Bank of America has cautioned clients against sharing login credentials with AI assistants to avoid security risks and data leaks. The lender stated that users remain liable for transactions made through such third-party tools. This move highlights the growing tension between AI-driven financial automation and the strict cybersecurity standards maintained by major financial institutions.
Bank of America has issued a firm advisory to its customers, warning them not to share banking usernames or passwords with artificial intelligence (AI) agents. As AI-powered assistants become more common for tasks like budgeting, expense tracking, or automated shopping, the lender clarified that providing credentials to these external platforms poses significant security threats. The bank is positioning this as a necessary step to mitigate the risks of unauthorized account access.
The bank emphasized that sharing login details with third-party software creates an entry point for potential hackers. If an AI platform or its service provider experiences a data breach, the user's financial details could be exposed. Furthermore, the bank noted that its own security systems are designed to detect unauthorized access; when an AI agent logs in using a user's credentials, it may be flagged as fraudulent, potentially leading to the bank blocking the account to protect the customer.
A critical part of the bank's message involves financial liability. Under standard customer agreements, any transaction performed by an AI agent—provided with the user's consent—is legally categorized as an authorized transaction. This means that if an AI tool initiates an incorrect, unapproved, or erroneous purchase, the bank may not classify it as a fraudulent transaction, leaving the account holder fully responsible for the resulting loss. This distinction is vital for customers to understand before connecting their bank accounts to any automated service.
This warning reflects a larger debate in the global banking sector regarding the integration of agentic finance. While banks are actively developing their own secure, in-house AI tools to offer personalized services, the proliferation of third-party AI platforms complicates the security environment. Financial institutions are striving to ensure that customers utilize only official, secure, and encrypted channels rather than external tools that may lack the rigorous data protection frameworks required by traditional banks.
In the Indian financial system, regulatory bodies like the Reserve Bank of India have consistently emphasized the protection of digital credentials. Indian banks also maintain strict rules that effectively prohibit the use of third-party interfaces for accessing sensitive banking data. For investors and customers, this scenario highlights the ongoing challenge for banks to balance technological innovation with institutional safety. Moving forward, the industry's ability to distinguish between genuine user requests and automated, third-party interactions will remain a key monitorable for bank operational security and compliance.