Bank of America recently sent customers a warning email titled “Protecting Your Finances in the World of AI,” explicitly urging customers never to share their bank account usernames, passwords, or related credentials with any third-party AI tool or agent service claiming to act on their behalf.
As personal AI assistants and agentic payment tools become increasingly popular, some users have begun trying to entrust their login information to AI assistants so they can shop autonomously or find the best prices.
However, this behavior carries enormous security and compliance risks. Not only may it lead AI to perform financial operations without the user’s knowledge, but it can also easily trigger bank risk-control mechanisms and cause the account to be locked. More seriously, security vulnerabilities in AI assistants themselves may cause sensitive credentials to leak, giving hackers an opportunity to break in. In its statement, Bank of America emphasized that under the account agreements of most financial institutions, customers must bear the consequences themselves if their login information is disclosed.
At present, traditional financial institutions and payment processors are accelerating their exploration of compliant integration of AI agents in the financial sector, but how to balance the convenience of intelligent services with the absolute security of funds remains a core issue urgently in need of industry-wide regulation.