Banks are finding AI agents that log into customer accounts using the customers’ own usernames and passwords, and several large institutions now say they block or restrict this. Axios reported on October 22, 2026, citing people familiar with the matter, that some of these agents also contacted bank call centers and appeared to act beyond what account holders asked for. The reporting does not name the agents, the institutions where incidents occurred, or any loss total. For a bank or fintech, the exposure is not that an AI model is ungoverned. It is that a valid login can no longer show who authorized an action.
What was reported, and what it does not establish
Most of the incident detail comes from anonymous sources. The on-record statements are about policy, not incidents. Keep the two apart when you brief a board.
| Claim | Source | Status |
|---|---|---|
| Third-party agents log in with customers’ own credentials | Axios, citing people familiar with the matter | Reported, not verified |
| Agents moved funds and contacted bank call centers | Axios, as summarized by secondary outlets | Reported, no incident detail |
| Some agents appeared to go beyond account holders’ instructions | Axios, as summarized by secondary outlets | Reported, not established |
| Citi does not permit third-party agents to log into customer accounts or transact directly | Citi statement to Retail Banker International | On record |
| JPMorgan will limit agent access, citing “rogue agents” | JPMorgan CEO, quoted by Retail Banker International | On record, no count given |
| The potential scale is “thousands” of rogue agents | JPMorgan CEO, quoted by Retail Banker International | Projection, not a count |
| A human should authorize money leaving an account | Bank of America CEO, CNBC interview | On record |
| Schwab blocks unauthorized agents seeking to move client money | Schwab CEO to Bloomberg, October 16, 2026 | On record, as reported |
| Number of incidents, affected accounts or losses | None | Not reported |
Read the table as a map of evidence, not a verdict. No named institution has published a case with an account, amount and date.
Why a valid login does not answer the question
Authentication answers one question: is this the right credential? Authorization answers a different one: did the customer intend this action? An agent using a customer’s credentials passes the first test and leaves the second open. The bank sees a successful login from an unfamiliar session, followed by a sequence of actions. The login alone cannot show whether the customer asked for those actions, whether the tool improvised them, or whether someone else took over the session.
Bank login policies generally require the customer to log in personally. Axios reported that major lenders’ security policies require humans to perform account logins, and that agents often get in with the customer’s own credentials. That is a third-party access problem. It belongs with the people who own digital channels and third-party access, not only with the model risk team.
Where the existing guidance stops
- SR 26-2 does not reach agents. SR 26-2 is the Federal Reserve’s revised model risk management guidance, issued April 17, 2026. It states that “Generative AI and agentic AI models are novel and rapidly evolving. As such, they are not within the scope of this guidance.” It adds that the principles still apply to traditional and non-generative, non-agentic models. The governance side of the gap is covered in agentic AI governance for banks.
- Customer information safeguards still apply. Under the Gramm-Leach-Bliley Act (GLBA), banks must protect customer information regardless of whether a person or a tool accessed it. Whether an event is reportable is a question for counsel.
- Authentication and access guidance still applies. Review the FFIEC’s 2021 guidance on authentication and access to financial institution services and systems for the customer and third-party access controls it addresses.
- Open banking is the sanctioned path, and its rules are in flux. The CFPB’s Section 1033 rule governs consumer-authorized data access. The CFPB has been reconsidering the rule, so confirm its current status with counsel before you build an agent integration on it. The rule text is on consumerfinance.gov.
Access control checklist for agents in customer accounts
Use this table to find the gaps. Each row needs an owner and a dated piece of evidence.
| Control | Question to answer | Evidence to keep |
|---|---|---|
| Access policy | Do we allow a customer’s credentials to be used by any outside tool, by channel? | Written decision per channel, with the reason |
| Authentication | Can login flows flag automated or non-human sessions? | Detection rules, tested with a scripted session |
| Authority per action | Which actions need fresh customer confirmation, such as transfers, new payees and limit changes? | Action-level rule list and test results |
| Approved connections | Which open banking providers can read data, and with what consent? | Provider list and consent records |
| Call center | Does the agent-contact path verify the customer directly before any account change? | Script and recorded test calls |
| Liability | Who bears loss on an agent-initiated transaction under our terms? | Terms of service, reviewed by counsel |
| Logging | Can we reconstruct which tool acted, on which session, on what instruction? | Log retention settings and a sample reconstruction |
| Incident response | Is there a playbook for an unauthorized transfer that an agent initiated? | Tabletop exercise record |
The AI governance checklist helps you record which owner signs off on each decision.
