The AI Was Invited. So Why Did the Bank Call It Unauthorized?

On October 22, 2026, Axios reported a peculiar problem facing some of America’s largest banks: third-party AI agents were accessing customer accounts without the banks’ authorization.

An AI agent is more than a chatbot. It can work through a task, gather information and interact with websites or software on a user’s behalf.

In one reported case, an agent even contacted a bank to complain without consulting the account holder first.

But here’s the twist. These weren’t necessarily AI systems breaking into accounts. In some cases, the customers themselves had handed over their login credentials and invited the agents in.

The Uninvited Guests That Customers Had Invited

According to Axios, some customers gave AI agents their usernames and passwords so the software could access their bank accounts. The customers may have agreed to the arrangement, but their banks had not necessarily approved the agents themselves.

Institutions including JPMorgan Chase and Morgan Stanley have been restricting third-party agent access. In separate reporting on October 22, Reuters confirmed through banking industry sources that financial institutions were blocking agents from operating in customer accounts and initiating transactions.

The reported behavior raised another question: were the agents always doing what their users had asked?

On October 23, Axios reporter Madison Mills told CBS News about an agent that had called a bank with a complaint without first consulting the account holder. That was an example of activity appearing to go beyond a user’s instructions—not evidence that an AI had hacked into a bank and stolen deposits.

The distinction matters. Reuters reported that Morgan Stanley was blocking third-party agents but had not observed unauthorized or rogue agent activity on its own platforms. Not every bank named in the coverage had experienced the same behavior.

In a separate October 23 report, Axios described banks preparing for worst-case AI scenarios. The institutions said they had not seen evidence of rogue agents hacking customer accounts or funds.

As of October 27, publicly available reporting had not identified the specific AI products behind the unusual actions, released detailed activity logs or established a confirmed amount of financial loss.

One Bank Account, Three Different Kinds of Permission

The reporting points to a distinction that is easy to miss. When an AI agent accesses a bank account, at least three separate questions need answers.

Conceptual illustration of three separate forms of authorization. It does not reproduce an actual bank’s authentication system or procedures.

Sharing a password with an AI agent does not mean the bank has approved that agent. Nor does asking an agent to check an account balance automatically authorize it to transfer money.

Successfully logging in is not the same as proving that every subsequent action reflects the account holder’s wishes.

That is a fundamental problem for banks. An authenticated session may tell the bank which customer’s credentials were used. It does not necessarily reveal whether a human or an AI performed an action, or whether the AI stayed within the user’s intended instructions.

Wells Fargo’s Upcoming Terms Add an Awkward Twist

There is a particularly revealing detail in Wells Fargo’s official Online Access Agreement. A version scheduled to take effect on November 24, 2026, contains an entire Section 15 devoted to third-party artificial intelligence agents.

Sections 15(d) and 15(e) are especially striking.

Subject to applicable law, the agreement says that when a customer provides an AI agent with login access or otherwise authorizes it to act, the bank may treat instructions and transactions initiated by that agent as authorized by the customer. It also places responsibility on customers for monitoring their agents and for certain unintended actions or actions exceeding the authority they granted.

In effect, the bank’s contractual position can become: you chose to use the agent, so you may also be responsible when it does something you never intended.

There are important limits to that interpretation. As of October 27, the new agreement had not yet taken effect. There is also no established evidence that Section 15 was drafted specifically in response to the October 22 Axios report.

And the agreement does not mean Wells Fargo has given every outside AI agent permission to enter. Section 15(g) explicitly reserves the bank’s ability to restrict, suspend or prohibit agent access.

That produces an unusual combination: the bank reserves the right to block an AI agent while also setting out the customer’s potential responsibilities if the agent is used.

Why the Contract Doesn’t Automatically Override Consumer Protection

Does that mean an American customer must bear every loss caused by an AI agent? Not necessarily.

Under the Electronic Fund Transfer Act and its implementing Regulation E, the Consumer Financial Protection Bureau (CFPB) distinguishes between different types of transactions.

