When an AI tool uses a shared bank login, the bank's records show only that the organization's own credentials sent the payment, not that software prepared it from a fraudulent email. Regulation E covers consumer accounts, while for business accounts UCC Article 4A lets a bank treat an order as the customer's when an agreed, commercially reasonable security procedure was followed. The edition asks organizations to check whether any AI tool holds a payment login, to split viewing, entry and approval roles, and to name someone to read bank statements promptly.
JPMorgan's CFO Says It Is On You If Your AI Agent Moves The Money
In a JPMorgan Chase earnings call on October 13, 2026, Jeremy Barnum, the firm's chief financial officer, was questioned about AI agents, software that can do more than answer questions. It can perform tasks on your behalf, such as reading your email, signing into websites and clicking the buttons. According to an article in American Banker, Barnum remarked that it would be "not secure" to give an agent your bank login and password and further stated that, should an agent act contrary to your desires, "that's going to be on them." The "them" would be you, the customer, to be sure, and Barnum was talking about customers generally, stating that JPMorgan blocks the services that do this wherever it is able.
Here is an example of such an exchange inside a business. Dana in this example is a fictional office manager at a tiny business.
Dana's Friday
Dana is a kitchen remodeling company's office manager. There are six employees; Dana is the bookkeeper, the payroll clerk, and the person who answers the phone. There is not a finance department and no accounting system with an approval process. Every week, Dana pays approximately a dozen bills to the lumber yards, the tile suppliers, and the subcontractors, directly online from the bank. And because this is such a small company, Dana is also the last check.
Dana uses one of the popular AI assistants to manage her email and compose messages. One day, she asks it if it can help with the bills. It could access her inbox and her bank's website if she supplies the login. She would be sent a weekly payment list to approve. That way it will free up an hour more each week. She thinks that would be good.
First, Dana gives the assistant the company's banking username and password (the same ones she uses herself). Business banks can give each employee individual access, so someone can just look, someone can just enter and someone can approve. Dana's company did not do it that way. She is the only user, so her single login can do all three things: look, enter and approve, including wires (payments sent directly between banks). It works for three weeks. Each week the assistant builds the list from the invoices, Dana reviews it, clicks the Approve button and goes home. By the end of the third week, Dana is skimming.
Friday morning arrives and an invoice is due to a local supplier. A new email sits in the inbox, appearing to be the supplier, requesting a different bank account number as they have changed banks. It is a fake message, written by a thief. The assistant is convinced by the message, as it appears identical to all emails from the company. It changes the account number on the list.
At four o'clock Dana opens the list. The phone has rung constantly since lunch. A crew leader is on hold about a tile shipment coming late. The owner is calling to ask if payroll is covered for Monday. The payments need to go out today.
There are twelve lines; the name of the supplier, the invoice number, the amount and, in little gray font at the end, a long account number. Dana does what she has always done. She holds the invoices next to the screen and matches up the name and the amount. Same on every line. The lumber yard is right. The tile company is right. She pays the tile company by wire, so there is a different account number this time; but that is just a long string of digits, like all the numbers on the screen, and no one can remember those. She has been paying these companies for years; she knows their names, she knows about what they charge her, but she does not know their account numbers; no one does.
The AI assistant did type a quick note in its own chat window (between the other messages it sent Dana), explaining that the supplier's account number had changed. Dana, meanwhile, does not open the window for the rest of the day.
She presses Approve and answers her call.
Monday arrives. The real supplier rings: where is our payment? Dana logs into the bank website and sees it. It left her account on Friday, but it went to an account number she has never seen, so she phones the bank.
The customer service rep at the bank is courteous and careful. They check the records. The correct username was used and the correct password. The payment was entered and sent with the company's own login. Because the bank has only one login for the company, its own records do not show one person entering the payment and a different person approving it. The money has already moved to another bank and then to a third.
"But I never picked that account," Dana says. "My assistant changed it, and a thief tricked it."
"The payment came through your company's login. Your username and the right password. From what we see, that was you," the banker says.
Dana asks if the bank is able to recover the funds. It may be that they cannot. A more important question is which party bears responsibility for the loss when an agent transfers money. That is what this edition is about.
