Wells Fargo has updated its Online Access Agreement so that, from November 24, 2026, any instruction or transaction submitted by an AI agent using a customer's online banking credentials is "deemed to have been initiated and authorized directly by you, without further verification", according to Tech Times. American Banker reports that the bank also requires customers to keep evidence that they revoked an agent's access, or remain responsible for its activity.
A broad definition. Tech Times says the agreement defines an AI agent as "any software that takes autonomous, semi-autonomous, or non-autonomous action on behalf of any person or entity" with your credentials. Section 15(e) adds: "Your use of any AI Agent is AT YOUR OWN RISK." The provisions apply "subject to applicable law or regulation".
Proof of revocation. According to American Banker, the new text says customers must "retain evidence of such revocation" and provide it at the bank's request. Until they notify Wells Fargo, they remain responsible for all the agent's activities, to the extent permitted by law.
The updated agreement asks customers to keep a record of when an AI agent's authority was revoked, because Wells Fargo may not otherwise have visibility into when that occurred. — Wells Fargo spokesman, to American Banker
Why it matters
A gap in federal rules. Tech Times notes that Regulation E caps liability for unauthorized transfers, but excludes transfers made by someone to whom the consumer "furnished the access device". Handing your password to an AI agent may fall into that exception, a question the Consumer Bankers Association called central and that no court or regulator has answered. Because agents log in with your username and password, the bank cannot tell them apart from you, or from malware using stolen credentials.
Sources differ on peers. Tech Times says Wells Fargo is alone among major US banks in formally permitting agent access, while JPMorgan Chase, Citi and Bank of America restrict it. American Banker, however, reports that big banks including JPMorgan Chase have also changed terms to make customers liable for agents they authorize.
Experts are skeptical. Douglas Borthwick, founder of The Insumer Model, told American Banker it is not realistic to expect customers to produce such proof: a screenshot "shows you asked. It doesn't show the agent stopped, and screenshots are easy to fake." Elaine Duffus of Wolters Kluwer asked who is at fault if an agent goes rogue after being told to stop.
- Check which apps and AI assistants hold your banking username and password.
- When you cut off an agent, save dated records and notify your bank.
- Change your password after revoking access.
- Be cautious with AI shopping agents during Black Friday, which Tech Times notes falls three days after the change.
The fix is still a draft. Tech Times reports that the Personal Agent Protocol, announced by Meta and Sierra in October with Wells Fargo as a design partner, would give agents limited permissions instead of full credentials, but it is not yet deployed in banking.
Sources: Tech Times, American Banker
Leave a Reply