Should you give an AI agent your business bank login?

In an email TechCrunch reported on October 27, Bank of America warned its customers: never give your username and password to an outside service, “including an AI-enabled tool or agent that offers to act on your behalf.” Another line is the one owners should read twice: “If you do share your credentials, keep in mind that you’re responsible for activity resulting from that access.”¹

I run hundreds of AI agents across my companies and my clients’ companies. My collections agent reads Fifth Nine’s bank account every week, with its own key and not my password. Yours doesn’t need your password either.

My answer: don’t give any AI agent the login you use for your company’s bank account. Give it a way in that can only read, or its own key scoped to the one job, and keep every payment as a click you make yourself.

Should I give an AI agent my bank login?

No. An agent signed in with your username and password can do anything you can do, and your bank’s agreement makes you responsible for all of it. Give the agent read-only access through your bank’s own user controls, a read-only data connection, or a scoped API key, and approve every payment yourself.

The temptation is real. Anthropic’s Claude Duet, launched October 21, can find the email you’ve missed, check QuickBooks or Stripe for unpaid invoices and draft reminders, and prepare payroll in Gusto.² The obvious next step is to let an agent like that into the bank. TechCrunch reports that customers are increasingly handing over their logins as personal AI assistants grow more popular.¹ Saying yes turns the agent into you, as far as the bank can tell.

That’s the problem Bank of America and JPMorgan are now describing.

What did Bank of America and JPMorgan say about AI agents?

Bank of America told customers, in an email TechCrunch reported on October 27, not to share their bank login with any AI tool or agent, and that they are responsible for what happens if they do. JPMorgan said on October 13 that it doesn’t let outside parties log in with customers’ credentials, and its CEO warned of a “liability transfer.”

A Bank of America spokesperson confirmed the email to TechCrunch, which reported it after the email was posted to social media.¹ On October 13, on JPMorgan’s third-quarter earnings call, Jamie Dimon told analysts the bank is “not going to allow just any … outside agent to come in inside the company, because it’s just too risky for clients and for JPMorgan.”³

Dimon’s warning to people using outside agents was blunter: “If people are using them, they should understand the risk. They should understand there’s a liability transfer.”

A JPMorgan spokeswoman told CNBC: “we do not permit third parties to access accounts by obtaining customers’ banking credentials and logging in on their behalf.” At Chase, agents can still see balances read-only if Plaid or another connector holds the customer’s credentials. They can’t send money or pay a bill that way.³

Who pays if an AI agent misuses my bank login?

You do, in most cases. Bank of America’s deposit agreement says that if you let another person use your account or your login, “you are responsible for all transactions conducted by that person (even if he or she exceeds your authorization).” For a business account, the federal consumer protections that cap personal losses don’t apply at all.

That sentence from the Bank of America Deposit Agreement, effective May 15, 2026, is the part I’d bet most owners have never read. Your responsibility lasts until you tell the bank the person is no longer authorized and it has had time to act. As I read it, the phrase in parentheses covers the agent that misreads your instructions and pays the wrong vendor. Find the same section in your own bank’s agreement.

The consumer safety net doesn’t reach a company account. Regulation E, the federal rule behind the $50 limit on a lost or stolen card reported within two business days of learning it’s gone, defines an account as one “established primarily for personal, family, or household purposes.”⁴ Your operating account isn’t one.

Even on a personal account, the rule excludes transfers made by “a person who was furnished the access device to the consumer’s account by the consumer,” unless you’ve told the bank that person’s transfers are no longer authorized. I’m not a lawyer, and I haven’t found a court ruling on how that applies to an AI agent. Dimon’s “liability transfer” tells you which way JPMorgan expects it to go.

Bank of America’s agreement adds two conditions for business accounts. If your claim involves a business account, you agree to go to your own insurance before claiming against the bank, and the bank’s liability shrinks by whatever your insurance pays, or should have paid. If the bank offered you a fraud-prevention service and you declined it, you can’t claim for the fraud it was built to catch.

How can an AI agent get read-only access to my bank account?

Give the agent its own read-only access: a separate user with inquiry-only access if your bank offers one, a read-only connection through an open banking provider such as Plaid, or an API key limited to reading. Each lets the agent see money arrive without sending it, and you can switch off its own user or key without touching your password.

Bank of America’s agreement already describes the first option for small business customers: “you should establish separate Access Credentials for each person who you determine needs access to your accounts.” Any login you set up for someone can “obtain information and make transactions on the account (unless inquiry only access is selected).” Inquiry only is the setting you want for an agent.

