Bank of America Warns Customers: Don’t Share Banking Passwords With Outside AI Agents
Bank of America warned customers not to give their online-banking username and password to outside AI assistants or agents, according to a customer email reported by TechCrunch on October 27.1 The bank’s public security guidance independently says sharing a login with a third party gives that service the same access the customer has and can leave credentials exposed if the service is breached.2
Account security • Reporting cutoff: October 27, 2026, 7:19 p.m. EDT / 23:19 UTC
The bottom line
Do not paste or type a Bank of America User ID, password, PIN, security answer, card data or one-time verification code into an outside AI tool. Bank of America’s official guidance says to use its consent-based connection, where available, instead of handing a third party the credentials used to sign in.2
What happened
What Bank of America reportedly told customers
TechCrunch reports that the email, titled “Protecting your finances in the AI World,” told customers never to share a username and password with another person or an outside service, “including an AI-enabled tool or agent that offers to act on your behalf.”1 The report says the email also warned: “If you do share your credentials, keep in mind that you’re responsible for activity resulting from that access.”1
That email was not independently obtained by The IT Guys. TechCrunch said Bank of America did not immediately respond to its request for comment about the message.1 The wording should not be read as a blanket legal conclusion that every loss automatically becomes a customer’s responsibility; the bank’s current agreement contains transaction-specific definitions, notice requirements and liability provisions.3
Verified facts
Why it matters
Why credential sharing is different from a bank-authorized connection
Bank of America also warns that a third party might continue accessing information after the customer stops actively using its service. Revoking access ends ongoing access, but the third party may retain and use data that was shared earlier.2
The wider banking concern
Reuters reported on October 22 that major U.S. banks had been blocking third-party AI agents from operating inside customer accounts, citing two people familiar with the situation and an Axios report.4 One banking-industry source told Reuters that some customers had shared login IDs and passwords with agents and that banks typically flagged and blocked those transactions; Reuters added that transactions made with customer-shared credentials cannot necessarily be deemed unauthorized.4
What remains unknown
No confirmed-loss claim: The reviewed sources do not establish a total number of affected Bank of America customers or confirmed fraud losses caused by AI agents.14
Reuters’ industry account relies on unnamed sources and attributes part of the underlying report to Axios; it is context for the banking sector, not proof of a specific Bank of America incident.4
This is not a warning against Bank of America’s Erica
Bank of America’s own Erica assistant operates inside its Mobile Banking app. The bank says Erica uses natural-language processing grounded in machine learning, not generative AI or large language models.5 The reported warning concerns outside tools or agents that ask customers to hand over banking credentials; it does not mean Bank of America rejects AI broadly.
What this means for readers
What to do now
- Never give an outside AI assistant your banking User ID, password, PIN, security answers, card details or one-time verification codes. Bank of America’s public guidance says sharing login information gives a third party the same access you have.2
- Use a bank-authorized connection instead. If a service is supported, sign in through Bank of America’s consent screen and approve only the data access you intend to share.2
- If you already shared credentials, try to remove the app or service’s access, then change the password from the official Bank of America app or website. The bank calls changing the password the safest option for a service that used the login directly.2
- Harden and monitor the account. Bank of America recommends using two-factor authentication where offered, keeping contact information current and setting security alerts.2 Review transactions and account activity, and contact Bank of America through its official app, website or number on the back of the card if anything looks suspicious.
Sources
- Bank of America kindly asks that you don’t share your banking password with your AI assistant — TechCrunch, October 27, 2026, 2:44 p.m. PDT.
- Third-Party App/Service Data Sharing — Bank of America, accessed October 27, 2026.
- Online Banking Service Agreement — Bank of America, effective October 19, 2026.
- US banks are blocking third-party AI agents access to customer accounts, sources say — Reuters, October 22, 2026.
- Erica — Virtual Financial Assistant — Bank of America, accessed October 27, 2026.
Update and correction note: This article distinguishes TechCrunch’s account of the customer email from Bank of America’s independently public guidance. We will update it if the bank publishes additional details or the underlying facts materially change.