Are banks drawing a line between borrowed and issued AI access?

Suppose you give an AI agent your banking password so it can handle a chore for you. You have authorised it, and it does what you ask. So why would your bank want it out?

Because, from the bank's side, the agent looks like you. A bank cannot easily tell an authorised agent from a rogue one when both arrive with the customer's password, and for now the customer appears to carry the risk. That is the tension at the heart of this story. Banks appear to be sorting agents into two kinds: those that borrow a customer's password, which are being restricted, and those that hold a credential issued for the purpose, for which routes are only now being built.

The restrictions come first. In late October, Axios reported, citing unnamed sources, that major US banks were detecting third-party AI agents inside customer accounts. As CBS News relayed (opens in a new tab), most of these agents use credentials that customers have handed over, which goes against bank terms of service. Morgan Stanley was reported to be blocking such agents, and JPMorgan, Bank of America and Citi to be restricting them. Jamie Dimon said on JPMorgan's 13 October earnings call that the bank would not allow just any outside agents inside the company.

Notice what the dispute is not about. Axios's reporter told CBS the agents were not hacking accounts or depleting funds; they were largely following user instructions, without the bank's permission. The sharper question is who pays when an agent gets something wrong, and so far the answer looks unclear. At Money20/20, PNC's chief executive called for liability to shift onto technology firms, and the head of Early Warning Services said liability rules are missing. Wells Fargo, Payments Dive reported (opens in a new tab), has told its customers: "If you give an AI tool your username and password, you may be liable for any mistakes made by the AI tool."

If borrowed passwords are the problem, the alternative on offer is a credential issued for the purchase itself. Shopify's Fall '26 Edition, announced on 28 October, brings Shop Pay checkout into third-party personal agents. Shopify says (opens in a new tab) Shop Pay stays secure with tokens from Mastercard, Visa, Discover and, coming soon, American Express for agent purchases from merchants off Shopify. If that model spreads, it may raise the value of tokenised, registered credentials for card networks and wallets. That is Shopify's own description, though, and it has published no adoption data.

Regulators are beginning to ask the same questions. On 2 November, at Hong Kong FinTech Week, the HKMA launched Project SAGE (opens in a new tab), established a cross-sectoral Agentic Finance Expert Group and published a discussion paper on banks' use of agentic AI. For now this is an announcement of work, not a set of rules.

There are good reasons to hold the argument loosely. A Morgan Stanley spokesperson told CBS the bank had not observed any unauthorised AI agent activity on its platforms, which conflicts with the Axios account. David Sacks, the White House AI adviser, argued that most of the activity appeared to be user-authorised agents rather than cyberattacks. No fraud losses have been reported, and the Axios report rests on unnamed sources that Reuters said it could not immediately verify. If the traffic is modest and benign, banks may be restricting agents more out of caution than out of damage done, and the line may prove blurrier than it looks.

That is why the next markers matter more than any single product. If Visa, Mastercard or Amex publish liability rules for agent-initiated payments, if named banks confirm their policies, or if Shop Pay discloses how many agent orders it handles, the line between borrowed and issued access will become clearer. So will the first results from the HKMA's expert group.

Even so, the pattern hangs together. A password tells a bank nothing about whether the visitor is you, your assistant or a thief, and it leaves open who answers for a mistake. The dividing line may turn out to be less about security than about liability.