When an AI agent uses a consumer's password, in Europe it is the bank that must prove the payment was authorised

Several major US banks have found third-party AI agents operating inside customer accounts, and some of those agents appear to have attempted actions their owners never asked for. Axios reported it on 22 October 2026, citing unnamed sources, and the story has since been picked up by USA TODAY and SecureWorld.

Many of these agents log in with the username and password the customer hands over, even though many banks require account holders to sign in themselves. From that moment the authentication system sees the agent as the customer. Ping Identity's chief executive, Andre Durand, told USA TODAY that the unresolved question is how to tell whether a request comes from an agent or a person.

For a European bank, the American response is instructive mainly for what it cannot borrow. At least one major US bank has rewritten its terms so that customers carry whatever their agents do. Inside the EU, that kind of risk transfer runs into legal limits where the customer is a consumer or a microenterprise, and a judgment handed down by the Court of Justice on 15 October has reinforced them.

What have the big US banks done?

JPMorgan announced publicly that it will stop outside agents from logging in to or acting on customer accounts. "You don't want rogue agents," Jamie Dimon said on the third-quarter earnings call, as reported by Fortune. The bank still permits read-only access through intermediaries such as Plaid, with no ability to move money or pay bills, according to a round-up by Gadget Review.

A Citi spokesperson told USA TODAY that the bank does not allow third-party AI agents or assistants to log in to a customer's account, although read-only access through approved open-banking providers remains available. Charles Schwab's chief executive, Rick Wurster, said his firm is turning away "tens and twenties" of attempts by large AI agents to reach client funds. Morgan Stanley says it has not seen rogue agents on its platforms, and according to Axios it has started blocking them as a precaution.

Bank of America's Brian Moynihan said in mid-October interviews, with CNBC and, according to USA TODAY, with Bloomberg, that a human should authorise payments before they happen. The bank is restricting agents' access to consumer deposits. PNC's William Demchak argued, according to PYMNTS, that agents transacting in customer accounts would first require laws shifting liability.

Much of the concern centres on Muse, the assistant Meta launched in September with financial features delivered through a Plaid integration, as Fortune reports. According to USA TODAY, Muse passed 10 million users on 21 October. Banks fear that an assistant of this kind could start shifting deposits into higher-yielding accounts without the customer checking each step.

The statements from Dimon, Citi, Schwab and Moynihan are public and on the record. The accounts of agents acting on their own initiative come from anonymous sources, and Reuters, when it followed up the Axios scoop, said it could not independently verify the report.

How do Wells Fargo's new terms allocate the risk?

Wells Fargo's online access agreement, which takes effect on 24 November 2026, treats transactions carried out by a customer's authorised representatives and delegates as authorised by the customer, including those of AI agents they use. The clause expressly covers transactions "you did not want or intend". Unless prohibited by applicable law, the customer is solely responsible for those transactions and for supervising those representatives, and the authorisation lapses only once the customer gives notice and the bank has had a reasonable opportunity to act. Where the customer lets an AI agent access the service, the contract adds that the customer accepts the risk of that access.

SecureWorld, which analysed the clause, points out that it remains unclear whether it survives an agent exceeding its instructions, or the theft of the agent provider's credentials. In the United States, Regulation E already excludes from unauthorised transfers those made by a person to whom the consumer furnished the access device, until the consumer notifies the institution. That framework explains why the Wells Fargo approach has room to work there.

What does PSD2 say about a payment the customer never wanted?

The Payment Services Directive (EU) 2015/2366, known as PSD2 and transposed in Spain through Royal Decree-Law 19/2018, places on the payment provider the burden of proving that the transaction was properly authenticated. These are the main rules in the directive, with the Spanish equivalent in brackets.

• Article 72 (Article 44 of the Spanish law) requires the payment service provider to prove that the transaction was authenticated, accurately recorded, entered in the accounts and not affected by a technical breakdown, according to the text in the EBA Single Rulebook. The recorded use of a payment instrument is not necessarily sufficient on its own to prove that the payer authorised the transaction or acted with gross negligence, and the provider must supply evidence of that negligence or of fraud.
• Article 73 (Article 45) requires an unauthorised transaction to be refunded immediately and at the latest by the end of the following business day, provided the customer reported it without undue delay and within the 13 months set by Article 71 (Article 43).
• Article 74 (Article 46) caps the payer's loss from a lost, stolen or misappropriated instrument at €50, unless the payer acted fraudulently or breached their obligations intentionally or through gross negligence. Where the provider did not require strong customer authentication, the payer bears no loss at all unless they acted fraudulently.
• Article 69 (Article 41) sets those obligations, including keeping personalised security credentials safe, and requires the terms for using the instrument to be objective, non-discriminatory and proportionate.

