U.S. Banks Curb Third-Party AI Account Tools Amid Security Worries
Morgan Stanley, JPMorgan, Bank of America and Citi are limiting third-party AI agents after unauthorized account access and actions that went beyond users' instructions. The banks are concerned about automated tools moving money or making purchases without clear permission and about telling human customers apart from AI activity. Read-only access is being considered as a safeguard.
Morgan Stanley, JPMorgan, Bank of America and Citi are among the lenders placing new limits on outside AI agents. Reported problems include account access without authorization and automated actions that exceeded what customers had asked for.
The banks are weighing read-only arrangements, which would let such tools inspect account details but not transfer funds or buy items. Another complication is verification: staff may struggle to tell a customer from an AI system contacting a call center on that person’s behalf.
Customers who rely on AI tools for financial tasks could see convenience reduced if agents are limited to viewing account data. Banks and third-party developers may need clearer permission and identity checks, while call-center staff could face harder verification work. Read-only access may lower the risk of unintended transfers or purchases, but it could also leave some users, including those who depend on automation for accessibility or time savings, with fewer options.