Bank of America has sent an email to its customers warning them not to share their online banking credentials with any AI‑driven assistant. The reminder comes as personal AI tools become more common in everyday tasks. Business owners should note the liability that remains with the account holder if an AI agent misuses those credentials.
What happened
In an email titled 'Protecting your finances in the AI World', the bank told customers that usernames and passwords must never be given to another person or an external service, including an AI‑enabled tool that claims to act on the user’s behalf. The message stresses that account agreements typically hold the customer responsible for any activity that results from shared credentials. A Bank of America spokesperson confirmed the authenticity of the email after it appeared on social media. The warning follows a broader industry discussion about how AI agents can be used to initiate payments or retrieve account data, and the challenges banks face in controlling unauthorised access. The email’s tone conveys clear frustration, noting that customers are increasingly handing over log‑ins as AI assistants grow popular. It warns that sharing credentials could trigger the bank’s fraud detection systems, potentially resulting in a temporary lock on the account.
Why it matters for businesses
The core issue is responsibility. If an AI assistant is granted access to a corporate banking login and then makes an unauthorised transaction, the bank’s policy places the loss on the business that supplied the credentials. This can expose small and mid‑sized companies to financial risk, especially when they rely on automation to streamline invoicing, cash‑flow monitoring or supplier payments. A security flaw in the AI service could also leak credentials to third parties, creating a vector for fraud. In the United States and the United Kingdom, regulators expect firms to demonstrate robust controls over third‑party access, and a breach caused by an AI tool could attract scrutiny from bodies such as the FCA or the OCC. In the Gulf region, where many firms use cloud‑based AI platforms, the same principle applies: the onus remains on the business to protect its banking details.
Beyond direct financial loss, a locked account can halt payroll, supplier payments and other cash‑flow processes, creating operational downtime that small businesses can ill‑afford. Maintaining separate, secure channels for banking reduces the chance that an AI‑driven error will interrupt core activities. For OpsKnot customers who already use custom CRM or AI agents to reduce manual work, the message is a reminder that convenience must be balanced with security. An AI‑driven sales assistant that can pull customer data from a CRM is useful, but it should never be given direct banking access without strict safeguards. The incident also highlights that banks are still working out how to integrate AI safely, meaning that policies may evolve quickly and businesses need to stay informed.
Practical steps
- Keep credentials private – Do not enter banking usernames or passwords into any AI chat window, voice assistant or third‑party automation tool.
- Use dedicated business banking portals – Access accounts through the bank’s official website or app, and enable role‑based access where possible.
- Review AI tool permissions – Audit any AI agents or integrations that can read or write financial data; revoke permissions that are not essential.
- Enable multi‑factor authentication (MFA) – Require a second verification step for every login, reducing the chance that a compromised password can be used alone.
- Set up real‑time alerts – Configure notifications for any transaction over a set threshold so that unusual activity is spotted immediately.
The bottom line
Bank of America’s warning underscores that the responsibility for secure banking remains with the account holder, even when AI assistants are involved. For small and mid‑sized businesses, the practical takeaway is to treat AI tools as helpers, not as custodians of banking credentials. By keeping passwords out of AI interfaces, using strong authentication, and monitoring activity closely, companies can enjoy the efficiency of automation without exposing themselves to unnecessary financial risk. Businesses should incorporate this guidance into their internal security policies and train staff to treat AI assistants as informational tools rather than transactional gateways.