Bank of America bans sharing passwords with smart agents, saying digital delegation removes protection from accounts
Bank of America, the second-largest banking group in the United States, sent a comprehensive warning to its customers titled “Protect Your Money in the Age of Artificial Intelligence,” urging them to refrain entirely from sharing their usernames and passwords for their bank accounts with any external party, and explicitly naming the AI tools and agents that can execute transactions and act on behalf of their owners. The direct tone of the message reflects a growing concern within the financial sector about the increasing reliance on personal digital assistants, as users rush to grant automation software full access to facilitate purchases and financial monitoring, without appreciating the security and legal consequences of breaking traditional protection protocols.
The banking memo identified three direct risks of handing credentials over to smart agents:The first is that the software agent could execute financial actions or transfers without the client’s knowledge or immediate consent; the second is that the bank’s automated monitoring algorithms might flag this activity as an external attack aimed at draining the account, prompting an immediate freeze and depriving the client of access to their funds; the most serious risk is that security vulnerabilities within the software and assistants themselves could leak banking login data to malicious parties, opening the door for hackers seeking financial gain to breach the bank account directly.
The move, which a Bank of America spokesperson confirmed as authentic after the message circulated on social media, comes as global financial institutions grapple with an escalating technical dilemma known as “delegated payments.” While banks, payment networks and transaction processors strive to devise secure mechanisms that allow users to delegate AI agents for shopping, securing the best prices and completing payments at the optimal time, banking systems today face a unregulated clash with unauthorized external agents attempting to reach customers’ funds through ordinary consumer portals, bypassing established authentication frameworks.
The danger of this practice lies in the loss of the contractual protection that safeguards depositors;Account-opening agreements at most banks clearly state that the client bears full legal and financial responsibility for any activity that results from delegating their login data to any third party. The Bank of America message was explicit on this point: “If you share your credentials, remember that you are responsible for any activity that results from that access.” In practice, using an independent smart agent to purchase a product or pay a bill could deprive you of the right to recover funds or sue the bank if balances disappear or an execution error occurs, because the bank will treat the transaction as a voluntary act by the account holder.
The warning carries direct practical implications for banking executives, cyber-security officers and fintech teams in Saudi Arabia, the United Arab Emirates and Egypt; with the rapid expansion of open-banking applications and the region’s digital-transformation race, user interest in trying smart agents to automate daily tasks is growing. This trend places regional banks before a urgent regulatory imperative: either accelerate the development of agent-specific APIs that ensure scoped delegation and encrypted authentication tokens without exposing original passwords, or confront a flood of frozen accounts and legal disputes with customers who have loaded their software with confidential data. The news also forces emerging fintech firms in Riyadh and Cairo to review their business models, as any application that relies on collecting users’ explicit banking login data now poses an operational risk that could lead to immediate delisting and regulatory prohibition.
Bank of America’s move reveals that the gap between AI agents’ ambitions and banking security architecture has become a tangible reality that demands a comprehensive reset of user behavior. Until financial institutions and tech platforms arrive at encrypted standards that separate delegation authority from possession of login data, the core strict rule for protecting savings remains unchanged: do not hand your bank-account key to an algorithm, no matter how persuasive it may be in convincing you that it acts in your interest.