Who's Really on the Line? Banks Say Outside AI Agents Are Showing Up in Customer Accounts, and What That Raises for Servicing and Collections Teams

Matt Lippl, Chief Product Officer, PayPath | Reviewed by Matt Lippl

Last reviewed: Nov 3, 2026

Updated Tuesday, Nov 3, 2026, CT: Wells Fargo has posted an updated Online Access Agreement, marked "Version Effective November 24, 2026," with a section on third-party AI agents. That's a bank's customer agreement. None of the sources we read describe a new law or regulation on the subject. We'll update this line if that changes.

The short version. Axios reported Oct 22, citing unnamed sources, that major U.S. banks are detecting third-party AI agents inside customer accounts, some taking actions "that appear to be independent of user instructions." CNBC reported Oct 13 that JPMorgan Chase CEO Jamie Dimon said the bank won't let outside agents in "because it's just too risky for clients and for JPMorgan." White House AI czar David Sacks said most of the activity described appears to be customers sharing credentials with agents, and that "these are in no way cyberattacks." Morgan Stanley's spokesperson said the bank hasn't observed "rogue AI agents accessing our platforms." Wells Fargo's updated agreement says instructions from an AI agent a customer authorizes "are deemed to have been initiated and authorized directly by you, without further verification." It also says customers "must retain evidence" when they revoke an agent's authorization.

Who this is for

Operations, servicing, and collections leads at banks, credit unions, lenders, and agencies, plus the compliance and product people who work with them. It reports what was said and lists questions. It doesn't say how any law applies to a particular program; teams often review that with their own compliance team or counsel.

A borrower's assistant calls to ask about a payment arrangement. The borrower didn't dial, didn't mention it was coming, and may not remember turning the thing on. The rep has about four seconds to decide what they're hearing.

The last three weeks of banking news point toward that scenario, though the reporting is mostly about logins, not phone calls. Here's what was said, and by whom.

Two kinds of agents

"Agent" covers two different things in these stories.

Consumer-run agents. A person gives an AI assistant their credentials or permission and asks it to do things: check balances, move money, call a company. Meta's Muse and Instinct come up in the coverage. Our Agentic AI entry shows how regulators and standards bodies define the term, and they don't all agree.

Institution-run agents. A bank, lender, or collector deploys AI agents to place or answer calls, texts, and emails with its customers. PayPath provides AI agents and a platform to orchestrate calls, texts, and emails for banks, credit unions, collectors, and other businesses. Those agents pause and bring in a person when they don't know how to complete an action or need clarification or confirmation, instead of guessing. (More in our Human-in-the-Loop entry.)

Almost everything below concerns the first kind.

What the banks said, on the record

JPMorgan Chase, Oct 13. On its third-quarter earnings call, Dimon said: "We're not going to allow just any ... outside agent to come in inside the company, because it's just too risky for clients and for JPMorgan." He added: "You don't want rogue agents, and it could be thousands of them." A JPMorgan spokeswoman told CNBC: "Because it is not safe, we do not permit third parties to access accounts by obtaining customers' banking credentials and logging in on their behalf." CNBC reported that agents can see some Chase data read-only, such as balances, through a connector like Plaid, "But they can't send money or pay a bill," with no timeline for changing that. (CNBC)

Dimon also spoke about responsibility. CNBC quotes him: "If people are using them, they should understand the risk," and "They should understand there's a liability transfer." We're reporting that without characterizing it. A Chase spokesperson told CBS News: "Customers should not give their username and passwords to anyone." (CBS News)

Schwab. Bloomberg reported Oct 16 that Schwab CEO Rick Wurster, in a Bloomberg Television interview, said Schwab is blocking unauthorized AI agents, including Meta's Muse. Wurster said he gets a weekly report on how many times clients have been blocked from using one of these agents, and that the big agents are being blocked "in the tens and twenties" per week. He also said: "We're not going to allow them to move money, but if they want to come in and see their account balances and do research, they will be able to do that through their LLMs." We read Bloomberg's text as republished by Moneycontrol. (Bloomberg text via Moneycontrol)