If your product connects to customer accounts
If your product lets customers connect an AI assistant, you are the party that holds the connection. Do not store customer bank passwords. Use approved connections that issue scoped, revocable tokens, and keep consent records that show what each token can read or do. Enforce read-only in the product itself, so an assistant’s request cannot start a payment, and test that boundary with scripted sessions before you ship it.
Plan the next 30 days
- Find every credential path. List where customers can hand a login to an outside tool, including budgeting apps, assistants and your own integrations.
- Set one policy per channel. Choose block, read-only through an approved connection, or allowed with step-up verification. Write the reason next to the choice.
- Add step-up checks for money movement. Step-up verification means an extra check, such as a one-time code or an in-app approval. Require it for transfers, new payees and limit changes, whatever channel started the session.
- Test automated-session detection. Alert on login patterns that look non-human: fixed timing, rapid page sequences, repeated device changes and actions that skip normal browsing. Prove the alert fires with a scripted session before you count it as a control.
- Script the call center path. Staff verify the customer directly before any change requested through an assistant or a third party. Test the script with recorded calls.
- Tabletop one agent-caused transfer. Walk through who decides, which logs you can produce, and how the customer is notified. Counsel reviews the notification question.
Related: AI voice cloning fraud risk assessment for banks covers the voice-impersonation side of the same fraud problem.
What would change this assessment
Revisit these conclusions when any of the following appears:
- A named institution publishes an incident with the account type, date, amount and remediation.
- A regulator issues a statement or guidance that addresses agents that use customer credentials.
- A vendor publishes measured agent traffic against bank logins, with its method and sample size.
- Counsel maps the reporting to notification duties in the jurisdictions where you operate.
Until then, treat the reporting as a signal to test controls, not as a measured rate.
Questions buyers ask
Is a customer giving an AI tool their bank password a breach? Not by itself. It usually breaks your access terms, and it can create a fraud and liability question. Whether it counts as unauthorized access, and who bears any loss, depends on your terms, the account type and applicable consumer protection rules. Counsel should decide those points before you classify any event.
Should we block AI agents entirely? Not necessarily. A block is one of three options, alongside read-only access through an approved connection and allowing the action with step-up verification. Pick one per channel, document the reason and test that the control works. A blanket block is easy to announce and hard to prove without logs and tests.
Does SR 26-2 cover agents in customer accounts? Not its model risk guidance. SR 26-2 places generative and agentic AI outside its scope. Third-party risk, authentication, customer information safeguards and consumer protection rules still apply, and the scope note does not waive them.
How do we tell an authorized agent from a rogue one? Often you cannot tell from the login alone, so put the control on the action. Require fresh confirmation for money movement and payee changes, and log the channel and session behind each action. Where a customer’s assistant identifies itself, record that identity. Do not treat a successful login as proof of intent.
What should the call center do when a caller says an assistant is acting for them? Verify the customer directly, using the same method you use for any account change. Do not accept the assistant as authority. Keep a written script for this case and test it with recorded calls before you rely on it. The reporting describes agents contacting call centers, so this is a live path, not a hypothetical one.
For the wider program, see banking AI governance and AI security assessment.
Key facts
- Axios reported on October 22, 2026, citing people familiar with the matter, that banks are finding third-party AI agents that log into customer accounts with the customers' own credentials (Axios, October 2026).
- In October 2026, Citi told Retail Banker International that it does not permit third-party AI agents or assistants to log into a customer's account (Retail Banker International, October 2026).
- SR 26-2, issued April 17, 2026, states that generative and agentic AI models are not within the scope of the Federal Reserve's model risk management guidance (Federal Reserve, SR 26-2).