Picture the case the reporter who broke the story described: a customer in the United States hands an AI agent the username and password to their bank account and asks it to check a balance. That, she said, is most of what happened. "In a lot of cases, this is just going to be customers giving their username or password" to an agent the bank has never vetted, Axios reporter Madison Mills told CBS News on October 23. The agents were not hacking accounts or draining funds, she said. They were largely following instructions.

The story Axios published on October 22 went further. Citing people familiar with the matter, it reported that Morgan Stanley had begun blocking third-party agents, that JPMorgan, Bank of America and Citi were restricting them, and that some banks had tracked agents contacting call centers or taking steps that "appear to be independent of user instructions." Unnamed executives called it "horrifying." Those incident claims are anonymous, and the one bank asked on the record pushed back: a Morgan Stanley spokesperson told Axios it had not observed "rogue AI agents" on its platforms.

The White House AI adviser wrote on X, as quoted by CBS, that this "may violate bank terms requiring humans to log in themselves, but these are in no way cyberattacks." Tom's Hardware ran the story under a headline about agents "attempting to make transactions." Decrypt led with "horrified." The line everyone is repeating is that banks are blocking AI agents.

The agent did not break in. It was handed a password because nobody had anything else to hand it.

What the banks said, in their own words

Now read what the chief executives said on the record.

JPMorgan's Jamie Dimon, on the bank's third-quarter call on October 13, per Banking Dive: "There's a liability transfer. They should understand the liability transfer." The bank would not "allow just any outside agent to come in inside the company." A Chase spokesperson told CBS that customers "should not give their username and passwords to anyone," and that the bank supports "secure, customer-authorized data sharing through open banking providers."

Charles Schwab's Rick Wurster, on October 15, per American Banker, said the firm would not allow an agent "trying to log in on behalf of a client." PYMNTS put the blocks at a double-digit number each week. PNC's William Demchak, the same day, called agents transacting for customers "incredibly unsafe" and said: "For that to ultimately take place, there's going to have to be laws passed on liability shifting."

None of those is an objection to agents. Each is an objection to a credential: a customer's password in the hands of software the bank cannot see, under a liability regime nobody has rewritten. Given that credential, blocking is the right call. My argument is about the credential.

A password says who you are. A mandate says what you may do.

A password carries one fact: the person presenting it knows the secret. It carries no amount, no counterparty, no expiry and no scope. When an agent logs in with it, the bank sees a session that looks exactly like you. It cannot tell your agent from a stranger, or a step you asked for from a step the agent chose. One executive told Axios the hard part was knowing whether an agent was authorized or "has gone rogue." Nothing in the login says.

So the bank's control is binary: let the session through or kill it. The only scoped credential most banks have ever issued is the read-only token behind open banking. Between look and everything there is nothing.

A mandate is the missing shape. In my free course on the agentic payment it is step one: a signed instruction that names the agent, bounds what it may do, for how much, with whom and until when, and leaves a record the agent cannot edit. The law already assumes that record. As I set out in Who Pays When the Agent Pays Wrong, Regulation E says that if you furnish someone your access device and they exceed "the authority given, the consumer is fully liable." The Ninth Circuit decided in August that when an agent logs in on your instruction you are the one accessing; the agent is "a tool, not a person." The rules put the agent's acts on you. The bank cannot see what you authorized. That is the gap.

A password says who you are. A mandate says what you may do. Blocking is what you do when you only have the first.

The same week, a retailer shipped the other shape

On October 21, the day before the Axios story, Walmart announced how agents will shop for its customers. Each agent gets "a dedicated profile within the customer's account," so its purchases show up separately. Customers set a spending limit, "for example, $50, $100 or $200," or require approval on every order. "Customers must approve agent purchases by default." "Agents don't receive customers' payment-card information." Returns apply "including if an agent doesn't act as intended."

That is a mandate: per-agent identity, a cap, approval as the default, the card kept away from the agent, and a stated rule for who carries a mistake. Coinbase shipped the same primitive as spend limits earlier this year. To see the shape work, the Hunch playground is a reference store from Major Labs whose mock checkout refuses any order over the mandate's amount and records what the agent did.

One caution from my own measurements. When I bound every agent summary to its signed action record in the third Bench entry, three of 51 contradicted it. The mandate has to bind to the record of what the agent did, never to the agent's account of itself. Walmart's per-agent purchase history is that record.

Wells Fargo already wrote the agent into the contract

Axios and Tom's Hardware say banks are rewriting their terms. The only rewrite I could open is Wells Fargo's Online Access Agreement, version effective November 24, 2026. Section 2(b) treats an authorized representative's transactions, "including the transactions of their AI Agents," as authorized by you. Section 2(d) says the bank "may rely and act on the instructions of any Authorized Representative or Delegate (including any instructions from their AI Agents)," that you are "solely responsible for those transactions," and that you are "solely responsible for supervising" everyone you delegate to.

So the agent is in the contract, the liability sits with the customer, and the instrument for delegating is still a username and a password. That is Dimon's liability transfer written down, with no way for the customer to say how far it goes.

What I would change this week

If you own a bank's digital product. Ship the credential that sits between read-only and everything: a per-agent token issued from inside the logged-in session, bound to a cap, a counterparty list and an expiry, revocable in one tap, with every action logged against the token. It is the open banking read-only token with an amount and a scope on it.

If you own a checkout. Do what Walmart did, so your store is not the next place an agent has to carry someone's password. A profile per agent, a cap the customer sets, approval by default, and never hand the agent the card. Test against the Hunch playground first, because a mandate the agent can talk its way around is a password with extra steps.

If you are the customer. Do not give an agent your bank password. Once you do, Regulation E and, from November 24 at Wells Fargo, your own contract put every one of its actions on you. Use your bank's read-only connections for watching balances. For anything that moves money, wait for the mandate.

What to watch

My prediction, dated so you can check it: the first US bank to offer a scoped agent credential, rather than a block, does it before the Wells Fargo agreement takes effect on November 24, and the rest follow within a year. Blocking a customer's own agent does not survive contact with the customer, and every chief executive quoted above objected to the credential or the law, never to the agent.

Watch too whether Axios's incident claims acquire named sources, and whether any other bank writes agents into its terms. If the agent is a tool and the customer is the principal, the question is not whether to let it in. It is what to hand it.

If your bank's contract already makes you responsible for your agent's transactions, what would you need to see before you let it hold anything more than a password?

Charlie Major is a Product Development Manager at Mastercard. The views and opinions expressed in Major Matters are his own and do not represent those of Mastercard.