Can AI Hack Your Bank Account? Why Banks Are Worried About Autonomous Agents

Yes, as a tool in criminals' hands. AI can help attackers impersonate account holders, get past identity checks and find software weaknesses. The harder question is what happens when the customer invites an AI assistant into the account and it can do more than they intended. FinCEN alert BIS paper

Your risk depends on the route in. A convincing scam, a stolen login, a weakness in financial infrastructure and an assistant given too much authority create different problems. Banks face those problems across borders, while the protections available after money moves depend on the account and payment system.

Some banks are already blocking agents their customers invited in.

The agents banks are turning away

Reuters reported on October 22 that major US banks were blocking third-party AI agents from operating in customer accounts and making transactions. An industry source described customers sharing credentials, with banks flagging and blocking activity. Reuters report

JPMorgan Chase CEO Jamie Dimon put the concern plainly. Allowing just any outside agent into the company would be “just too risky for clients and for JPMorgan,” he said, according to Reuters. Reuters report

An agent can work through a task, use tools and choose its next step. That makes it useful for financial administration: inspecting transactions, collecting documents or preparing a payment. It also creates an awkward question for the institution. A correct password identifies an account, but says little about the limits the customer gave the software.

Morgan Stanley had blocked outside agents but had not seen unauthorized or rogue agents, a Reuters source said. The report describes access concerns and restrictions, without documenting completed theft from these customer accounts. Reuters report

The immediate challenge is drawing a boundary between an assistant allowed to look at your finances and one able to change them.

How AI can put money at risk

Five routes help explain what banks and customers are actually defending.

In late 2024, US financial-crime agency FinCEN reported increased suspicious activity reporting involving suspected deepfakes, particularly fabricated identity documents used to bypass verification. Here the AI helps a criminal appear legitimate to the institution. FinCEN alert

An Australian example shows what that can look like at account level. Brokerage CommSec warns that convincing AI-assisted interactions can help criminals pass identity checks and take control of accounts, after which they may attempt to change passwords, update details or transact. CommSec guidance

An invited assistant can face a different attack. Anthropic's browser safety guidance illustrates how hidden instructions in a page, email or document could divert an assistant into sharing bank statements. It says Claude asks permission before accessing financial sites and warns that prompt-injection safeguards leave a residual risk. A request to enter a site and permission to carry out a particular task still need separate attention. Browser safety guidance

The danger can therefore start with an interaction that looks routine: a customer identity check, an account login or an email the assistant has been asked to read.

What more capable AI changes

AI's role extends beyond writing persuasive scam messages. In November 2025, Anthropic reported an AI-assisted espionage campaign that included financial institutions among its targets. Human operators selected targets and retained strategic decisions, while the software carried out substantial operational work. The provider reported some successful intrusions across the wider campaign without identifying successful financial-sector victims or stolen deposits. Anthropic investigation

Our earlier investigation into how hackers delegate work to AI agents covers criminal campaigns and their economics. For a financial institution, the practical concern is how much work an attacker can pursue while requiring less continuous supervision.

The September paper from the Bank for International Settlements' Financial Stability Institute describes advances in vulnerability discovery, exploit development and multi-step operations, together with shorter windows to repair weaknesses. Those abilities can also support defense. BIS paper

Controlled evaluations show why the threat deserves attention. The UK AI Security Institute tested extended attacks in simulated networks and found progress as models and computing budgets improved. Those ranges had no active defenders stopping the agents. They measure technical capability under specified conditions, rather than the likelihood of breaching a live bank. AISI research

The unresolved question is the balance between faster attacks and faster protection. The financial-sector evidence gives reason to act, while leaving that overall outcome open.

Financial defenses have gaps to close

An attacker finding a flaw sooner is dangerous when the organization still needs days to approve and deploy a repair. An assistant's access policy offers limited protection if the surrounding software cannot enforce it. These are operational problems that a more capable model can intensify.

Australian regulator APRA provides a concrete example of the preparedness problem. Its April industry letter identified weaknesses in a sample of large banks, insurers and superannuation trustees: access controls had not adjusted to nonhuman actors such as agents, and remediation timelines were not consistently aligned with faster threats. APRA letter

Defenders can delegate useful work too. The BIS paper describes defensive opportunities alongside the threats. APRA and ASIC's August statement highlights threat intelligence, vulnerability detection, code review and incident response, while emphasizing identity controls, tested recovery and the risks of shared technology suppliers. BIS paper APRA and ASIC

For customers, recovery belongs alongside prevention. A bank needs to contain a compromised account and keep essential services available. A supplier failure that interrupts several institutions can matter even when the customer has followed every password rule.

Permission the bank can enforce

Forbes contributor Sandy Carter offers a useful example: an agent authorized to pay a $200 bill should be stopped if it tries to send $2,000 or pay someone else. Her point is that the bank must enforce the boundary instead of relying on the agent to remember its instructions. Sandy Carter in Forbes

That distinction gives customers a practical test. Can the service limit the recipient and amount, expire the permission and let you revoke it? Or does the assistant simply operate an account session with whatever powers are available inside it?

