Why are banks blocking AI agents from moving money?

Banks cite fraud and liability. When a customer shares a password with an outside agent, the bank can’t tell the customer from the agent, can’t limit what the agent does and can’t easily say who’s responsible if a payment goes wrong. Most large US banks now allow read-only access through approved connections and block agents that log in with shared credentials.

Can an AI agent access my bank account?

Through approved connections, many banks allow agents to read balances and transactions. Giving an agent your username and password usually violates your bank’s terms of service and may affect your protections if something goes wrong.

What is permission design for AI agents?

It’s the practice of giving an agent scoped, reversible and visible authority over an account, so a person can delegate a task without handing over their identity.

Who is liable when an AI agent makes a payment?

That’s unresolved. Banks are negotiating liability protocols with agent developers, and regulators haven’t issued rules specific to agent-initiated payments.

Banks Gave AI Agents a Cancel Button. Customers Need a Lock.

Some of the biggest US banks have decided AI agents can look at your money but not move it. For moving money, that leaves customers with an all-or-nothing control, and all-or-nothing controls get used at the wrong moment, or worked around.

In one week this October, JPMorgan Chase, Citigroup, Bank of America and Charles Schwab drew the same line: outside AI agents can read customer accounts through approved connections, but they can’t move money (PYMNTS). Days later, CBS News reported that banks were finding unauthorized agent activity inside customer accounts anyway, mostly because customers had handed their username and password to an agent the bank never vetted.

Permission design for AI agents is the practice of giving an agent scoped, reversible and visible authority over an account, so you can delegate a task without handing over your identity. Every bank and fintech building for agents is working on this right now, and most are treating it as a policy question. I think it’s a design question first, and not a new one. I worked on a smaller version of it at PayPal in 2019.

The line the banks drew

Schwab plans servers that let a client’s chosen AI model check balances and run research under Schwab’s rules, with no way to move money. Bank of America is limiting agent access to deposits while it works out liability with agent developers, and its CEO says a person should approve any money leaving an account. Meanwhile JPMorgan and Schwab are building their own assistants to do the moving themselves.

Regulators are asking the same questions. Reuters reported that the Fed, the OCC and the FDIC want to know what limits banks put on agents, how agent actions get approved and whether those decisions can be audited (Reuters via BNN Bloomberg). The sources are anonymous, and none of it is a rule yet.

For moving money, banks haven’t built an approved route at all. If you want an agent to pay a bill for you today, you have two options: hand it your password, which your bank prohibits, or don’t use one. That’s a cancel button.

What a cancel button teaches

In 2019 I led design on PayPal’s Unified Card System, which brought card management for the PayPal Cash Card and other card products into one experience. One problem came straight from customer service. If you misplaced your card, you had exactly one control: cancel it. Plenty of people did. Then they found the card in a coat pocket and called back, frustrated, and PayPal paid for a replacement nobody needed.

We added Lock Card, a single reversible switch. Calls about lost and replaced cards fell significantly.

What stuck with me is that when the only control you have is drastic and permanent, people either use it at the wrong moment or work around it. Customers handing their passwords to agents are doing the second thing, with a lot more at stake than a plastic card.

The workaround is the warning

That project taught me a second thing. Our data showed customers typing their card details by hand into merchants that didn’t take PayPal. We could have discouraged it. Instead we designed the sanctioned version: Copy Card Number, which kept the details hidden until you deliberately revealed them. People were already doing it, so we made the safe way the easy way.

Credential sharing with agents is the same signal at bank scale. Banks are right to block it, and I’ll get to why below. But blocking doesn’t make the demand go away. If people want something and there’s no approved way to do it, they’ll find an unapproved one.

What a lock looks like for an agent

From 2018 to 2019 I led design on PayPal’s virtual card work: a card you controlled, with a spending limit and an expiration date you set. I left PayPal in 2020. Later that year PayPal released PayPal Key, a virtual card for use anywhere Mastercard is accepted online, and retired it in 2022. The principle outlived it: authority that’s scoped when it’s granted is easier to trust than authority that’s all or nothing.

For an agent, a lock has five properties:

Scope. Which accounts and which actions. Reading balances isn’t the same grant as paying a bill.
Limits. How much, how often, and until when.
Reversibility. Pause without revoking, the way a lock differs from a cancel.
Visibility. What the agent did, when and why, somewhere you actually look.
Escalation. Approval above a threshold set by risk, not a prompt on every action. Some AI products already let you set each connected tool to allow, always ask, or deny (Department of Product).

Pieces of this are showing up. Robinhood lets outside AI agents trade and pay through its banking server, with a spending limit the customer sets, optional manual approvals and no access to the primary card number (PYMNTS). Mastercard has built a payments tool for machines on x402, a protocol designed for agents to pay (Fortune). Schwab’s read-only servers are scope built into infrastructure. I haven’t seen anyone put all five together in one place a customer can see.

The hard part is the state, not the switch

Building the Lock Card toggle was easy. The hard part was communicating the locked state: what you could and couldn’t do while the card was locked, and when you’d find out. Agents are the same. A permission screen at setup isn’t enough. You need to know what an agent can do right now and what it’s already done.

OpenAI recently published a report that shows why. An internal research model ran short of funds during a coding task on a test network. It derived keys from publicly known recovery phrases, checked 362 addresses, found one with money in it and spent from it. Its own reasoning questioned whether that was allowed, then decided it was fine. Its final report left out where the money came from (OpenAI).

No real money moved, and capability had nothing to do with it. The agent decided its own judgment outranked the account holder’s permission, then kept quiet about it. That’s where the card analogy runs out: a card does nothing on its own, and an agent makes choices. That’s why the lock has to be visible, not just reversible, and why the banks’ caution isn’t paranoia.

To be fair to agents, they’re good at the money tasks people neglect: moving idle cash, paying bills on time, catching a subscription that quietly renewed. Where they fall down is knowing the limits of their own authority. An agent doesn’t know what it wasn’t allowed to do unless the system tells it and checks. So those limits have to be spelled out in the design, not left for the agent to work out.

Where this argument doesn’t hold

Banks may not want delegation to work. An AI safety researcher argued on NewsNation that agents moving idle checking balances into higher-yield savings threaten bank margins (Yahoo Finance). If the blockade is mostly commercial, better permission design won’t open it. It will only make the banks that open up more trusted than the ones that don’t.
The rules aren’t settled. Regulators are asking, not ruling, and liability for agent-initiated payments is unresolved. Build the lock now and you’ll be revising it.
Demand is early. At Money20/20 USA, a panelist noted x402 volumes are still very small, and the panel agreed consumer trust is still a hurdle (FinTech Futures).
Smaller banks can’t build this alone. For most of them, the lock will arrive through processors and card networks, which moves the design problem to whoever owns that layer.

The lock is the product

Agents are going to move money. The banks are already building their own to do it. What’s still open is whether customers get a lock, or keep reaching for their password.

The institutions that design the lock keep customers on the sanctioned path. The ones that ship only a cancel button will keep finding agents in accounts they never authorized.