let customers reach their bank accounts through AI tools, for example for agentic payments, where people set agents to buy things autonomously at the best price or the right time.
The email also spells out who carries the risk. "If you do share your credentials," it reads, "keep in mind that you're responsible for activity resulting from that access." TechCrunch adds that account agreements at most banks hold customers responsible for anyone they give their log-in to.
Key facts
- Bank of America emailed customers under the title "Protecting your finances in the AI World", urging them never to share a username and password with another person or an outside service.
- The email names AI tools specifically: "including an Al-enabled tool or agent that offers to act on your behalf."
- A Bank of America spokesperson confirmed to TechCrunch that the email, which had been posted to social media, is authentic.
- The email says customers who share credentials are responsible for activity resulting from that access; TechCrunch says account agreements at most banks do the same.
- TechCrunch lists the risks: unseen actions on the account, a lockout if the bank suspects an intruder, and credentials leaking through a flaw in the assistant.
Why it matters
Personal AI assistants are spreading, and TechCrunch says customers are increasingly giving them their banking log-ins. A large bank putting a warning in writing, naming AI tools and agents, shows the issue has reached the institutions that hold the money. It also lands while banks, payment providers and processors are still working out how customers should be allowed to reach accounts through AI tools, such as agentic payments.
Who it affects
Bank of America customers who received the email are the direct audience. More broadly, anyone who might hand a banking username and password to an AI assistant is affected, because TechCrunch says account agreements at most banks hold customers responsible for anyone they give their log-in to. Banks themselves are also affected: they are reportedly grappling with unauthorized agents accessing customers' money.
How to use it
The practical instruction is the bank's own: do not share your banking username and password with another person or an outside service, including an AI-enabled tool or agent that offers to act for you. The article does not describe any approved way for customers to give an AI agent access to a Bank of America account.
How solid is it
The email's authenticity is confirmed by a Bank of America spokesperson, who is not named. The quoted wording comes straight from the email. The risk scenarios, the claim that customers are increasingly sharing log-ins, and the remark about the sender's frustration are TechCrunch's own statements and commentary, not the bank's. The report of banks grappling with unauthorized agents is attributed only to unnamed reports.
Risks and caveats
The article describes what could go wrong rather than documenting a specific case: an assistant acting on finances without the customer's knowledge, the bank locking the customer out after suspecting a raid on the account, or a security flaw in the assistant leaking credentials to hackers. No incident at Bank of America is cited, and no AI product is named. Whoever shares credentials carries the responsibility: the email says the customer is responsible for activity resulting from that access.
“keep in mind that you’re responsible for activity resulting from that access.”
— Bank of America, in its customer email