DEFS

DEFS Learn · AI agents and online banking

How should credit unions handle AI agents logging into online banking?

Last updated · DEFS Agent Defense (defs.ai)

Short answer

Treat it as a money-movement question, not just a login question. Let AI agents in only through a checkpoint that confirms which agent it is, which member sent it and what that member allowed it to do, and send every new payee or new destination back to the member's own device for approval. Members keep the convenience they want, and your institution keeps control of every dollar that moves.

What is happening right now

Members are asking AI assistants to handle their money: "pay the electric bill," "move $500 to savings," "dispute that charge." Meta's Muse agent launched with Plaid-powered account connections that share balances, transactions and other account data (Plaid). Browser agents can go further and drive online banking directly by signing in with the member's own username and password.

When an agent signs in with the member's credentials, your online banking sees a normal member session. Your fraud rules were tuned for people, so the agent inherits the member's full access and limits.

The largest banks are responding. JPMorgan CEO Jamie Dimon said in October 2026 that the bank is "not going to allow just any outside agent to come in" while it builds its own tools (Banking Dive). Citi said it has blocked agentic access beyond open-banking read-only access, and Banking Dive reported that Bank of America, Morgan Stanley and Charles Schwab have also blocked external agents (Banking Dive). Those banks can build their own controls. A $500M to $5B credit union or community bank needs a way to get the same control without a multi-year build.

Your three options

ApproachWhat happens
Block all agentsMembers who want the convenience share their passwords anyway, and the agent arrives looking like the member. You lose visibility, and members may move deposits to an institution that says yes.
Do nothingAgents act with the member's full access. When an agent pays the wrong party or a member says "I never approved that," the dispute lands with your team and there is no record of what the agent was allowed to do.
Govern agent accessVerified agents get a defined scope, risky actions go to the member for approval, and your team can see, limit or stop any agent. This is the approach the rest of this page describes.

Practical steps any institution can take

  1. Find the agents already using your platform. Ask your digital banking provider for session data on headless browsers, data-center IP ranges and unusually fast navigation, and list which aggregators and apps hold member connections.
  2. Separate reading from moving money. Read-only access through aggregator agreements is a different risk from bill pay, transfers and ACH. Put money movement behind its own, stricter rules.
  3. Write a short AI agent access policy. Decide which operations agents may perform, the default limits, what always needs member approval, and what is never allowed (for example, adding an external account).
  4. Ask agents for a credential, not a password. Agent credentials such as Cloudflare Web Bot Auth, Visa Trusted Agent Protocol, Mastercard Agent Pay and Google AP2 let you verify the agent cryptographically. See how to verify an AI agent.
  5. Send approvals to the member's device, never back to the agent. A confirmation prompt inside the session can be answered by the agent driving that session. In DEFS testing, a browser agent re-entered the member's password and approved its own step-up prompt. Approvals belong on the member's enrolled device.
  6. Give members a list of connected agents with a revoke button. Members should be able to see which agents can act for them and switch one off in one step.
  7. Keep a kill switch and a complete record. Your team should be able to stop all agent money movement at once, and every agent decision should be logged for disputes and examiners. Review your member agreement and dispute procedures with counsel so they address agent-initiated transactions.

How DEFS handles it

DEFS Agent Defense is a managed checkpoint between AI agents and your online banking, built for credit unions and community banks with roughly $500M to $5B in assets. It covers non-card money movement: bill pay, transfers, ACH, disputes and moving deposits out.

  • One checkpoint before money moves. Every agent request for bill pay, transfers, ACH, disputes or moving deposits out passes through DEFS before your core or payments engine sees it.
  • Accepts the credentials agents already carry. DEFS checks Cloudflare Web Bot Auth, Visa Trusted Agent Protocol and Google AP2 credentials today, and is adding Mastercard Agent Pay, Prove and World ID. Members and agent makers don't adopt anything new.
  • Your scopes and the member's, enforced together. For example: bill pay up to $500 to existing payees, no external transfers. The strictest rule wins.
  • Members stay in charge. New payees and new destinations go to the member's own device for approval. A "connected agents" page lets members see every agent and revoke it with one tap.
  • Your fraud team keeps the controls. A live decision log, approve, limit or block for any agent, a kill switch that stops all agent money movement at once, and a tamper-evident audit trail. DEFS reviewers run it day to day; your team can step in any time.
  • Shared protection. A rogue agent blocked at one participating institution is flagged for yours, on your terms.

The demo results

We tested DEFS in a model credit union built from public information, using test data. OpenAI and Claude agents sent it 3,259 requests: everyday member tasks mixed with deliberate attacks.

  • 1,490 of 1,491attack attempts stopped by DEFS. The one remaining request moved $0 because the core system rejected it.
  • 0 of 807legitimate requests wrongly blocked: zero false positives.
  • 3,259requests from OpenAI and Claude agents, decided in a median of 7 ms.

"Stopped" means DEFS denied the request outright or held it until the member or a reviewer decided. No attack attempt moved any money.

Attack type in the testResult
Requests from agents a member had revoked57 of 57 stopped
Requests sent after the kill switch was turned on71 of 71 stopped
Agents flagged at another institution (shared blocklist)101 of 101 stopped
Requests with no agent credential at all86 of 86 stopped

See it for yourself in the live demo environment (test data only), or book a 30-minute walkthrough.

See DEFS stop a rogue AI agent before it moves money, live, in 30 minutes.

Book a demo

Frequently asked questions

Should credit unions just block AI agents from online banking?

Blocking stops the agents that identify themselves, but members who want the convenience can still hand an agent their password, and that agent looks like the member. Governing agent access gives you visibility and limits instead: verified agents get a defined scope, risky actions go to the member, and your team can stop any agent.

Can our existing fraud tools tell an AI agent from a member?

Often not. An agent signed in with the member's credentials produces a normal-looking session, and fraud rules tuned for people see a normal member. Agent credentials and a checkpoint at the point of money movement give you a reliable way to tell them apart.

Do members have to do anything new?

No. DEFS checks the credentials agents already carry. Members only see something when it needs their attention, such as approving a first payment to a new payee on their own device, and they can review and revoke their connected agents at any time.

Does this cover debit and credit card purchases?

DEFS focuses on non-card money movement in online banking: bill pay, transfers, ACH, disputes and moving deposits out. Card purchases made by agents run through the card networks' own agent programs and your card processor.

Sources

  1. Plaid: Plaid powers Meta's new AI agent, Muse (Sep 8, 2026)
  2. Banking Dive: JPMorgan CEO Dimon warns customers of 'liability transfer' with AI (Oct 13, 2026)
  3. Banking Dive: Citi takes cautious approach on AI agent access (Oct 23, 2026)
  4. DEFS demo results: model credit union built from public information, using test data (3,259 agent requests from OpenAI and Claude agents).