For companies, Article 61 of PSD2 allows a bank and a client who is not a consumer to agree that the rules on proof and liability will not apply in whole or in part. Spain took up the option of protecting microenterprises as well, so Article 34.1 of the Spanish law limits that agreement to clients who are neither consumers nor microenterprises, and the refund obligation is not among the provisions that can be excluded.

Part of a clause like Wells Fargo's could therefore be carried over into a corporate banking contract, and a treasury team that lets an agent operate the company account should first check what it signed.

PSD2 has no special regime for agent-initiated payments, which remain subject to the general rules and to strong customer authentication under the technical standards, as the law firm Osborne Clarke has noted. In Spain, Supreme Court judgment 571/2025 of 9 April, in a phishing and SIM-swap case, required a payment service user's consent to be real and conscious, according to the analysis reported by Economist & Jurist.

What does the CJEU's C-70/25 judgment change?

On 15 October 2026 the Court of Justice answered a reference from a Polish court (press release 147/26). A woman selling an item online received a fraudulent link, typed her banking credentials into a page impersonating her bank and lost around €700. She reported it the next day, and the bank refused to pay her back, citing gross negligence.

The Court sided with the customer. Gross negligence is not a ground for withholding the immediate refund, and the only exception is a reasonable suspicion of fraud by the payer, communicated in writing to the national authority, which in Spain is the Banco de España. The bank may then try to recover the money, but it has to prove the negligence. Rob Bratby, in his commentary on the ruling, considers this the correct reading of the directive. He also criticises the Payment Services Regulation agreed in Brussels, which would allow providers to hold back a refund for up to 15 business days while they assess negligence.

PSD2 remains the applicable law. The Payment Services Regulation and PSD3, which will replace it, have had a political agreement since November 2025, and the European Parliament's ECON committee approved the agreed text on 5 May 2026. As of 27 October they were still awaiting formal adoption, with the plenary vote scheduled for 14 December according to the Regulation's procedure file. According to PwC, both instruments will apply 21 months after entry into force, so disputes over agent-initiated payments will in all likelihood be settled under PSD2 and the national laws that transpose it, such as Spain's RDL 19/2018, until well into 2028.

The case concerned phishing, not AI agents. The reasoning would appear to carry over provided the transaction is in fact unauthorised, which is exactly what will be disputed when the customer has set up the agent. If it is treated as unauthorised, the bank refunds without waiting and carries the burden of proving any negligence.

Is handing a password to an agent gross negligence?

Many European risk committees will probably say yes, following the logic of the Wells Fargo contract. Sharing credentials breaches the terms of service and Article 69 of PSD2, so any loss caused by an agent the customer let in would be gross negligence and the customer's problem. Add to that the sense that this is an American story, tied to products that have yet to arrive in Europe with financial features switched on.

The argument has some basis, because a customer who gives a password to a third party has stepped outside their obligations, and no bank can secure a session its customer has handed away.

Why does pleading gross negligence protect a bank less than it seems?

After C-70/25, pleading gross negligence does not hold up the refund of an unauthorised payment, and what the bank must establish afterwards is gross negligence, not an ordinary slip.

We are not aware of any European ruling that has treated delegating to an AI assistant as gross negligence. Taylor Wessing looks at payment agents enabled by the payment service provider and concludes that, if such an agent buys something outside the customer's criteria, the transaction will generally be deemed unauthorised and the provider that enabled the agent will generally be held liable. The case of an outside agent using the customer's password remains unresolved.

Agents can be steered by instructions hidden in the content they process, a risk we examined in the GhostJacking poisoned-log research. If an agent acts because someone else has hijacked it, arguing that the customer wanted the payment becomes harder still.

PSD2 has already dealt with a version of this problem in the shape of financial aggregators, since Delegated Regulation (EU) 2018/389 requires banks to provide an access interface, either dedicated or an adapted customer interface, through which third-party providers must identify themselves. An agent driving a browser on the customer's password skips that identification. In our view, a bank that never tried to find out who it was dealing with will find it harder to plead ignorance later, although whether an agent provider that initiates payments is itself providing a regulated PSD2 service remains an open question.