My collections agent works this way. Fifth Nine sends its invoices from its bank, and the agent reads that account with its own key. The key is read-only except for one thing: it can write a note on each payment, saying which invoice the money paid. It writes the note, reads it back, and only then counts the payment as matched. It can’t move a dollar.⁵

Way in	What the agent can do	Who’s on the hook	My call
Your username and password	Anything you can, including payments	You, under the deposit agreement	Never
A password manager signs in for it	Anything you can, once signed in	Still you: it’s your login	Not for the company account
Its own user, inquiry-only	See balances and transactions	You set its limits	Good start
Read-only open banking connection	See balances and transactions	Still you; the connector may hold your login	Good for reporting
Its own API key, scoped to the job	Only what the key allows	You set the scope	Best for a recurring job

The password manager row is the new one. 1Password for Agents, launched October 22, lets an agent sign in to a site without ever seeing the password. That’s a real improvement for your personal accounts. “The old model where you hand over a credential and hope for the best doesn’t work,” said Aashish Tripathi, 1Password’s chief product officer.⁶ The agent still signs in as you, though. As I read Bank of America’s agreement, a login an agent uses on your behalf is still your login, whoever typed it.

Can an AI agent pay bills or move money for my business?

No, not on its own. Let an agent prepare the payment: match the bill, fill in the amount, line it up in your bank or bill-pay tool. You approve each one. ChatGPT agent refuses bank transfers, Claude Duet won’t move money between accounts even with your approval, and JPMorgan, which blocks outside agents, blocks exactly this.

OpenAI built ChatGPT agent in 2025 to “actively refuse high-risk tasks such as bank transfers.”⁷ Anthropic’s Claude Duet asks you before it sends a message or makes a payment, and some things stay off-limits even with your approval, “like trading securities or moving money between accounts.” When it buys something through Stripe’s Link wallet, it pays with a virtual card, “so your real card number isn’t shared.”²

At Fifth Nine, money goes out only on my word for that payment.

The gap between preparing a payment and sending it is where your judgment lives. An agent that lines up a month of bills and waits for your click saves you most of the time. An agent that sends them saves you one more minute and puts every dollar in the account behind its judgment.

What about personal AI agents that ask for your bank login?

Keep your company’s bank out of them. Personal agents like Claude Duet and Meta’s Muse are built for personal use: one person’s account, not a team’s.⁸ Claude Duet runs on your Claude account, on one vendor’s system and model. Connect your company’s bank to one, and your financial data sits with a vendor you can’t easily leave.

That lock-in is the bigger risk. The vendor holding your business data can also become your competitor. A company’s recurring jobs belong on a setup that works with any model, where the agent has its own access and the record of its work stays with you. Mine can move between Anthropic’s Claude, OpenAI’s Codex and open-source agent software, and the setups Fifth Nine builds for clients work the same way.

I compared one of them in detail in Claude Duet for small business. Claude Duet is a reasonable assistant for an owner. It isn’t where your company’s bank access belongs.

What should an owner do this week?

Find out whether anyone at your company has already given an AI tool a bank login, and change that password if so. Then list the jobs you’d want an agent to do with the bank, and give each one the narrowest read-only access your bank offers. Keep payments as your click.

Three questions for your bank will tell you how far you can go. Does it let you add a user with inquiry-only access? Does it support read-only data connections through an open banking provider? Does it issue API keys, and can they be limited to reading? If the answer to all three is no, the agent can work from the statements you export, and the bank stays yours.

I covered the rest of the access rules my agents run on in AI agent security, and what my collections agent does each week in AI agent vs ChatGPT.

If you want an agent on your bank-side work without handing over the keys, Fifth Nine’s AI Audit maps which accounts each job needs and what waits for your approval.

---

Sources

How this was written: drafted with AI from my notes and Fifth Nine’s operating records, then edited and approved by me.

Footnotes

1. Zack Whittaker, “Bank of America kindly asks that you don’t share your banking password with your AI assistant”, TechCrunch, October 27, 2026. I couldn’t find the email on Bank of America’s site; the quotes are from TechCrunch’s report, and a Bank of America spokesperson confirmed the email to TechCrunch. ↩ ↩² ↩³

2. Anthropic, “Introducing Claude Duet”, October 21, 2026. Claude Duet is a waitlisted research preview for Claude Pro and Max subscribers in the US. ↩ ↩²

3. Hugh Son, “JPMorgan Chase blocks outside AI agents like Muse, Instinct from directly accessing accounts”, CNBC, October 13, 2026. CNBC reports the block applies to retail customers, and that the bank gave no timeline for letting agents act on accounts directly. ↩ ↩²

4. Regulation E, 12 CFR 1005.2, definitions of “account” and “unauthorized electronic fund transfer”; the $50 and $500 limits are in 12 CFR 1005.6. A business account falls under your deposit agreement and state commercial law instead; Bank of America’s agreement, for example, applies Article 4A of the Uniform Commercial Code to funds transfers. Ask your bank and your attorney what applies to yours. ↩

5. From Fifth Nine’s operating records. The agent runs every Monday; how it matches payments is in Should you let QuickBooks AI send your invoice reminders?. ↩

6. 1Password, press release, October 22, 2026, for the quote. Availability is from 1Password’s “Introducing 1Password for Agents”, the same day: it is available for 1Password Individual and Family accounts on 1Password.com; its Claude Duet integration is listed as coming soon. ↩

7. OpenAI, “Introducing ChatGPT agent”, July 2025. ↩

8. Meta calls Muse “a personal AI agent” in “Muse Is Now Available in Singapore”, October 27, 2026. Anthropic’s Claude Duet FAQ says “Team and Enterprise plans are not included yet.” ↩