Bank of America warns customers against sharing credentials with AI agents

Bank of America has issued a direct warning to its customers, explicitly advising them not to share their banking usernames and passwords with AI-enabled tools or agents. According to TechCrunch, the financial giant sent an email titled “Protecting your finances in the Al World” to remind users that sharing credentials with outside services, even those designed to act on their behalf, poses significant security and compliance risks.

What happened

TechCrunch reports that Bank of America sent an email blast to customers urging them to never share their login details with another person or an outside service, specifically including “an Al-enabled tool or agent that offers to act on your behalf.” The bank confirmed the authenticity of the email after it was posted to social media. The warning highlights several specific risks: an AI assistant could perform financial actions without the user’s knowledge, trigger security flags that lock the customer out of their account, or suffer a security flaw that leaks credentials to financially motivated hackers.

The article notes that this guidance comes as banks are still grappling with how to integrate AI agents into financial operations. While the industry is exploring “agentic payments”—where agents autonomously make purchases—banks are reportedly struggling with unauthorized agents accessing customer funds. TechCrunch emphasizes that despite the convenience of AI assistants, account agreements at most banks hold customers responsible for any activity resulting from shared access. As the bank’s email states, if you share your credentials, you are responsible for the resulting activity.

Why it matters for small business owners and CFOs

For small and mid-sized companies, this warning is a critical compliance and operational risk alert. Many small business owners are increasingly tempted to use personal or third-party AI agents to automate routine financial tasks, such as invoice processing or expense categorization, to save time. However, Bank of America’s stance clarifies that handing over direct banking credentials to an external AI tool is not a viable strategy for efficiency. From a financial operations perspective, this creates a liability trap: if an AI agent makes a mistake or is compromised, the business owner remains personally and corporately liable for the losses because they voluntarily shared access. This undermines the core promise of AI-driven efficiency by introducing severe security overhead. For fintech builders and financial analysts, this signals that the market for “agentic payments” is not yet ready for direct credential sharing. Instead, the industry must rely on secure, API-based integrations and bank-approved frameworks that do not require exposing raw passwords. Small companies should view this as a clear boundary: AI can assist with financial analysis and drafting, but it should not have direct, unmediated access to banking logins.

What to do this week

1. Audit all current AI tools used for financial tasks and immediately revoke any that have direct access to banking usernames and passwords.
2. Review your business bank account agreements to understand specific liability clauses regarding third-party access and unauthorized activity.
3. Implement a strict policy that prohibits sharing banking credentials with any AI agent, directing them instead to use secure, read-only API connections where available.

Sources

• Bank of America kindly asks that you don’t share your banking password with your AI assistant — TechCrunch - Fintech