Wells Fargo agreement makes customers liable for AI agent actions

Wells Fargo has updated its Online Access Agreement, effective Nov. 24, to make customers responsible for AI agent activity and to require them to keep proof that they revoked an agent's authorization, American Banker reported on Nov. 2.2

A Wells Fargo spokesman told American Banker that customers may authorize or revoke an AI agent outside Wells Fargo, and that the bank may not otherwise have visibility into when a revocation occurred.2

The agreement says customers remain responsible for all of an AI agent's activities until they notify the bank of revocation, to the extent permitted by law or regulation, and must give the bank evidence of revocation on request, according to the text quoted by American Banker.2

A dev.to post summarizing American Banker's review says a new Section 15 deems anything an agent does under a customer's login to be authorized by the customer without additional verification, including unintentional actions and manipulated inputs; American Banker's excerpt cites the notification step as Section 17(d), and we did not see the agreement itself.12

The spokesman's statement, as reported, did not say what counts as evidence of revocation, a question American Banker had put to the bank.2

American Banker reported that JPMorganChase has also changed its terms to make customers liable for actions of AI agents they authorize, and the dev.to post says, citing Axios and Reuters reports from Oct. 22, that JPMorgan, Bank of America, Citi and Morgan Stanley block third-party agents from customer accounts.12