- Please visit our social media pages
You wouldn’t hand a stranger the keys to your house, leave them a to-do list and go out for the day. But that is more or less what some people are now doing with their bank accounts.
The apps in question are known as AI “agents”. Unlike a chatbot, which simply answers questions, an agent carries out tasks. Tell it to pay the electricity bill or move €200 into savings and it will log in, find the right screens and do it, without you checking each step. To do that with your bank, it needs your username and password. In one US survey, a fifth of people said an AI app had already asked them for their login details or card numbers.
It has not always gone well. In October several large American banks found these agents working inside customer accounts. They hadn’t broken in. The customers had given them the password. One bank watched an agent reset a customer’s password, log in and change the list of accounts that money could be sent to, none of which the customer had asked for. Agents can also be fooled by instructions hidden in a scam email or website.
Banks are now putting the blame on customers
JPMorgan Chase, Bank of America, Citi and Morgan Stanley have blocked or restricted outside AI agents. According to The Telegraph, HSBC, Barclays, Lloyds, NatWest and Nationwide are doing the same in the UK.
Wells Fargo has gone further. From 24 November, anything an AI agent does with a customer’s login will be treated as if the customer did it, including mistakes and things the customer never intended. Anyone who switches an agent off has to keep proof that they did so. JPMorgan’s chief executive, Jamie Dimon, has described this as a “liability transfer”. It is a polite way of saying the risk is now yours.
So far these reports have come from the US. We haven’t seen cases in Spain yet, but the same apps are available here to anyone with a smartphone.
Spanish law hasn’t caught up
In Spain and across the EU, the rules on unauthorised payments are good. If money leaves your account without your consent, the bank normally has to refund you quickly, and you lose no more than €50 unless the bank can show you were grossly negligent.
But those rules were written with thieves and fraudsters in mind, not software that you invited in yourself. If an app you chose moves your money, was that payment really unauthorised? Lawyers can’t agree. An Italian lawyer quoted in La Repubblica recently said nothing obliges a bank to refund you in that situation. Others think the bank would still have to prove negligence. Almost every bank contract forbids sharing your password, and a bank could easily point to that.
No one can tell you for certain that you would get your money back.
The Microsoft outage on 12 and 13 November, which disrupted banks, hospitals and courts in 74 countries, had nothing to do with AI. Microsoft says it was a technical fault. Still, it was a reminder of how much of our banking depends on a handful of technology companies. The difference is that an outage only stops you getting at your money for a while. An AI agent with your password can actually move it.
A few practical points:
Don’t give your online banking password, or the codes your bank texts you, to any app, chatbot or website other than your bank’s own.
If you want a budgeting app to see your accounts, connect it through your bank’s official link (open banking), and choose read-only access if it is offered.
If you have already given an AI tool your login details, change your password and look through your recent payments and saved payees.
If a payment you don’t recognise appears, ring the bank at once, then put it in writing and keep a copy. If they won’t refund you, you can complain to the Banco de España.
Keep a card from a second bank, or a bit of cash, for the days when your bank’s systems go down.
These tools may well become safe and useful in time. For now, your password is the key to your money, and the banks are making it clear that whoever holds the key will be held responsible.
