The banks just admitted they can’t tell your people from a machine

Last month an Axios scoop put the biggest banks in America on the record saying something they usually keep to themselves. They are finding AI agents inside their customers’ accounts. They did not authorise them. And they often cannot tell whether a person or a machine is logged in. Morgan Stanley has started blocking third party agents. JPMorgan, Bank of America, Citi and Charles Schwab are restricting them. Axios reported bank executives describing the situation as “horrifying.”

It is easy to read that as a banking infrastructure problem. It is not, or at least not only. Read the quotes again and the real problem is the one most security teams have been avoiding: you can no longer tell, at the moment it matters, whether the thing acting on an account is the human you trust or something wearing their credentials.

Charles Schwab’s chief executive Rick Wurster said the firm is “blocking unauthorised agents who try to log in on behalf of clients,” and does not let them move money. Citi’s global head of AI wants a “know your agent” process, the way banks already run know your customer.

Here is the part that should stop a board. Most of this access is not a hack. It is a customer who willingly handed an agent their username and password because the agent offered to help. One industry expert put it plainly: there are “no agreed standards yet for how a bank verifies an agent,” and the agents mimic the behaviour of real human users, so they are hard to detect at all.

Notice what that removes. The attacker no longer has to break in. They either persuade a person to open the door, or they arrive wearing the legitimacy of an agent that person already trusts. Either way the control meant to catch them, a check built to tell an authorised human from an intruder, is staring straight at the one signal it was never designed to question.

That is not a firewall problem. That is a judgment problem, and judgment lives in people.

The agents are coming because customers want them

People are not reluctant. In Accenture’s January 2026 survey of more than 25,000 consumers, three in four said they would let an AI agent carry out tasks on their instruction, and roughly a third would let it choose and spend with their approval.

The figure worth watching is not any single number but the direction. As letting an agent act on your behalf becomes ordinary, the old instinct that kept people safe, do not share your password with anyone, quietly erodes. Handing credentials to an agent starts to feel like using a product rather than taking a risk. That is precisely the behaviour the next wave of attacks is built to rent.

The thing agents exploit is the oldest thing in security

Whatever an agent does, it does it through a person’s access and a person’s trust. That is the same door attackers have always used. In Verizon’s 2026 Data Breach Investigations Report, a person was involved in 62% of all breaches, and 65% in financial services. Agents do not change that equation. They industrialise it.

Industrialise is the right word. A convincing social-engineering campaign used to need a skilled person, time and patience, and it did not scale. An agent has none of those limits. It does not get tired, it never sounds nervous, and it can run the same approach against thousands of people at once, at any hour, learning from what works as it goes.

And the cost is compounding

The FBI’s complaint centre logged $20.9bn in reported losses in 2025, up from $4.2bn in 2020. For the first time it broke out AI-related crime on its own. A cloned voice is now good enough that one European businessman wired close to a million euros after a call from what he believed was a government minister.

You cannot buy your way out of a judgment call

The banks are responding the only way they can right now, by blocking agents and rewriting their terms of service, because there is no rulebook. US regulators have not written one. A finance industry working group said it cleanly this year: a deepfake cannot spoof possession of a private cryptographic key, but it can absolutely spoof a human. So the controls built around humans are the ones under pressure.

You can block an agent at your login page. You cannot block the moment your finance manager takes a call from a voice that sounds exactly like your chief executive, or the moment an employee pastes company credentials into a helpful looking assistant. Those moments happen in people, and they are getting harder to call, not easier.