Episode 36
Block the Password, Not the Agent
I contend that banks are justified in blocking AI agents that log in with customer passwords, but the central imperative is to build a secure, bank‑managed way for agents to access accounts rather than to bar them outright. I outline that retailers and platforms have enabled agent access by default while major banks have reacted to fraud incidents and executive warnings by restricting or blocking outside agents. I emphasize that the real problem is customers surrendering credentials, since passwords cannot express limits such as spending caps, approved payees, or expirations. I propose five concrete actions: block direct password logins, open a read‑only access door for balances and transactions, provide customer‑issued permission slips with caps and revocation, make product and rate pages machine‑readable, and communicate clearly that passwords are never required for agents. I report survey evidence showing consumers want bank‑provided agents and human review of major decisions, which supports designing safe entry rather than imposing permanent exclusion. I urge banks to build the permissioned door now so they control the outcome instead of reacting later. Two stories unfolded within a day that reveal opposing instincts about artificial agents and money. I recount how Walmart introduced agent profiles that live inside a customer account, with spending caps, no access to card numbers, and default approval workflows that protect consumers and merchants. The very next day, leading banks moved in the opposite direction, restricting or blocking third‑party agents after reports of an agent resetting a password and transferring funds. I argue that the core problem is not an external intrusion but credential sharing: customers handing the single key their bank provided—their password—to an unvetted agent. A password cannot express limits, scopes, or expiry. I describe legal and commercial friction as well: Amazon’s litigation with Perplexity and a Ninth Circuit interim view that an agent acting at a customer’s direction is a tool, not a person. I summarize consumer research showing fear of handing over passwords but strong interest in bank‑provided agents that act with read‑only access and human review for major decisions. The account closes with the paradox banks face: the choice is to erect a wall now or build a secure door that channels agents safely into the account ecosystem.
Takeaways:
- I describe that major banks are blocking outside AI agents because of credential risks.
- I explain that most incidents involved customers giving their passwords to agents, not external hackers.
- I argue we should block password logins but allow read only access and permission slips for agents.
- I recommend banks make product and rate pages machine readable so models can parse offers before recommending.
- I state that customers want human review of major decisions and clear promises that banks will never need agent passwords.
Companies mentioned in this episode:
- Walmart
- Axios
- JPMorgan Chase
- Citi
- Bank of America
- Wells Fargo
- Morgan Stanley
- Charles Schwab
- Meta
- American Banker
- PNC
- CBS
- Expedia
- Shopify
- OpenAI
- Microsoft
- Perplexity
- Amazon
- Adobe
- American Bankers Association
- TD Bank
- Plaid
- Mint
- Aivo
- Mercury
- Huntington Bank
- Synovus
Transcript
Two stories broke a day apart last month.
Speaker A:On October 21, Walmart told AI shopping agents how to come in.
Speaker A:Every agent gets its own profile inside your account.
Speaker A:You set a spending limit, 50, 100, 200 bucks, or you approve every order.
Speaker A:The agent never sees your card.
Speaker A:On October 22, Axios reported that some of the biggest banks in the country were blocking AI agents from customer accounts.
Speaker A:Same week, same technology, opposite instincts.
Speaker A:Today.
Speaker A:Why the banks are half right and why the half they're missing is the half that matters to you.
Speaker A:This is banking on disruption, reported from the trenches, not the keynote stage.
Speaker A:I'm Fred Cadena.
Speaker A:This is a dispatch.
Speaker A:Just me, one idea.
Speaker A:About 10 minutes.
Speaker A:What actually happened?
Speaker A:Here's the scorecard.
Speaker A:JPMorgan Chase, Citi bank of America, Wells Fargo and Morgan Stanley are blocking or restricting outside agents.
Speaker A:Schwab is blocking them too, including Meta's Muse.
Speaker A:And the fear isn't made up.
Speaker A:American Banker reported that one large bank watched an agent reset a customer's password, change the approved transfer accounts and move $100,000 out.
Speaker A:The fraud team went to the CEO and said, Block everything.
Speaker A:Jamie Dimon said on JP Morgan's earnings call, they won't let just any outside agent in.
Speaker A:PNC's Bill Demchak called agents transacting inside accounts incredibly unsafe.
Speaker A:At Money20 20, he described the agent builders as kids in a room with a new toy.
Speaker A:But listen to what the reporter who broke the story told cbs.
Speaker A:In a lot of cases, it's customers giving their own username and password to an agent the bank hasn't vetted.
Speaker A:Not hackers, customers.
Speaker A:She did say they found some actions that looked unauthorized, like an agent calling the bank with a complaint without checking with the customer first.
Speaker A:So this is mostly not an intrusion problem.
Speaker A:It's a credential problem.
Speaker A:The customer handed over the only key the bank ever gave them, the password.
Speaker A:And a password can't say only this much.
Speaker A:Only to these people, only until Friday.
Speaker A:Everybody else built a door Retail.
Speaker A:The Walmart rules I just told you about.
Speaker A:Approval by default.
Speaker A:Agents never touch the card, and returns apply if the agent gets it wrong.
Speaker A:Travel Expedia is building a way for partners agents to plug straight into its inventory.
Speaker A:And it signed on with Muse E Commerce.
