Bank of America told customers they are responsible for activity if they hand an AI their password

A Bank of America email that circulated on social media this week tells customers that anyone who gives an AI-enabled tool or agent their banking username and password is “responsible for activity resulting from that access.” A Bank of America spokesperson confirmed to TechCrunch that the message is authentic. The bank’s online-banking service agreement, effective October 19, 2026, carries matching language about transactions performed by anyone a customer allows to use their credentials. The email went out under a subject line about protecting finances in the AI world.

Tech news in one quick read: Get the most interesting stories in startups, tech and programming, each with a short TLDR, in one daily email from TLDR.

Subscribe to TLDR →

We may earn a commission if you sign up.

An email whose origin the bank confirmed

The message first surfaced on Bluesky, where a user posted it, and TechCrunch reported on it October 27. Its core instruction is that a username and password should never be shared with another person or an outside service, a category it extends to any AI-enabled tool or agent that offers to act on a customer’s behalf. The warning about responsibility follows in the same passage. The bank’s spokesperson, in TechCrunch’s account, offered no comment beyond verifying that the email was real.

TechCrunch adds context from outside the bank: customers are increasingly giving login details to personal AI assistants, and the risks it lists include an assistant acting on accounts without the owner’s knowledge, a bank locking a customer out after mistaking the activity for an attack, and a security flaw in an assistant leaking credentials to hackers.

The email does not stand alone in the industry, according to TechCrunch, which says account agreements at most banks hold customers responsible for anyone to whom they give a login and links a U.S. Bank digital services agreement as an example. It also points to an Axios report from October 22 on banks grappling with unauthorized AI agents reaching customer accounts. TechCrunch’s account does not say when the Bank of America email was sent or how many customers received it.

What the service agreement puts in writing

Two sections of the Online Banking Service Agreement bear on the email. Section 9.A, “Protecting Passwords,” asks customers to keep a password “strictly confidential,” providing it only to “authorized signers” on the account. Section 8.B, on limitation of liability for online banking transactions, says that when a customer permits another person to use the User ID, password and related codes, the customer is responsible for “all transactions that person performs.” The same section says transactions initiated with fraudulent intent by the customer or someone acting with the customer count as authorized.

Neither section, as read, mentions artificial intelligence or automated agents. A separate clause governing the Zelle service says users may not authorize a third party to use that service or share credentials with one.

Section 8.B is written in terms of “another person,” The sections read for this report do not say whether an AI tool counts as one, and the email does not cite a specific clause.

The guarantee, and the federal floor beneath it

The bank’s online and mobile banking security guarantee page says customers are not liable for unauthorized transfers or bill payments made through those channels if reported promptly, and refers readers to the service agreement for full terms. The agreement supplies the clock: the customer has no liability for unauthorized transactions when the bank is notified within 60 days.

The Consumer Financial Protection Bureau’s Regulation E supplies the baseline for consumer electronic transfers. Its definition of an unauthorized electronic fund transfer excludes a transfer initiated “by a person who was furnished the access device to the consumer’s account by the consumer,” unless the consumer has told the institution that transfers by that person are no longer authorized. Separately, section 1005.6 caps a consumer’s liability at $50 when the institution is notified within two business days of learning of a loss or theft, at $500 after that, and leaves liability uncapped for unauthorized transfers made after the 60-day window closes. That window runs from the institution’s transmittal of the periodic statement on which the transfer appears, and the rule requires the consumer to report within it to avoid liability for later transfers.

Gaps that the documents leave open

Placed side by side, the email, the agreement and the federal rule describe the same dividing line from different angles, and none of them addresses an AI agent directly. Whether a bank would treat a transaction made by an assistant holding a customer’s credentials as one the customer “permitted” is a question the documents read for this report do not answer, and the spokesperson did not address it.

What the record does establish is narrower. The bank has put customers on written notice, in an email it acknowledges sending, that its warning about shared credentials names AI tools alongside other people and outside services. The service agreement dated October 19, 2026 already assigns responsibility for “all transactions that person performs,” and Regulation E’s exclusion for persons furnished an access device remains the federal reference point.

This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.

Tech news in one quick read: Subscribe to TLDR →

We may earn a commission if you sign up.