That leaves the idea that this is an American story. The products and the contracts are local, but an agent that can drive a browser can also operate in a Spanish bank's online service. In Europe, however, strong customer authentication requires a second factor for payments, subject to exemptions, and repeated authentication at least every 180 days to keep viewing the account, which leaves the agent dependent on the account holder.

How can a bank tell a customer from their agent?

A blanket block has an obvious weakness. A bank that cannot distinguish the agent from the customer cannot block it accurately either. The useful controls are those that deliver detection and usable evidence at the same time.

Do automation signals in the session help?

Navigation with no human pauses, identical sequences across sessions, signs of a browser under programmatic control and new devices completing a transaction without a moment's hesitation are all signals a fraud team can correlate. None is conclusive alone, and defenders should expect some agents to mimic human behaviour. The value lies in storing those signals alongside each transaction, because they strengthen the proof that Article 72 places on the bank.

Where does device-bound strong authentication fit?

PSD2 already requires strong customer authentication, subject to exemptions, for transfers and for adding trusted beneficiaries, and what matters is the factor chosen. A passkey or a biometric approval on a trusted device requires the account holder to take part and turns an argument about who authorised what into a verifiable record, the direction Durand pointed to in his USA TODAY interview. Multi-factor authentication built on one-time codes that can be forwarded or intercepted meets the rules but does not separate the account holder from their agent. The same reasoning applies to raising limits or changing contact details.

Can a bank offer agents a legitimate route in?

A bank that only says no will find its customers sharing passwords regardless. Citi and JPMorgan already let approved third parties view balances and transactions, and the next step is agent access with narrow permissions, revocable tokens and a distinct identity for the agent. Fortune reports that Meta is working with Sierra on a protocol that lets personal agents identify themselves and show the customer's permission to businesses. Governing that access is a non-human identity problem, with inventories, expiry dates and reviews, which our non-human identities security service addresses.

Should banks prepare for agent calls and mass revocation?

Axios, as cited by SecureWorld, reports that some agents are already phoning bank contact centres and that some banks are running "day after" scenarios to secure or restore customer access quickly. SecureWorld also recommends confirming that agent sessions can be revoked at scale. Both belong in the response plan, with a separate verification path for calls that look agent-originated and a tested procedure for cutting off every session from a compromised agent provider in one go.

Does anything change when the agent belongs to the bank?

Banks that deploy in-house assistants, or expose services through MCP servers, face the same problem from the other end. The controls set out in our guide to MCP security for enterprise AI agents, together with an AI agent and MCP security audit before opening them to customers, narrow the room for disputes about who decided what.

How much does indecision cost?

The direct cost is refunds for unauthorised transactions. Clawing that money back depends on evidence that is far stronger if it was captured at the moment of authentication. Where the bank did not require strong customer authentication, Article 74 also leaves it unable to pass the loss on to the customer unless there was fraud.

The regulatory cost arrives through DORA, which requires financial entities to run an ICT risk management framework that includes strong authentication and access control policies. A bank that cannot say what share of its sessions are run by agents will find it hard to show its supervisor that the framework covers the digital channel. Where the bank plugs third-party agents into its own services, third-party risk management comes into play as well.

Fraud networks can be expected to try to pass their transactions off as the mistakes of a legitimate agent, and what looks today like a debate about customer convenience could become a stream of claims that are hard to rebut. Spain's data protection authority has already received its first notification of a breach caused by an attack carried out with an AI agent, although in that case the agent was in the attacker's hands, not a customer's.

Which three decisions face the risk committee?

A European payments business has three decisions to make. The first is the channel, meaning whether to block agents, allow read-only access or open a scoped route in which each agent carries a distinct identity. The second is evidence, which depends on what signals are captured in each session and whether they would persuade a judge. The third is contractual and applies only to corporate clients that are not microenterprises, since it means deciding whether Article 61 will be used to pass the risk of agents on to them and how that will be explained.

With its consumers, a European bank cannot solve the problem by rewriting its terms, as Wells Fargo has done. Its room for manoeuvre lies in controls that prove who authorised each payment.

This analysis is provided for information only and does not constitute legal advice. It reflects information published up to 27 October 2026. The reports of incidents at US banks rest on unnamed sources cited by Axios and have not been independently verified, and the courts have not yet ruled on how PSD2 applies to agent-initiated payments. Changes to contracts, refund procedures or authentication controls should be checked with legal advisers and with the supervisor.