What the bank can see
The bank will see a login. It cannot tell who or what was using it. It will record that the password and username are correct and the payment will go through. It will nowhere record how the list had been generated by a software program, based on a fraudulent email, with someone clicking approve in a rush and while holding a phone.
This is not a new ruse. On June 27, 2014, the Internet Crime Complaint Center of the FBI described a scheme where criminals email a company from what appears to be a supplier's account and ask to change payment details, and victims often find out only when the real supplier asks to be paid. This kind of fraud, termed business email compromise, was noted in a story published by Nacha on April 24, 2025, to be responsible for close to $2.8 billion in losses, according to the FBI's report for 2024. Until recently, a human being read that email and made the change. Dana's company gave that job to software and left only one click for Dana at the end of the process.
What the law says
This is the section most people overlook. For your personal bank account there is a federal rule called Regulation E which applies to electronic transfers including unauthorized ones. It applies to any "account" established primarily for "personal, family or household" use (a company bank account would not qualify). Here is the caveat. A transfer is not counted as unauthorized if it was started by someone the customer gave their login to, until the customer tells the bank that person no longer has permission. The rule's text does not say whether that includes an AI tool.
A company is left with its account agreement and a state law, Article 4A of the Uniform Commercial Code. A 2012 analysis by the California Senate Committee on Banking and Financial Institutions, citing the bill's sponsor, said Article 4A "was designed to provide a set of rules governing wholesale wire transfers." Section 4A-202 allows a bank to treat an order as coming from its customer "whether or not authorized," where a procedure is in place (that the customer and the bank have agreed upon), such as an agreed login or verification rule. This procedure must be commercially reasonable and the bank must act in good faith. In simple terms: if the procedure you have agreed with your bank is followed and is also commercially reasonable, the order can be yours.
Section 4A-505 provides time limits. After the customer receives a notice from the bank that reasonably identifies the payment, the customer has one year to raise an objection. If a customer does not object within the year, they cannot claim that the bank has no entitlement to the funds. However, this is only the maximum time frame: a bank's own account agreement may set a shorter period. One year is the outer limit and not something a customer should plan on.
Neither section says what happens when the password is entered by software, or whose order that is. Dana's company would be paying to find out.
Three things to check this week
One: the login. Has anyone in your organization given an AI tool a bank or payment login, even once, even just to save time?
Two: roles. Online banking guides from two banks describe a split between roles: what you can see, what you can enter payments into and what you can approve a payment with, with some requiring a second person for payments over a threshold. One says if no one else at the business can approve the payment, the approval is skipped. Ask your bank what it offers, who has what role and what it takes to put in a second approver. If you are the solo user, you hold all three, and so does any tool you give your login to. A read-only tool, like one that matches invoices with payments, should get a login that can only ever read.
Three: the bank statement. Once a payment is reported to your organization, for example as part of its statement, the one-year clock runs from the day your organization received the report. Name someone to read them and contact the bank that day if something looks odd. Your account agreement may allow less time.
Somewhere in your organization, someone may have given an AI tool the bank login to save an hour a week. If that tool is ever fooled, the bank's records will show only that the organization's own login sent the payment.
The story of Dana is invented to show how something that could easily happen on an average afternoon can go wrong. The company, the individuals, the email from the supplier and the payment are not real events.
Sources: South Shore Bank, “Payments Approval” business banking guide, and HAPO, business user permissions guide, both undated, read October 25, 2026. FBI Internet Crime Complaint Center, scam alert, June 27, 2014. Nacha, “FBI’s IC3 Finds Almost $8.5 Billion Lost to Business Email Compromise in Last Three Years,” April 24, 2025. Maria Volkova, “JPMorgan warns of risks to consumers who rely on AI agents,” American Banker, October 13, 2026. 12 CFR 1005.2, Regulation E definitions of “consumer,” “account,” and “unauthorized electronic fund transfer,” Cornell Legal Information Institute. Uniform Commercial Code 4A-202 and 4A-505, Cornell Legal Information Institute. California Senate Committee on Banking and Financial Institutions, analysis of SB 708, hearing of August 23, 2012. This is general information, not legal advice.
Last week: Your Company May Have to Pay for Your AI Agent's Next Mistake on Its Own. The book on who owns what an agent does: Who Owns the Agent?