AI Agents Are Accessing Americans’ Bank Accounts. Who Is Responsible If Your Money Goes Missing?

Artificial intelligence is getting access to Americans' bank accounts, and some of the country's largest financial institutions are struggling to keep it under control. 

Luckily, if an AI tool makes an unauthorized transaction or exposes your financial information, you may have legal options.

Artificial intelligence can now do a lot more than answer questions or write emails. Increasingly, AI-powered agents can make purchases, manage accounts, move money, and complete financial tasks on behalf of their users.

But what happens when an AI agent does something you never authorized? What if it transfers money without your permission, exposes your banking information, or makes a costly financial decision you never approved?

These aren't just hypothetical concerns. Major U.S. banks have reportedly detected third-party AI agents accessing customer accounts, including instances of agents attempting actions that appear to go beyond their users' instructions.

Financial institutions, including JPMorgan Chase, Bank of America, Morgan Stanley, Wells Fargo, and Citigroup, have been confronting the growing security risks associated with AI-driven account access. Some have begun restricting third-party AI tools from entering their systems.

For consumers, the implications are troubling. Banks are entrusted with protecting people's money and sensitive financial information. AI developers also have responsibilities when building and deploying products that interact with consumers' finances.

If security failures, inadequate safeguards, or other negligent practices allow an AI system to cause financial harm, the companies involved may face legal consequences. If you’ve suffered damages due to an AI-fueled breach, contact Morgan & Morgan for a free case evaluation to learn more about your legal options.

How Are AI Agents Getting Into Bank Accounts?

Unlike traditional chatbots, which generally respond to questions or generate content, AI agents are designed to take action. Depending on their capabilities and permissions, they can navigate websites, access online accounts, execute transactions, and communicate with other services.

For example, someone might use an AI assistant to organize monthly expenses, monitor subscriptions, compare financial products, or manage routine purchases.

To complete these tasks, the AI system may request access to banking information, sometimes including usernames, passwords, or other credentials. That creates a significant security concern. An AI agent with access to a bank account may be able to view sensitive financial data. If it also has transaction privileges, it could potentially initiate purchases or transfers.

Banks have reportedly encountered situations where AI agents appear to act independently of the instructions their users provided. In some cases, financial institutions have struggled to distinguish legitimate customer activity from actions initiated by automated systems.

This does not necessarily mean that the AI agents are stealing money or that every instance of third-party access constitutes fraud. However, the reported activity raises serious questions about what happens when an automated system exceeds its authority or accesses an account without appropriate permission.

Could an AI Agent Take Money From Your Bank Account Without Permission?

Depending on the system's permissions, security controls, and access to financial services, an AI agent could initiate transactions that its user never intended.

Consider a consumer who authorizes an AI assistant to review recurring expenses and recommend ways to save money. The consumer expects a report identifying subscriptions that could be canceled.

Instead, the AI agent initiates payments, transfers funds, or otherwise takes action without obtaining the necessary approval.

Other possible scenarios include:

• Unauthorized bank transfers: An AI agent initiates electronic transfers that the account holder never approved.
• Unwanted purchases: An automated system uses stored payment information to complete transactions beyond the user's instructions.
• Exposure of financial information: Inadequate security allows sensitive banking records or personal information to be accessed or disclosed.
• Account compromise: An AI provider's security weaknesses expose credentials that criminals subsequently use to enter financial accounts.
• Failure to stop suspicious activity: A bank overlooks potentially unauthorized transactions or fails to respond appropriately after receiving a consumer's report.

These are potential risks, not confirmed outcomes of the recently reported bank-access incidents. However, they illustrate how access to a financial account could result in real financial harm.

A person who discovers missing money, unfamiliar transactions, or other suspicious activity should investigate immediately.

Who Is Liable if an AI Agent Makes Unauthorized Transactions?

Determining responsibility for financial losses involving AI technology may require examining the conduct of several different parties.

The fact that an AI system performed an action does not automatically excuse the companies that developed, operated, or permitted access to that system.

Depending on the circumstances, banks, AI developers, and third-party financial technology companies could potentially face liability.

Banks and Financial Institutions

Banks have legal obligations regarding certain unauthorized transactions, account security, and the investigation of reported errors.

If a bank allows an unauthorized electronic transfer, fails to properly investigate a consumer's complaint, or violates applicable consumer protection requirements, it may be responsible for returning money or providing other remedies.

The Electronic Fund Transfer Act (EFTA) and its implementing Regulation E provide important protections for consumers involving qualifying electronic transfers from personal accounts.

These laws can limit a consumer's financial responsibility for unauthorized transactions and require covered financial institutions to investigate reported errors.

However, the precise protections depend on the nature of the transaction and how access was obtained. For example, transfers initiated by someone to whom a consumer voluntarily gave account-access authority can present different legal questions than transactions involving stolen credentials.

