Is AI Trying to Access Your Money? Banks Are Worried

An AI assistant checking your bank balance or organising your expenses sounds convenient. Now imagine that the same AI starts attempting transactions you never asked it to make. That is the problem reportedly confronting some of America’s biggest banks.

According to an October 22 report by Axios, major US banks have detected unauthorised third-party AI agents operating inside customer accounts. Sources told Axios that some agents appeared to attempt actions independent of user instructions. Morgan Stanley, JPMorgan Chase, Bank of America and other institutions are restricting access as they try to contain the risk.

The report does not establish that these banks have suffered widespread financial losses from rogue AI agents. But it reveals a problem that financial institutions are struggling to resolve: how do you distinguish an AI acting with a customer’s permission from one operating beyond it?

The Important Distinction

For most of the current generation of AI tools, the user still makes the final decision. You ask a chatbot a question, receive an answer and decide what to do next. An AI agent changes that relationship. You give it a task, and it can work through multiple steps, browse websites, interact with connected services and attempt to complete the job on your behalf. That is what makes agents useful. It is also what makes them complicated to secure.

Consider a customer who shares their banking credentials with an AI assistant to track spending. The agent may have access to more than the customer intended. If it can initiate purchases or move money, the consequences of a mistake become much more serious. Axios reported that banks are finding it difficult to distinguish between human users and AI agents, or establish whether an agent accessing an account has been properly authorised.

Some banks are therefore moving towards read-only access, allowing agents to examine financial information without initiating transactions.

This is not necessarily a case of AI developing independent intentions. An agent can exceed its instructions because of a software flaw, a misinterpretation of a task or manipulation by malicious content. The problem is that the resulting action can still have real-world consequences.

Who Is Responsible When An Agent Goes Wrong?

The difficulty is not limited to detecting suspicious activity. It extends to determining responsibility.
Suppose you ask an agent to pay an electricity bill. Instead, it attempts to transfer money to another account. Was the transaction authorised because you gave the agent access to your bank account? Or did the agent exceed the permission you granted? These are two different questions.

A valid login does not automatically mean every subsequent action is authorised. Similarly, permission to read an account should not automatically imply permission to transfer funds.
Banks have traditionally built their security systems around customers, credentials and transactions. AI agents introduce another layer: software that can operate through those credentials and make decisions across several steps.

The response cannot simply be to block every AI agent. Customers will increasingly expect these tools to manage routine tasks. But allowing agents unrestricted access creates risks that banks cannot ignore. The challenge is to establish boundaries around what an agent can do, how those permissions are verified and how quickly access can be revoked when something goes wrong.

Why This Matters For India

India’s digital financial ecosystem makes this question particularly relevant. UPI, mobile banking, digital lending and online payments have made financial services accessible through a phone. An AI agent could eventually be asked to pay bills, renew insurance, book tickets or manage routine expenses. The convenience is obvious. So is the potential risk if an agent acts beyond its instructions.

India already has banking cybersecurity requirements and a framework for addressing unauthorised electronic transactions, and later NCPI also put UPI’s AI protocol on hold. But the emergence of AI agents raises additional questions about how consent, authentication and responsibility should work when software acts on behalf of a customer.

There is also a wider cybersecurity concern. On October 15, CERT-In issued an advisory describing incidents in which AI agents exceeded their assigned authorisation and accessed live systems belonging to Indian organisations. The agency said some incidents involved exposed credentials and excessive permissions. These were not necessarily banking incidents, but they demonstrate that agent-related security risks are already relevant to India.
The policy challenge is therefore not hypothetical. Existing weaknesses in digital infrastructure can become more consequential when automated systems are capable of discovering and exploiting them at speed.

What Should The Safeguards Look Like?

An AI agent should not receive one blanket permission to access everything. There should be a clear difference between reading financial information, preparing a payment and actually transferring money. Banks could use separate agent identities, restricted permissions, transaction limits, approval requirements for high-risk actions and detailed records of what an agent attempted. Customers should also be able to revoke access quickly.
For India, the question is how existing banking and cybersecurity frameworks can accommodate these new capabilities, including who is responsible when an agent exceeds its authority.

AI agents may eventually make digital services significantly easier to use. But convenience cannot come at the cost of losing control over our own money. The real question is no longer simply whether we trust AI to give us the right answer. It is whether we can trust it to act on our behalf and whether the systems around it can stop it when it goes too far.