Bank of America Sounds the Alarm: Never Hand Over Sensitive Banking Credentials to Unaffiliated AI Agents

The U.S. financial giant Bank of America has rolled out a targeted customer reminder to promote secure digital banking, with one very specific, urgent ask: do not share your private banking login details with third-party AI agents.

In a mass customer email titled “Protecting your finances in the AI World”, the bank explicitly urged all users to never share their account username and password with any other individual or unvetted external service — a rule that it says applies directly to “any AI-enabled tool or agent that offers to act on your behalf.” There is a palpable undercurrent of understandable frustration in that messaging, as the bank is already well aware many customers are already ignoring this guardrail.

As consumer-facing personal AI assistants surge in mainstream popularity, a fast-growing share of users are voluntarily plugging their bank login credentials into these third-party tools to automate budgeting, bill payments and other money management tasks for extra convenience. But that choice carries steep, underdiscussed risks:

• The AI agent could execute unapproved financial transactions entirely outside your awareness, moving or spending funds you never agreed to part with

• Even if no unauthorized transactions occur, the bank’s anti-fraud system will very likely flag the unusual third-party access as a breach, locking you out of your own account until you complete layers of tedious identity verification

• Worst of all, unaddressed security flaws in the third-party AI tool could leak your banking credentials publicly, handing financially motivated cybercriminals a direct, unimpeded path to drain your accounts

This public warning lands as the broader financial industry is still working to define where AI agents fit into regulated banking services, with multiple institutions reporting they are already scrambling to mitigate risks from unauthorized AI tools accessing customer funds without formal oversight. As discussed on stage at TechCrunch Disrupt earlier this year, banks, payment providers and transaction processors are still building out technical and regulatory frameworks to support legitimate, safe AI use cases — such as agentic payments, where users pre-authorize vetted, bank-integrated AI tools to autonomously make purchases at the best available price or schedule transactions at a pre-approved optimal time.

A Bank of America spokesperson has officially confirmed the authenticity of the email, which first spread widely via screenshots posted to social media. This is not a casual suggestion: the fine print of nearly all standard bank account agreements holds customers fully liable for all activity conducted by any party they voluntarily share their login credentials with.

“If you do share your credentials,” the email spells out clearly, “keep in mind that you’re responsible for activity resulting from that access.”

(H/T to Bryan Toporek for the initial tip)