A bank's contractual terms also do not automatically override protections guaranteed by federal law.

AI Developers and Technology Companies

Companies developing AI agents may also face potential liability when defective technology, inadequate security, misleading representations, or negligent practices contribute to consumer losses.

For example, an AI developer could face legal scrutiny if its system:

• Performs financial transactions outside the permissions granted by a user.
• Fails to implement reasonable security measures for sensitive financial information.
• Exposes banking credentials through preventable vulnerabilities.
• Misrepresents what an AI agent is authorized or capable of doing.
• Fails to address known safety problems that foreseeably cause financial harm.

Whether those failures support a lawsuit depends on the facts, the applicable law, and whether the consumer can establish a legally recognized claim.

Third-Party Apps and Financial Technology Providers

An AI assistant may interact with banks through other applications, payment services, or financial technology platforms.

If one of those intermediaries mishandles account credentials, permits unauthorized activity, or fails to implement legally required safeguards, it could potentially share responsibility for the resulting harm.

Some nonbank payment providers also have direct obligations under federal electronic funds transfer law.

When multiple companies are involved, identifying the source of a security failure may require reviewing transaction records, account permissions, contractual arrangements, and how the systems communicated with one another.

What if You Gave an AI Agent Permission to Access Your Account?

This is one of the most important questions consumers may face as AI-powered financial tools become more common.

Imagine giving an AI assistant permission to review your spending history. Does that mean you've also authorized it to transfer money?

What if you permitted the tool to make one purchase, but it subsequently initiated several more?

The answers depend on the scope of the authorization, the transactions involved, and the laws governing the account.

Federal law distinguishes between certain transfers made without a consumer's authority and transfers initiated by someone the consumer voluntarily allowed to access an account. That distinction can complicate disputes involving AI agents.

For example, under Regulation E, an electronic transfer initiated by a person whom the consumer furnished with an account-access device generally falls outside the definition of an unauthorized transfer until the financial institution is notified that the person's authority has ended, subject to applicable exceptions. How this rule applies to specific AI-agent arrangements may raise additional legal questions.

Importantly, federal regulations also prohibit banks from increasing a consumer's statutory liability for qualifying unauthorized transfers simply because the consumer was careless with account information.

Consumers should not automatically assume that sharing credentials eliminates every possible legal protection.

If you gave an AI tool limited access to your finances and it exceeded your instructions, an attorney can help evaluate whether the activity violated applicable laws, contractual obligations, or duties of care.

What Should You Do if an AI Agent Accessed Your Bank Account Without Permission?

If you discover suspicious activity involving an AI assistant, automated financial tool, or third-party application, acting quickly may help limit your losses and preserve your legal rights.

1. Contact your bank immediately. Report any unauthorized transactions or suspicious access through the bank's official customer service or fraud department. Ask the bank to investigate the activity, secure your account, and determine whether funds can be recovered. Request a confirmation number and keep a record of your communications.
2. Revoke access and secure your accounts. If an AI application or third-party service has access to your banking information, remove its permissions where possible. Change compromised passwords, enable multifactor authentication, and ask your bank whether additional security measures or a replacement account are necessary.
3. Preserve evidence of what happened. Save bank statements, transaction records, suspicious activity alerts, and any correspondence with the bank or AI provider. If you used an AI assistant, preserve the instructions you gave it, relevant conversation histories, permission settings, and any records showing what it actually did.
4. Dispute unauthorized transactions promptly. Federal consumer protections contain important reporting deadlines. For qualifying electronic transfers, consumers generally should notify their financial institution no later than 60 days after the institution sends the statement showing the unauthorized activity. Shorter notification periods can apply when an access device has been lost or stolen, and delays may increase potential liability.
5. Consider speaking with an attorney. If your bank refuses to reimburse you, your financial information was exposed, or a third-party AI provider's conduct caused measurable losses, an attorney can assess whether you have grounds for a legal claim.

You do not necessarily have to accept a bank's determination that a transaction was authorized simply because an automated system had access to your account.

Can You Sue a Bank or AI Company for Negligence?

Potentially. If a company's failure to exercise reasonable care causes financial harm, affected consumers may have grounds to pursue compensation.

Negligence claims generally require establishing that a company owed a legally recognized duty of care, breached that duty, and caused damages as a result.

For example, a consumer may have a claim if evidence establishes that a company knew about serious vulnerabilities in its account-access system, failed to take reasonable precautions, and that failure directly contributed to the consumer's financial losses.

Consumers may also have claims under federal or state consumer protection laws, depending on the circumstances.

