US Banks Restrict Outside AI Agents Amid Checkout Rise

Major US banks block outside AI agents from customer accounts

CPO Magazine reported on October 29, 2026 that several large US banks are blocking or restricting third-party AI agents from accessing customer accounts because of security concerns. Citing an Axios investigation, the report says financial institutions increasingly struggle to tell whether an action comes from the customer or from an AI agent. CPO Magazine names Bank of America, JPMorgan Chase, Morgan Stanley and Wells Fargo as having blocked or restricted such access.

Over the same period, "agentic checkout," in which an AI agent completes a shopping payment for the user, has drawn attention. Both developments involve users handing operating authority to an AI agent, with a retailer on one side and a bank on the other.

Agentic checkout lets an AI agent complete the purchase flow

Commerce platform BigCommerce defines agentic checkout as an AI agent completing a purchase on behalf of a shopper. The work includes managing the cart, calculating shipping and tax, handling payment and confirming the order, without the shopper visiting the retailer's website. In the model BigCommerce describes, the retailer remains the merchant of record, processes the order and is responsible for fulfillment, returns, refunds and customer service.

BigCommerce divides the flow into five steps:

• Intent capture: the shopper states conditions such as budget, size and delivery date, and the agent turns them into searchable criteria.
• Product selection: the agent compares price, size, stock and delivery time.
• Checkout session: the agent connects to the retailer's system, the retailer calculates the final price, tax and shipping, and the process continues after the shopper confirms.
• Payment authorization: the agent does not handle the raw card number. It uses a one-time tokenized credential limited to a specific retailer and amount, or a signed mandate that records what the shopper authorized.
• Post-purchase handoff: after payment succeeds, the retailer confirms the order and takes over shipping and customer service.

The Raleigh News & Observer also ran an explainer on agentic checkout the same week, titled "What Is Agentic Checkout? How AI Agents Now Complete Your Online Purchases For You."

Customers handing over login credentials is where the banks' concern starts

CPO Magazine explains that no hacker broke into customer accounts in this case. AI agents gained access because customers gave their account login credentials to the agents to manage finances or complete certain tasks. Some AI tools also obtain credentials by scraping bank interfaces, and some banks block this practice to protect customer data.

The report says some AI agents may call customer service and take actions the customer did not request. Banks also worry that they cannot keep pace with the speed of AI development, and that risks arising in real time are hard to predict and handle. Chase separately advises customers not to give login credentials to third parties, including AI agents. Morgan Stanley says it has not observed rogue AI tools accessing customer financial accounts.

JPMorgan CEO Jamie Dimon said on the third-quarter earnings call on October 13, 2026: "We're not going to allow just any … outside agent to come in inside the company, because it's just too risky for clients and for JPMorgan." CNBC reports that a JPMorgan spokesperson confirmed the bank currently blocks outside AI agents from operating accounts on behalf of retail customers, and does not allow third parties to obtain customers' bank credentials and log in for them.

Banks take middle paths: read-only access, revised terms and in-house agents

CPO Magazine notes that most US banks also acknowledge customers will use AI tools in future, and have proposed middle paths:

• Some banks offer read-only access, letting AI agents view customer account data but not move funds.
• Some banks have revised their terms of service to bar customers from letting third-party AI tools access their financial accounts.
• Some banks are building in-house agents and considering secure channels so that AI agents can connect safely to bank platforms in future.

A JPMorgan spokesperson said the bank supports secure, customer-authorized data sharing through open banking providers and is working to enable agent connections safely. According to CNBC, if a connector such as Plaid holds the user's credentials, an AI agent can read data such as balances from a Chase account in read-only mode, but cannot send money or pay bills. The spokesperson also said there is currently no timeline for letting agents interact directly with customer accounts.

The report adds that existing finance tools such as Quicken and bank chatbots handle only preset tasks, which sets them apart from AI agents that act autonomously.

Approov and Dimon raise identity verification and risk warnings

Ted Miracco, CEO of Approov, told CPO Magazine that using shared credentials to let an agent impersonate a customer leaves banks unable to distinguish an authorized agent from an attacker using the same login. He argues that until agents have verifiable identity, limited permissions and audit trails, blocking is the banks' most defensible control.

On risk, Dimon said users who adopt an outside agent should understand the risks, and said it involves a "liability transfer." CNBC records this as his remark and does not explain how liability would be decided legally. CNBC also notes the dispute resembles JPMorgan's earlier move to charge data intermediaries such as Plaid, where banks' security concerns again met technology companies' need for access.

The use of AI agents is widening. This site previously covered Japan Digital Agency rolls out AI agents on GenNAI, reporting on enterprise agent applications; the US Congress inquiry into a Delaware proposal for AI agents to run companies discusses proposals on AI agents operating companies.

Directions Taiwan can draw on

The approaches taken by US banks and retailers offer several design directions to compare. The following is a reference compiled from the reports above and does not describe the current situation in Taiwan.

• Limited authorization scope: the tokenized payment BigCommerce describes restricts an agent's authority to a specific retailer and amount, so the agent never holds the full card number. This can serve as a reference for payment authorization design.
• Read-only data through open banking channels: JPMorgan supports customer-authorized data sharing through open banking providers, so tools can read balances without the user handing over a username and password.
• Agent identity and audit trails: the verifiable identity, limited permissions and audit trails Miracco describes can serve as a checklist if agents are later allowed to operate accounts.
• Explaining risk to consumers: Dimon advised users to understand the risks of adopting outside agents and mentioned a liability transfer. Financial institutions and platforms may consider stating this risk clearly on the authorization screen, along with the advice not to hand over login credentials. This is an editorial suggestion; legal liability and disclosure duties need separate confirmation.

Financial institutions, payment providers and e-commerce platforms in Taiwan planning AI agent services can build authorization scope, identity verification and risk disclosure into their design.