According to Axios, major US banks, including Morgan Stanley, Bank of America, JPMorgan, and Wells Fargo, are detecting third-party AI agents accessing customer accounts. And they sometimes seem to attempt actions that probably go beyond what users requested.
This creates a new security challenge for banks: to distinguish an AI agent carrying out a legitimate customer instruction from one acting outside its authority.
Some banks are responding by restricting third-party AI access or exploring read-only permissions, Axios reports.
But the key is in finding a way to support useful automation without giving agents more control than customers intended.
A successful login does not establish permission
A customer might ask an agent to check an account balance. But “Check my balance” is a specific instruction, and it does not authorize an agent to transfer money, change account details, or initiate other sensitive actions.
Yet conventional account access controls may struggle to make that distinction. Once an agent enters a customer's account using valid credentials, the bank may struggle to determine what the customer actually authorized it to do.
This challenge derives from a gap between identity and authority. The customer may be genuine, and the login may be valid, but neither establishes the limits of the agent's permission.
So, the question for banks is how to connect three things: the verified customer, the instruction they gave, and the action the AI agent is attempting to perform.
Banks may be underestimating the agent problem
Regula's 2026 global study, Identity Verification in the Age of AI Agents, points to a potential gap in how financial institutions assess AI-agent-related risks.
Only 21% of banking respondents ranked AI agents acting on behalf of users among their top identity threats, compared with 26% across industries.
At the same time, 64% of banking respondents expressed confidence in their ability to verify human presence during identity checks, compared with 48% across other sectors.
These findings suggest that banks may be more confident in their ability to verify people than they are concerned about software acting on those people's behalf.
AI agents need permissions that match the task
For banks, the practical challenge is to define what an agent is allowed to do, enforce those limits, and determine when the customer needs to approve an action directly.
“Think of sending someone to collect a parcel. They need permission to collect that parcel – not a key to your home. Businesses need the digital equivalent: permissions narrow enough to match the task, with limits they can actually enforce. Reading a balance should not allow a transfer. Approving one payment should not authorize the next ten. Anything beyond the agreed limits needs fresh customer approval; if there is doubt about who is approving it, the business may need to verify the person again. Permissions should also expire or be easy to cancel. And businesses need records of both the instruction and the action. If a customer later says, ‘I never asked it to do that,’ a successful login is not a sufficient answer.”
– Henry Patishman, Executive Vice President of Identity Verification Solutions
This approach would allow agents to complete routine tasks within defined boundaries while leaving room for banks to require additional approval for actions that exceed initial limits. Depending on the risk, that approval could involve transaction confirmation or renewed identity verification, including document and biometric checks.
Managing these checks becomes easier when identity verification is part of a connected process rather than a series of isolated operations. Regula IDV Platform brings identity data and verification history together in a unified customer profile, while configurable workflows allow businesses to introduce additional checks when circumstances change or an action requires stronger assurance. This gives banks the flexibility to verify customers again when needed, without repeating the entire onboarding process.