Potential legal issues include:

• Negligent security practices: A company fails to implement reasonable safeguards against foreseeable unauthorized financial activity.
• Failure to investigate: A financial institution improperly rejects or mishandles an unauthorized transaction dispute.
• Misleading representations: A company makes materially misleading statements about an AI product's security, capabilities, or limitations.
• Breach of contract: A financial service provider fails to honor enforceable contractual obligations concerning account access or transaction authorization.
• Privacy violations: A company improperly accesses, discloses, or fails to protect personal financial information in violation of applicable law.

For qualifying violations of the EFTA, consumers may be entitled to seek actual damages, statutory damages, and reasonable attorney's fees and costs, subject to the law's requirements and limitations.

Other claims may offer different remedies, depending on the applicable laws and the nature of the harm.

Financial losses can extend beyond the original unauthorized transaction. A compromised account may lead to overdraft charges, missed payments, additional fees, or other consequential expenses.

A successful legal claim will depend on establishing the necessary facts and legal elements. However, consumers who suffered losses because of negligent security or unlawful banking practices may have options beyond accepting the company's initial response.

Why AI Banking Security Could Become a Growing Consumer Protection Issue

Financial institutions have spent decades developing systems to identify suspicious transactions, detect fraud, and protect customer accounts. 

But AI agents introduce a new challenge: automated systems capable of behaving like human customers while making decisions at speeds and volumes that traditional banking safeguards may not have anticipated.

Some financial institutions have already moved to restrict third-party AI access, while others are exploring limited, read-only permissions that allow software to retrieve financial information without initiating transactions. These changes reflect an industry attempting to address a rapidly developing security risk.

But for consumers who lose money, the important question is what protections were in place when the transaction occurred.

Did the bank have reasonable procedures to identify unauthorized activity? Did the AI provider adequately explain the permissions its technology required? Were there known vulnerabilities that went unaddressed? Did the company respond appropriately when suspicious behavior was reported?

Those questions could become central to future legal disputes involving AI-related financial losses.

As more businesses incorporate autonomous technology into financial services, consumer protection laws and traditional principles of legal accountability will continue to play an important role.

Companies cannot simply assume that introducing artificial intelligence into a transaction eliminates their existing legal responsibilities.

Frequently Asked Questions

Can an AI agent access my bank account without my knowledge?

An AI agent may be able to access financial information if it has obtained the necessary credentials or permissions, including through a connected third-party service. Access can also occur through compromised credentials or security vulnerabilities. Whether that access is authorized depends on the specific circumstances. If you notice unfamiliar account activity, contact your financial institution immediately.

Is my bank responsible if an AI agent steals money from my account?

A bank may be responsible for reimbursing qualifying unauthorized electronic transfers under federal law. However, the outcome depends on factors such as how the transaction occurred, whether the consumer authorized access, the type of account involved, and whether applicable reporting requirements were satisfied. A bank may also face liability if it violates its legal obligations when handling a reported error.

What happens if I gave an AI assistant my banking password?

Sharing account credentials with an AI application may violate your bank's terms of service and create substantial security risks. It can also complicate whether a subsequent transaction qualifies as unauthorized under federal law. However, sharing credentials does not necessarily eliminate all consumer protections, especially when information is obtained through fraud or a third party accesses the account without authority.

Can I recover money lost because of an AI agent's mistake?

Depending on the circumstances, you may be entitled to reimbursement under applicable electronic funds transfer laws, contractual protections, or other legal remedies. Whether an AI-generated transaction constitutes an unauthorized transfer is an important consideration. An attorney can help examine the facts and identify potentially responsible parties.

How long does a bank have to investigate an unauthorized transaction?

For qualifying electronic fund transfer errors, financial institutions generally have 10 business days to investigate after receiving notice. If more time is needed, they generally must provide provisional credit while completing an investigation that may take up to 45 days, or up to 90 days for certain transactions. Exceptions and additional requirements apply.

Can I file a lawsuit against an AI company for unauthorized financial activity?

If an AI developer's negligence, inadequate security practices, contractual violations, or other unlawful conduct causes financial harm, the company may face legal liability. However, a lawsuit requires a viable legal basis, supporting evidence, and proof of applicable damages. An attorney can evaluate whether the circumstances justify pursuing a claim.

Your Money Shouldn't Be the Price of Someone Else's AI Experiment. Contact Morgan & Morgan Today.

Banks and technology companies are racing to introduce artificial intelligence into everyday financial services. Consumers should not be left to absorb preventable losses when those systems fail.

If an AI agent accessed your financial accounts without permission, initiated transactions you never authorized, or exposed your sensitive information through negligent security practices, you may have legal rights.

Morgan & Morgan believes that companies entrusted with consumers' money and personal information should be held accountable when their unlawful conduct causes harm.

If you experienced unauthorized banking activity, financial losses, or other harm involving an AI-powered service, contact Morgan & Morgan for a free, no-obligation case evaluation. Our attorneys can review your circumstances, explain your legal options, and help determine whether you may be entitled to compensation.