Speaker A:In March, Shopify switched agent selling on by default.
Speaker A:Millions of stores became shoppable.
Speaker A:Inside ChatGPT, Copilot and Google's AI mode.
Speaker A:No opt in required on by default.
Speaker A:Hold that phrase up against blocked by default.
Speaker A:The big holdout is Amazon.
Speaker A:It sued Perplexity to keep its shopping agent out In August, the 9th Circuit lifted the injunction and said that when an agent logs in on your instruction, you're the one accessing the site.
Speaker A:The agent is a tool, not a person.
Speaker A:That was Amazon, not a bank, and it's a preliminary ruling.
Speaker A:But think about what it does to a bank's terms of service.
Speaker A:Why did retail move Adobe's numbers visits to US retail sites from AI assistants were up 393% year over year in the first quarter, and by March, those shoppers bought at a 42% higher rate than shoppers from search, email or social a year earlier.
Speaker A:They converted worse.
Speaker A:My Read the shopper who arrives by way of an AI assistant is now a retailer's best prospect.
Speaker A:What Customers actually said the ABA released a morning consult survey this week.
Speaker A:The headline 77% of Americans are worried about letting an AI move their money.
Speaker A:Plenty of people read that as see customers agree with the block.
Speaker A:Read the rest 79% say they shouldn't have to give an AI their banking password.
Speaker A:80% Say the bank should be able to tell them apart from their agent.
Speaker A:76% Say banks should be able to require agents to prove they're secure and 19% say an agent has already asked them for their login.
Speaker A:That's not keep the agents out.
Speaker A:That's build us a safe way in and make it the bank's job.
Speaker A:TD bank found 69% would let a bank provided AI assistant do at least one task for them.
Speaker A:Top picks Tell me about better rates, keep me out of overdraft, pay my recurring bills and the number one thing that builds trust?
Speaker A:A human reviews the big decisions.
Speaker A:So the preference is simple.
Speaker A:Do it for me, but check with me first.
Speaker A:Hype or real time?
Speaker A:For hype or real claim 1 AI agents are going to drain your deposits overnight.
Speaker A:Hype for now, Muse connects to bank accounts through Plaid Read only balances, transactions, investments.
Speaker A:It can't move the money.
Speaker A:And in the aba survey, only 27% say they're likely to let an agent manage their balances in the next year.
Speaker A:Claim 2 Agents are already deciding who gets the next account.
Speaker A:Real American Banker covered a study from a firm called Aivo.
Speaker A:Researchers posed as small business owners in 2,160 conversations with ChatGPT, Gemini and Perplexity.
Speaker A:ChatGPT and Gemini recommended one fintech Mercury 383 times 30 traditional banks combined 299 banks show up at the start of the conversation on brand.
Speaker A:Then they lose the recommendation because the model can't work out what they actually offer.
Speaker A:Banks did win somewhere.
Speaker A:Credit JPMorgan Chase on small business.
Speaker A:Credit Huntington and Synovus on SBA loans.
Speaker A:So block the login all you want.
Speaker A:The agent is still reading the statement and it's still making the recommendation.
Speaker A:What I do Monday at a $5 billion bank or credit union?
Speaker A:5 Moves 1.
Speaker A:Block the password, not the agent.
Speaker A:Keep stopping.
Speaker A:Agents that log in as the customer publish the sanctioned way in.
Speaker A:2.
Speaker A:Open the read only door on purpose balances, transactions, rates, fees.
Speaker A:You already do this for aggregators.
Speaker A:3.
Speaker A:Give agents a permission slip, not a key, a credential the customer issues from inside their own login.
Speaker A:A cap, a payee list, an expiry revocable with one tap.
Speaker A:Walmart already built the retail version.
Speaker A:Big stuff still comes back to the customer to approve.
Speaker A:4.
Speaker A:Make your website readable by a machine.
Speaker A:Your product and rate pages, rates, fees.
Speaker A:Who qualifies how to open stated plainly and marked up so a model can read them.
Speaker A:If ChatGPT can't parse your rate page, you lose the deposit it before a human ever sees your name.
Speaker A:5.
Speaker A:Tell your customers out loud we will never need your password for an agent.
Speaker A:That's a fraud message and a trust message in one sentence.
Speaker A:And while you're at it, have a couple of people on your team actually use these agents.
Speaker A:Hook one up to a test account and see what it says about you.
Speaker A:Where does this leave us?
Speaker A:Banks have seen this movie a decade ago they blocked the screen scrapers, mint and plaid as fraud.
Speaker A:Then they signed API deals.
Speaker A:Block then deal.
Speaker A:The only choice is early or late.
Speaker A:One date to watch.
Speaker A:November 24th.
Speaker A:That's when Wells Fargo's new online access agreement takes effect and it writes AI agents into the contract.
Speaker A:Whatever your agent does is treated as you.
Speaker A:The agent is officially in the paperwork.
Speaker A:The question is whether anyone builds the permission slip to go with it.
Speaker A:If you're running a bank or credit union and you're building the door instead of the wall, I want to hear from you.
Speaker A:Find me on LinkedIn.
Speaker A:This has been banking on disruption.
Speaker A:Reported from the trenches.
Speaker A:See you next time.
