AI Agents in Online Banking: Who Is Actually Logging In?

If your team has started asking about AI agents in online banking, you are asking at the right time.

Customers are already handing these assistants their logins, and the industry has not yet agreed on how banks should respond. Here is the plain version of what is happening, what your existing controls can and cannot tell you, and what to settle internally before a customer asks.

What banks are finding

In October, Axios reported that several large U.S. banks are finding third-party AI agents inside customer accounts. In many cases the customer gave the agent a username and password and asked it to help. Most of the activity follows the customer's instructions. Axios also found activity that appears to go beyond what customers asked for. The response varies: some banks are blocking or restricting these agents, and others are looking at view-only access.

The same pattern has shown up outside banking. A major online retailer recently began blocking a customer's AI shopping assistant, calling it an unauthorized agent. The customer wanted the help. The platform had not agreed to it.

Why AI agents in online banking strain the login

Your authentication and fraud controls still matter. They check credentials, devices, behavior, and transaction patterns, and they were built to answer one question: is this the customer, or someone pretending to be the customer?

An agent acting with the customer's permission breaks that frame. The credentials are valid. The customer is real. The customer is also not the one operating the session. A login can confirm that the right person granted access. It cannot say who is acting now, what the customer asked that actor to do, or where the limits are.

Think of it the way you would think of a power of attorney. Permission to review a balance is not permission to move the money. Permission to pay bills is not permission to open an account. Authority has a scope, and a password does not carry one.

Questions to settle before a customer asks

You do not need a finished product to have a position. You do need an answer to these:

• Is our current stance on customer-directed software a written policy, a technical block, or just the absence of a decision?

• Do digital banking, fraud, legal, and operations define an authorized actor the same way?

• Where does permission to view information end and permission to act begin?

• If an agent follows a broad instruction and the result surprises the customer, who is accountable under our agreements and the rules that apply?

What is still not settled

Standards for identifying and governing AI agents are not settled. The FDIC chairman said in October that the agency's model risk guidance does not yet cover agentic or generative AI, and he asked how much decision-making authority depositors will delegate. A federal appeals court ruling in August, in a dispute between Amazon and an AI shopping assistant, was narrow. It did not create a general right for agents to operate on any platform.

Plan for a moving target, and for customers who will not wait for the rules to settle.

This is the practical version. The strategic question is bigger: how a bank stays part of the relationship when customers increasingly act through assistants. I take that on in this week's issue of The Instant Edge, “The Customer Logged In. The Customer Wasn't There.” The Instant Edge is where I write about instant payments, digital banking, and the decisions behind them. Subscribe at instantpaymentsmaven.substack.com for the next one.