Citi. A Citi spokesperson wrote to USA TODAY: "We do not permit third-party AI agents or assistants to log into a customer's account or transact directly within our digital banking platforms." PYMNTS attributes a similar description of Citi to the Financial Times. (USA TODAY)

Bank of America. PYMNTS, citing the Financial Times, wrote that Bank of America is "limiting agents' access to consumer deposits while it writes protocols that decide which party is liable for a payment an AI authorizes." We couldn't open the FT article, which is paywalled, so that description rests on PYMNTS. Retail Banker International and The Paypers give similar summaries of the FT report. On the record, CEO Brian Moynihan told CNBC: "We strongly believe there should be a human in the loop to authorize money moving out of your account." (PYMNTS; CNBC Investing Club)

Morgan Stanley. Axios reported that "A Morgan Stanley spokesperson said the bank hasn't observed instances of 'rogue AI agents accessing our platforms.'" CBS News reported that a spokesperson said the bank had not observed any unauthorized AI agent activity across its platforms. Axios separately reported, citing unnamed sources, that Morgan Stanley "has begun blocking third-party agents from accessing its platforms." We're reporting both as written. Bank of America and Wells Fargo "did not immediately respond" to CBS. Wells Fargo's updated agreement terms are covered in the next section.

What Wells Fargo's updated agreement says

Wells Fargo has posted a version of its Online Access Agreement marked "Version Effective November 24, 2026." Its opening list of what the agreement covers includes "Your responsibilities for artificial intelligence agents, if and when we permit the use of such agents." The version currently posted as in effect, marked "Version Effective May 21, 2026," doesn't mention AI agents. AccountsRecovery.net reported the change Nov 3. (Wells Fargo; AccountsRecovery.net)

The terms are in Section 15, "Third-Party Artificial Intelligence Agents or Agentic AI." Here's what it says, part by part. All quotes are from the Nov 24 version.

What counts as an agent, 15(a). "'AI Agent' means any software, application, program, or other technology that takes autonomous, semi-autonomous, or non-autonomous action on behalf of any person or entity."

Authorization, 15(d). The subsection opens "Unless otherwise provided by law or regulation." It applies "if you provide an AI Agent with access to the Service or any Eligible Account using your login credentials, or otherwise authorize an AI Agent to act on your behalf." In that case, the customer agrees that "Any instructions, actions, or transactions initiated by the AI Agent are deemed to have been initiated and authorized directly by you, without further verification, and we have no obligation to investigate the validity or scope of such authority."

Responsibility, 15(e). "Your use of any AI Agent is AT YOUR OWN RISK." The customer is "solely responsible for" a list that ends with an item marked "(Unless otherwise provided by law or regulation)," covering, among other things, "unintended actions performed by the AI Agent" and "the AI Agent exceeding the authority granted by you." The subsection also says: "You acknowledge that we do not monitor, screen, or review AI Agent activities, including any transactions initiated by an AI Agent."

Revocation, 15(f). "You must retain evidence of such revocation and must provide such evidence to us, at our request. Until you notify us of such revocation pursuant to Section 17(d), you remain responsible for all the AI Agent's activities, to the extent permitted by law or regulation."

Registration and blocking, 15(g). Wells Fargo reserves the right to change its requirements for agents, "including requiring that you register your AI Agents with us," and to "Limit, prohibit, prevent, suspend, or terminate access by any AI Agent to the Service or any Eligible Account, including by restricting certain actions by AI Agents."

The law-or-regulation qualifiers. Three places in Section 15 carry them: the opening of 15(d), one item in 15(e), and the last sentence of 15(f), "to the extent permitted by law or regulation." Section 15 doesn't name a specific law or regulation. This post doesn't address which ones those phrases refer to or how they would apply to any transaction.