Payment networks and developers are building relevant controls. Visa's Trusted Agent Protocol uses signed requests to help merchants recognize approved agents and their intent. Google's AP2 specification describes signed checkout and payment authorizations, receipts and checks performed by ordinary deterministic software. These create evidence of what a customer approved. Visa documentation AP2 specification

They address particular payment and commerce interactions. They do not give every assistant permission to operate online banking or promise a refund after a mistake.

Our 1Password for Agents analysis explains another boundary: hiding the password from the model protects a reusable secret, while controlling the resulting account session protects what happens next.

Who pays if an agent moves money

Start by separating a bank failure from a disputed payment. Deposit insurance protects eligible deposits when an insured institution fails. It does not decide whether an AI-initiated transfer must be reimbursed. The country, payment system and authority given to the service all matter. FDIC guidance US deposit-insurance rule

For a payment, the questions are who initiated it and what authority they had.

United States

In the US, giving someone payment authority can leave you fully liable when they exceed your instructions. Regulation E's official commentary says that if you furnish an access device, such as a code, and authorize a person to make transfers, you are fully liable for transfers that exceed that authority unless you have notified the financial institution that the person is no longer authorized. Both access and transfer authority matter. Regulation E commentary

Credentials obtained through fraud are treated differently. CFPB guidance says a fraudster's transfer using access obtained that way can still be an unauthorized electronic fund transfer. Sharing credentials alone is therefore too crude a test for deciding a claim. CFPB guidance

For an AI service, the unresolved step is applying these rules to the actual arrangement: which person or provider received authority, what it covered and how the payment was initiated. Exceeding a prompt does not, by itself, settle the reimbursement question.

United Kingdom

The UK has specific reimbursement rules for eligible authorized push payment scams carried out through Faster Payments or CHAPS. FCA guidance describes protection up to £85,000, with eligibility conditions, possible deductions and exclusions. Overseas payments and payments on crypto exchanges follow different rules. That protection concerns qualifying scams; it is not a blanket promise to refund any transfer an AI agent gets wrong. FCA guidance

For a payment you did not authorize, FCA guidance says the refund should normally arrive by the end of the next business day after you report it; authorization, customer fraud and intentional or grossly negligent breaches of security duties can affect the outcome. FCA guidance UK payment regulations

European Union

Under the EU's PSD2 framework, unauthorized payments generally trigger prompt refund duties, while fraud, intentional breaches and gross negligence can change the payer's liability. National implementing law and whether valid payment consent was given matter. These are payment rules applied to the circumstances of a loss, rather than a separate AI-agent refund guarantee. PSD2 European Commission

Negotiators agreed on PSD3 and a new Payment Services Regulation on November 27, 2025, including full refunds for qualifying bank-impersonation scams and treating fraudster-initiated or altered transfers as unauthorized. Those forthcoming protections are separate from rights already in force. European Parliament deal Council legislative note

Australia

In Australia, the ePayments Code provides protections through subscribing providers. Its unauthorized-transaction definition excludes payments performed by the user or with their knowledge and consent. Breaching passcode rules can affect liability, subject to the Code's conditions; the correct passcode alone does not prove customer responsibility. Provider-approved access arrangements also matter. ASIC overview ePayments Code

Australia's Scams Prevention Framework is being introduced in stages. The ACCC says most obligations start on March 31, 2027. Future requirements should not be mistaken for a refund guarantee available today. ACCC framework

Keep control of the payment

Keep banking credentials out of general-purpose agents and check that the institution supports a proposed connection. An approved read-only integration can reduce transaction authority, although financial information still needs protection. Limit the agent's access and keep human approval for consequential actions. Cyber security guidance

Our always-on assistants guide explains how to set access and approval boundaries before connecting more accounts.

Use your bank's strongest supported authentication and verify unexpected requests through its official app or a number you independently know. Use unique passwords and multifactor authentication. A familiar voice or polished message is a poor substitute for going directly to the bank. Moneysmart guidance

If you see an unfamiliar payment, contact the bank immediately. Contact a linked payment provider too, preserve the agent's instructions and approvals, and withdraw access with the providers' help. Ask what recovery or reversal is available and follow the complaints route for your country if the dispute remains unresolved. Account recovery guidance FTC guidance FCA guidance

Choosely's Take

AI can help attackers reach financial accounts, and it can bring useful assistants into those accounts with the customer's permission. Banks need controls that recognize both situations.

For the customer, the important question is what authority crosses the login screen. Before letting an agent handle money, look for a specific permission the institution can verify and enforce. Keep approval of the actual payment in your hands when those limits are unclear. A capable assistant is far more useful when its financial reach is easy to understand and stop.