EXPLORINEER
en

KR — ZDNet Korea

Bank of America Tells Customers Not to Give AI Assistants Their Banking Passwords

Security2 min read

Bank of America has told its customers not to share their online banking login details with AI assistants or AI agents. The bank sent the warning in an email on October 27, according to TechCrunch.

What happened

Bank of America sent customers an email titled 'Protecting Financial Assets in the AI Era.' The bank asked people not to share their usernames and passwords with other people or outside services. This includes AI tools and agents that offer to handle tasks for you. The bank also said that if you share your login, the bank will hold you responsible for any transactions made through that access.

Key facts

  • The email was sent to customers on October 27 (local U.S. time).
  • The bank says customers are responsible for any activity that happens after they share login details.
  • TechCrunch says most U.S. bank terms of service also make customers responsible for actions taken by anyone they gave login details to.
  • Bank of America did not respond to TechCrunch's request for comment.

Why logins are risky with AI

An AI agent that has your bank login could make money moves without you knowing. The bank might also see the agent's access as an account takeover attempt and lock your account. If the AI assistant has a security flaw, hackers could steal your login details. Banks are still deciding how to handle 'agentic payments,' where AI picks and pays for items on its own. Axios reports that banks are also struggling with how to deal with unapproved AI agents that try to access customer accounts.

Why it matters

This shows that big banks see AI agents as a real security risk, not just a new tool. If you share your password, you may lose money and have trouble proving what happened. People who use AI helpers should know that handing over a bank password can mean taking on the risk themselves.

What to watch

  • Whether other large banks send similar warnings to customers.
  • How banks change their terms to cover AI agents and agentic payments.
  • How AI tool makers add safe ways to log in without showing passwords. A related TechCrunch story describes 1Password supporting AI agent login without exposing passwords.

Glossary

AI agent
A computer program that can take actions for you on its own, such as making payments or booking things.
TechCrunch
A U.S. news website that covers technology companies, products, and startups.
Axios
A U.S. news site that reports on politics, business, and technology.

Ad

Add 150 words. Learn 10 a day.

Dicter word books send only the words you learn to your review notes.

More in this topic

SecurityTechCrunch

Hacker stole personnel data about thousands of Homeland Security employees, including CBP and ICE agents

Personal and work contact data on more than 40,000 U.S. Department of Homeland Security employees, including CBP, ICE, HSI, and CISA staff, has been published online after a hacker claiming to be "Department of Peace" stole it from an Okta single sign-on system used by the department. The dataset also includes IT and log-in records showing which internal systems and apps employees can access. Homeland Security and Okta have not confirmed the breach details; Okta says it has no evidence its own systems were compromised.

SecurityITmedia

NEC Apologizes for Information Leak at Contractor, Says It Is Reflecting as a Security Business

At its Q2 earnings briefing on October 28, NEC Vice President and CFO Kazukazu Amemiya apologized for a security incident involving a contractor, saying that as a company in the security business it deeply regrets the incident. NEC had announced on October 20 that a system development and maintenance contractor was hit by a cyberattack in late September, affecting customers, and that a cloud storage service used for information sharing also leaked files containing personal data. Amemiya said NEC is prioritizing responses to regain customer trust and strengthening its management structure.

SecurityITmedia

Unauthorized Access to JAL Reservation System Exposes Data of About 90,000 People, Including Passport Numbers for Some

Japan Airlines (JAL) and Japan Transocean Air (JTA) said that a provider of their reservation and check-in management system was accessed without authorization, and that reservation data for about 92,000 customers may have been viewed from outside. For about 2,000 of them, passport numbers, phone numbers, and other details may also have been viewed, while the companies said there was no sign of credit card numbers or passwords being leaked and no effect on flight operations. The affected provider, Amadeus IT Group, reported the intrusion on October 23, has completed necessary security measures, and has not confirmed any misuse of the information as of October 28.

SecurityThe Register

123 Reg discloses 'AI cyberattack' on customer data, suspects China nexus

UK domain registrar 123 Reg says it suffered an "AI-driven cyberattack" on September 18 that exposed customer data, including contact details, VAT numbers and API product information. The company says its investigation found attacker infrastructure hosted in China and Singapore and suspects a China-linked group, possibly the same actor that used the open-source ARTEX tool against South Korean financial institutions. 123 Reg says it believes the attacker only read customer data but may have made copies, and has urged customers to be wary of unsolicited messages.