Can AI agents access your bank account? Chase and Schwab now say no

The Morse teamPublished October 30, 202610 min read

AI agents can access your bank account only if you give them a way in, and as of October 30, 2026, your bank may treat whatever an agent does there as your own act. Chase and Schwab now block outside AI agents that sign in with a customer's username and password. Chase also changed its online banking agreement, effective October 27, 2026, so that anything an outside AI does with your login counts as authorized by you, including mistakes. Approved connections, like a Plaid link or Schwab's own MCP server, still work, though Schwab says it won't let an outside AI move money through its servers.

We read the transcript of JPMorgan Chase's October 13, 2026 earnings call on its investor relations site, a transcript of Schwab's October 15 Fall Business Update, Chase's Digital Services Agreement, Schwab's Security Guarantee and third-party access terms, Bank of America's Online Banking Service Agreement, Regulation E with the CFPB's official interpretation, and the CFPB's open banking pages, all on October 30, 2026. Where a fact appears only in news coverage, we name the outlet and the day it reported. This isn't financial or legal advice. The banks deserve some credit: they put their rules in writing, in plain words, and Chase tells you exactly what to do if you've already shared a password.

What did JPMorgan and Schwab say about AI agents?

Both said they block agents that log in as you. On JPMorgan's October 13 call, Jamie Dimon said "you don't want rogue agents, and there could be thousands of them," and that "we're not going to allow just any outside agents to come in inside the company, because it's just too risky for clients and for JPMorgan." He added: "There's a liability transfer."

His CFO, Jeremy Barnum, was more specific. He said some services that offer money movement "do it through credential sharing," that "it's not secure," and that JPMorgan is blocking them. Then he spelled out who pays: "if they give up their credentials to the agent and the agent does something that they don't want, that's going to be on them." A JPMorgan spokesperson told Fortune, which reported it on October 15, that the bank supports "customer-authorized data sharing through open banking providers."

Two days later, Schwab's CEO, Rick Wurster, opened his AI remarks with "First, we are blocking unauthorized agents who try to log in on behalf of clients," according to a transcript of the October 15 call published by The Motley Fool. His second and third steps were Schwab's own assistant, Charley, and letting clients "use their LLMs to connect to our MCP servers." American Banker reported the same day that the block covers agents using client login credentials or browser automation.

At least one guide, The AI Career Lab's (updated October 22), describes Schwab's plan as read-only connections. Wurster described it differently on the call: "We do have clients that are trading through LLMs and APIs," and Schwab has "started a pilot for traders to safely and securely connect to our MCP layer via the LLM of their choice," beginning with Claude. The limit he named was money movement: "We do not allow them to move money because we think there is too much risk there to the client and to the firm."

Bank of America took the same line with its customers. TechCrunch reported on October 27 that the bank emailed them not to share their login with "an AI-enabled tool or agent that offers to act on your behalf," and warned: "If you do share your credentials, keep in mind that you're responsible for activity resulting from that access."

What each bank's agreement says if you give an agent your login

Each bank's own agreement already answers the liability question. This table sets the public statements beside the contract terms, as both read on October 30, 2026.

Chase's agreement says the October 27 changes "ratify your obligation to not share credentials," so Chase presents the rule as one customers already had. It names "External AI, automated tools, or data aggregators" as third parties barred from using your login, and defines a "Third-party AI Agent" as software that takes "autonomous, semi-autonomous, or non-autonomous action on behalf of, or at the instruction of" anyone, including you. If you let one in, you're deemed to "expressly authorize that third party to transact in your account," and Chase will treat its instructions "as if you personally took or gave those actions."

Who pays if an AI agent moves money you didn't want moved?

Under these agreements, the banks say you do, and Regulation E may not protect you. Regulation E caps what you owe for an "unauthorized electronic fund transfer" at $50 if you tell your bank within two business days of learning your access device was lost or stolen, and at $500 after that, with a 60-day window for transfers on your statement (12 CFR 1005.6). A transfer by an agent you handed your login to may not count as unauthorized at all.

The definition in 12 CFR 1005.2(m) excludes a transfer "by a person who was furnished the access device to the consumer's account by the consumer, unless the consumer has notified the financial institution that transfers by that person are no longer authorized." An access device is "a card, code, or other means of access," which covers a username and password. The CFPB's official interpretation, comment 2(m)-2, goes further: if you give someone an access device and they exceed the authority you gave, "the consumer is fully liable for the transfers" until you tell the bank.

The CFPB's examples are "a family member or co-worker." The rule doesn't mention software. Comment 2(m)-3 treats a device "obtained through fraud or robbery" as unauthorized, which leaves open what happens when a stranger's hidden text steers an agent you set up, the attack we explain in what prompt injection is. As of October 30, 2026, we found no CFPB guidance on either question. The banks' agreements already answer it their way.

Is connecting through Plaid or an approved API safer than sharing your password?

It's safer for your password, but the liability terms reach both routes. Chase permits "third-party applications and tools, including External AI, to access customer account data through approved application programming interfaces." The same section of its agreement says its list of consequences, including that you're responsible for unintended actions, applies equally to "any account data access you authorize through APIs."

