Banks Are Blocking AI Agents. Blocking Won’t Hold.
On October 13, Jamie Dimon told analysts that JPMorgan Chase would not let outside AI agents operate inside customer accounts. “You don’t want rogue agents,” he said. Charles Schwab, Citigroup and Morgan Stanley have since taken similar steps.
The banks are right to worry. When a customer hands banking credentials to third-party software, the bank can no longer tell the difference between the customer, an agent acting faithfully for the customer, and a fraudster who has compromised that agent. To the bank’s systems, all three look like the same authenticated login. That is account takeover risk at machine scale.
But blocking buys time. It doesn’t solve the problem. Consumers already expect software to help manage their money, the same way they came to expect mobile banking and automated bill pay, and Meta, OpenAI and others are now shipping agents built to do exactly that. Institutions that simply say no will watch their customers’ agents route around them.
The question that matters is how to let legitimate agents in while keeping everything else out.
Deposits Will Start Moving on Their Own
Imagine a customer authorizing an agent to watch savings rates. When a better offer appears, the agent weighs the account requirements and switching costs, then moves the money. Apollo’s chief economist, Torsten Slok, has warned that agents could shift funds from checking accounts averaging 0.1% into accounts paying 3.3% to 5%. For banks that have long relied on customer inertia, that is a structural threat.
The next step is agents negotiating with other agents. Rather than moving funds immediately, a customer’s agent might ask the existing bank to match a competing rate, while the bank’s own agent calculates what keeping that deposit is worth. The same pattern will reach travel, where a traveler’s agent negotiates fares, upgrades and loyalty benefits directly with an airline’s agent.
In every one of these exchanges, each side needs proof that the agent across the table is real, represents who it claims to represent, and is allowed to make the commitment it is making. Without that proof, agent-to-agent commerce becomes an open door for fraud.
Authentication Is Not Authorization
Most digital security answers one question. Is this the right person logging in? Agents break that model. A customer might allow an agent to check balances and compare products without ever allowing it to transfer funds, open credit, or share data with third parties.
An agent retrieving a savings balance presents a different risk from one initiating a $50,000 transfer. An agent recommending a product is different from one accepting contract terms on the customer’s behalf. Treating these as equivalent because they arrive through an authenticated session is how losses happen.
Dimon framed the accountability question bluntly, warning that customers who let agents into their accounts need to understand the “liability transfer” they are accepting. That is fair today, but it can’t be the end state. Banks, merchants, and customers all need to know who authorized what before a transaction executes, not after a dispute.
Know Your Actor
This is the thinking behind what we call Know Your Actor. Identity verification has always asked who the customer is. In an agentic economy, organizations also need to know which actor, human or not, is taking an action, whom it represents, what authority it has been delegated, and whether its behavior matches that authority.
Verification also can’t end at the first connection. Permissions get revoked. Agents get compromised. The model or the company behind an agent changes. A customer who let an agent move up to $1,000 between their own accounts last month may have withdrawn that permission this morning. Trust has to be evaluated continuously, every time an agent reads data, negotiates terms, or moves money.
Not every interaction deserves the same scrutiny. Checking a balance should be nearly frictionless. Moving a large sum to a new payee should require stronger proof, explicit customer confirmation, or both. Proportionate checks are what make legitimate automation possible without handing fraudsters a new channel. Our Know Your Agent product at Microblink is built on this framework.
From Blocking to Verifying
The industry is already moving. JPMorgan says it supports customer-authorized data sharing through secure open banking connections, not shared logins. Meta says it is developing a protocol to signal when a personal agent is acting for a customer. These are early signs of a shift from blocking agents to verifying them.
The banks that build that capability first will keep, and win, the deposits that agents move. The ones that rely on blocking will find the wall gets thinner every quarter.
