AI Agents are logging into customers’ bank accounts. What should the Bank do?

When a customer asks an AI assistant to sort out a utility bill, the assistant needs to get into the banking app. So, the customer provides it with their username and password. From the bank’s vantage point, that login looks like any other.

According to Axios, reported on 22 October, this is already happening at major US banks. They are detecting third-party AI agents inside customer accounts, usually logged in with the customer’s own credentials. Some agents seemed to have contacted call centers, others appeared
to take steps the customer had not asked for. Even if the customer had given permission, under the guidelines of most banks, customers must log in to their own accounts, so an agent breaks the rules even when the customer has allowed it.

The response so far is cautious. One major bank has begun blocking outside agents, and three others are restricting them. In reality, many banks cannot tell whether an agent’s activity is directed by the customer, and one executive said they struggle to tell an authorized agent from
one that has gone rogue. The same report says most banks have authorized, or are moving towards, read-only access, where an agent can see account information but cannot move money. The bank that is blocking agents said it has not observed any rogue ones.

What RBI’s rules say about customer credentials

The reporting is from the US, and nothing in it says the same is happening in India. The question still applies, because Indian regulations are built around the customer’s own credentials. RBI’s authentication directions, which applied from 1 April 2026, define a factor of authentication as a
credential of the customer. Domestic digital payments need two of them, with listed exceptions, and the issuer must compensate the customer in full for losses on transctions that did not follow the directions.

From 1 January 2027, RBI’s fraud-protection directions add more. They give handing over credentials to another person for carrying out transactions as an example of customer negligence. They put the burden of proving a customer’s liability on the bank. They set a ceiling of 45 days
to resolve a complaint about domestic fraud, and they require instant SMS alerts on electronic banking transactions above ₹500, with details that include the channel used.

Neither document mentioned software agents. A customer who hands an agent their login and later disputes a transaction creates a case these rules do not settle. The bank would need to show who acted, under what permission, and when, and it would have 45 days to do it. That is an
evidence problem before it is a legal one.

What banks already know about delegating authority

Banks have handled delegated authority for a long time. A business customer decides who can create a payment, who can approve it and up to what limit, and the bank keeps a record of each step. NPCI’s UPI Circle applies the same idea to individuals. A user can authorize another person
to pay from their account within a monthly limit of up to ₹15,000, for a period the user sets.

An AI agent is a new kind of actor in an old arrangement. The question is whether it can be given the same treatment, with its own permission, its own limit, and a trail that shows what it did. A shared password gives it none of those.  

What a bank can decide now
 

The first decision is the bank’s own position. It can block agents, allow them to only read, or offer a route for them to act within limits. Whichever it chooses, the customer terms should say so in plain words.

The second is where agents come in. If the only way in is the customer’s own login, the bank cannot separate the agent from the customer. A route built into the bank’s own channels, with its own permissions, makes the agent visible. RBI’s authentication directions already allow banks to
run additional checks based on device attributes and user behaviors, which gives a bank signals to work with.

The third is the record. With the burden of proof on the bank and a 45-day clock, a bank that can show which actor did what, and under whose permission, is in a better position than one that cannot.

Clayfin’s corporate banking platform already carries these controls for business customers, with multi-level approval workflows, role-based access and flexible maker-checker workflows for SMEs. Those controls answer three questions for business customers: who can act, who must approve, and what gets recorded. An AI agent acting for a customer raises the same questions, and a bank that has settled them for business customers has a head start.