Schwab's third-party access terms say much the same. By telling Schwab to let a provider in, "you are authorizing any and all actions that the Third Party Provider undertakes as a result," even ones "you did not anticipate," and "the Schwab Guarantee does not apply to their actions." Once the provider has your data, Schwab says, "we cannot retrieve it for you."

An API connection keeps your password out of the agent's hands, and lets you cut off one app without changing your login. Under both banks' terms, your data and your liability still travel with it. Our guide to whether Perplexity Comet is safe shows what agents have done with sessions they were trusted with.

Should you give ChatGPT, Muse, or another AI agent your bank login?

Not under these agreements, even when the agent never sees the password. The agent makers have built ways to keep the password itself from the model. OpenAI's ChatGPT agent help page, in the version we read on October 30, 2026, says that agent "is no longer available" and points to ChatGPT Work and its cloud browser. It describes the login flow: the agent pauses, you take over the virtual browser, and ChatGPT "doesn't capture passwords or sensitive data you manually enter." The same page adds that "cookies persist across sessions for convenience, just like a regular browser."

Meta's Muse announcement, dated September 8, 2026 and updated September 30, says Muse "can open a browser, fill out forms, and negotiate on their behalf," and that "any credentials a person shares with Muse go into secure storage, so Muse can use them without seeing them."

Both designs protect the password, and both leave the agent able to act while signed in. Chase's agreement treats what External AI does in that session as yours.

For a sense of what agents keep once they're signed in, our page on whether Manus AI is safe walks through one agent's saved sessions, passwords, and deletion steps.

What does the CFPB's open banking rule say about AI agents?

It covers data access, it's on hold, and it doesn't mention AI. The CFPB issued the personal financial data rights rule on October 22, 2024, effective January 17, 2025 (CFPB). It requires covered banks to share transactions, balances, and "information to initiate payment," such as an account and routing number that may be tokenized, and it says a bank "must not allow a third party to access the data provider's developer interface by using any credentials that a consumer uses" to sign in (12 CFR part 1033). The largest banks' first compliance date in the rule's text is April 1, 2026.

On August 22, 2025, the CFPB opened a reconsideration with an advance notice of proposed rulemaking, and as of October 30, 2026 its reconsideration page still lists only that notice. The law firm Cozen O'Connor reported on April 9, 2026 that a federal court in Kentucky has barred the CFPB from enforcing the rule while it reconsiders.

What to do if you already gave an AI agent your bank password

Do these in order:

1. Change the password. Chase's agreement says that if you've shared your login with any third party, "you must change those credentials."
2. Tell your bank the agent is no longer authorized. Regulation E's exclusion lasts until "the consumer has notified the financial institution," and Bank of America's agreement makes you responsible "until you notify us." Chase's agreement gives 877-242-7372 for this.
3. Sign the agent out and delete what it saved. OpenAI's help page says cookies persist in the agent's browser and tells you to "sign out of sites and remove cookies in your ChatGPT data control settings" (OpenAI). Meta says Muse keeps credentials you share in its own secure storage, so check there as well.
4. Cut off approved connections you no longer use. For Plaid links, Plaid says you can manage them in Plaid Portal (Plaid).
5. Read your next statements line by line. Regulation E gives you 60 days from the statement to report a transfer you didn't make (12 CFR 1005.6).

How to get help with money without handing over a login

Every risk above comes from software holding a session that can act in your account, under an agreement that says its actions are yours. Most of what people want from that software, like where the spending went, whether a bill looks high, or how to pay down a card, needs a few numbers, not a login.

On Morse, you ask in words. Type the figures the question needs and leave the account itself out of it. Your chat history is stored in your browser, encrypted, and locked when you sign out. Our servers don't keep messages or log what you write, and Morse doesn't train AI on your content, sell your data, or show ads. Pick a mode for each chat:

• E2EE, for balances, debts, and figures you'd rather no company read. Your browser checks the secure enclave's proof that it's genuine, then encrypts the message so only that enclave can open it, and Morse's servers relay ciphertext they can't read. The enclaves are run by third-party providers, not by Morse, and the guarantee depends on the enclave hardware and attestation working as designed. E2EE runs open-weight models with no web search, and comes with Pro at $19 a month. Here's how end-to-end encrypted AI chat works.
• Private, the default, for budgets and payoff plans. Open-weight models like DeepSeek, Kimi, and GLM, plus Grok, answer here. Morse has zero data retention agreements with its inference, search, and other providers, so they keep nothing; see what zero data retention means.
• Anonymous, to ask GPT, Claude, or Gemini about money without the provider knowing it's you. Our proxy removes your account, email, and IP address and sends the message under Morse's own account. The provider still sees what you write and may keep it for a limited time to check for abuse, under its own policy.

In any mode, round the numbers and leave out account numbers, routing numbers, and passwords, since no answer needs them. Clearing your browser or deleting your account deletes your chats, and Morse can't recover them, so copy any plan you want to keep. Our privacy policy has the details.

Ask your next money question from the Morse home page without an account, or start free with no card.