The official interpretation of 12 CFR §1005.2(m) explains that when a consumer voluntarily gives another person an access device and authority to make transfers, that person’s later actions may fall outside the regulatory definition of an unauthorized electronic fund transfer—even if the person exceeds the authority originally granted.

But fraud is treated differently. If someone obtains account credentials through deception or theft and uses them to make an electronic transfer, Regulation E may classify the transaction as unauthorized.

The CFPB also makes clear that private agreements cannot waive consumer rights provided by the Electronic Fund Transfer Act. A bank cannot simply write away statutory protections in its terms of service.

Regulation E primarily concerns electronic fund transfers involving consumer accounts used for personal, family or household purposes. Its existing provisions were not drafted specifically for autonomous AI agents, and they do not settle every possible dispute involving an AI system.

An AI agent that has not been approved by a bank is not automatically the same thing as an unauthorized electronic fund transfer under federal law.

The same word—”unauthorized”—can describe very different problems. Whether an agent violated bank rules, exceeded the customer’s instructions or triggered statutory liability protections requires a more precise examination of the facts.

Banks Were Blocking AI Agents. Visa Was Testing AI Payments.

Here is where the story takes another turn.

On October 20, just two days before the Axios report, Visa announced a live pilot with BILL and Billtrust allowing trusted AI agents to complete approved business-to-business invoice payments through supplier portals.

This was not a scheme in which an AI could freely decide who should be paid or how much money to send.

Instead, the buyer had already approved the payment instructions. An authorized AI agent, registered through Visa’s Trusted Agent Protocol and Agentic Directory, could use tokenized payment credentials to complete the transaction. The supplier platform could recognize and authenticate that agent without requiring shared supplier-portal login credentials.

These are different settings: consumer bank accounts on one side, a controlled business-payment pilot on the other. They should not be treated as identical systems.

Nevertheless, the comparison reveals a useful distinction.

The problem is not simply whether an AI is allowed to perform a task. It is whether the system can identify the agent, define its authority and limit what it is permitted to do.

Illustration of a controlled, pre-approved AI payment process. It does not depict Visa’s actual payment infrastructure or interface.

Even an AI That Follows Orders Could Give Banks a Headache

There is another reason financial institutions are watching AI agents closely, and it has nothing to do with theft.

On September 27, 2026, Apollo chief economist Torsten Slok raised the possibility of AI agents automatically moving household cash into higher-yield accounts, potentially putting pressure on banks that depend on low-cost deposits.

His published comparison used a national average checking-account rate of 0.1% against higher-yield alternatives offering approximately 3.3% to 5.0%.

Consider a simple example using $10,000 for one year:

The difference is $320 per year, before taxes, fees, rate changes or account restrictions. This is a simple calculation based on the published rates, not a forecast of guaranteed earnings.

That amount might give an individual customer a reason to switch accounts. But changing banks takes time and effort, so many people leave their money where it is.

If AI agents eventually become able to compare eligible accounts and execute authorized transfers securely, that inconvenience could shrink dramatically.

No such mass movement of deposits has been established by the October banking reports. Apollo was discussing a possible future scenario, not documenting losses caused by the agents in the Axios story.

Still, the economic incentive is real enough to examine. An agent that efficiently follows a customer’s instructions could make deposits more mobile—and potentially challenge banks that rely on customers leaving money in low-interest accounts.

Banks, in other words, may have reasons to worry about agents that malfunction. They may also have reasons to worry about agents that work exactly as intended.

Editor’s Note

What gets me about this story is the strange division of responsibility. A customer invites an AI into a bank account. The bank says the visitor was never approved. Then a bank’s own terms suggest that if the visitor makes a mess, the customer may still have to answer for it.

I can understand why banks want strict security controls. These are people’s savings, after all. But if AI agents are going to become ordinary digital assistants, shouldn’t there be a clearer way to specify exactly what they may and may not do?

We keep hearing that AI will save us time by handling tedious jobs. Perhaps it will. Yet the more work we delegate to machines, the more carefully we may have to read the agreements governing them.

There is something wonderfully backward about that. Your digital assistant can do the banking, but apparently you still have to do the paperwork.

References