What Axios reported, from unnamed sources

Axios's Madison Mills wrote Oct 22 that the usual case is when "an agent or AI assistant accesses a human's account with the user's permission and login credentials," which "goes against the guidelines of most banks requiring that humans log in to their own accounts." In other cases, "some banks have tracked activity when agents ... contact call centers or appear to take actions independent of user instructions."

Two lines read as operational. "Many banks are broadly not able to parse whether agent account activity is user-directed, sources said." And: "One bank executive told Axios they struggle to differentiate between agents, as well as whether an agent has been authorized by a user or has gone rogue and gained access to a customer account." Axios also said "Most banks have authorized or are moving in the direction of allowing read-only access." (Axios)

Mills told CBS that "in other cases, in our reporting, we did find evidence that appeared to look like agents taking actions in customer accounts that were not authorized." CBS gave one example: "the AI calling a bank with a complaint without first consulting the account holder." It also reported Mills saying the agents "weren't going rogue or hacking customer accounts."

The counterpoint

Sacks, in a post on X reported by CBS, said: "There's a world of difference between user-authorized agents (Muse, Instinct, Grokbot, etc.) and true unauthorized/rogue agents that could constitute cyberattacks." He said most of the activity in the Axios story "appears to be the former: customers sharing credentials with agents so they can take actions on their behalf," and: "This may violate bank terms requiring humans to log in themselves, but these are in no way cyberattacks." On access, CBS says he suggested banks could grant "read-only" permission, adding: "Full write access (with user credentials) is a different risk category and should be approached carefully."

Open questions for servicing and collections teams

The reporting doesn't say agents are calling collections lines at scale. Axios mentions call centers, and CBS gives one example. The questions below are what that raises. Teams often take them to compliance or counsel.

How would a rep or a voice agent recognize that a caller is software?

Voice, timing, scripted phrasing, one call-back number across a dozen accounts. Is there a step for it, or is it a judgment call?

What does authentication do with "I'm calling on behalf of the account holder"?

Many programs already have a path for authorized third parties. Does it cover an assistant the customer set up themselves, and who verifies with the customer?

How is the contact recorded?

As the consumer, a third party, or something else? Does the account note say which, and keep the words used?

What happens when an agent asks to stop contact, dispute a balance, or move a payment date?

Does intake record who made the request and on whose behalf, and does anyone confirm it with the consumer? How those requests are treated is for the team's policies and counsel; the open question is whether the record is clear enough to ask them.

What does the institution's own outbound agent do if it reaches someone else's assistant?

Pause and bring in a person, keep going, or end the call, and who configured that?

How would a team tell agent activity from customer activity?

Wells Fargo's terms treat an authorized agent's instructions as the customer's own, and say the bank does "not monitor, screen, or review AI Agent activities." Axios's sources said many banks "are broadly not able to parse whether agent account activity is user-directed." When a payment, a promise to pay, or a message reaches a servicer or collector, what in the record would show whether the consumer or an agent sent it, and does anyone downstream see that?

What might revocation "evidence" look like?

Section 15(f) says customers "must retain evidence of such revocation" and provide it "at our request," but Section 15 doesn't describe what that evidence is. A dated notice to the agent's provider, a confirmation screen, a record of the call to the bank? If a consumer tells a servicer or collector that an agent acted after they turned it off, what would anyone on that call be able to see, and where would it be noted?

If agents are registered, does that show up anywhere else?

Section 15(g) reserves the right to require that customers "register your AI Agents" and to block agents or restrict "certain actions." Would a registration, or a block, be visible to anyone outside the bank, such as a servicer, a collector, or the institution's own agent on the other end of a call?

Questions for AI agents and automation

This part is about systems, not law.

Is there an escalation path for "I'm not sure who this is"?

At PayPath, agents bring in a person when they need clarification or confirmation, escalations go to a dedicated Inbox, and a co-pilot agent reaches the escalation contact in their preferred medium, such as a push notification or text message.

What's the read-only analogue?

Axios and Sacks both describe read-only access as a middle ground. Is there an equivalent in servicing: an outside agent can ask for a balance but can't change a payment arrangement without a person?