Gave Your Card Login to an AI Agent? Amex's New Terms Say Whatever It Does Is on You.

If you’ve handed your credit card username and password to an AI assistant so it can book trips, chase refunds or pay bills, your card issuer just told you something important. Whatever that agent does with your login may be your problem, not theirs.

American Express rewrote its online terms of service. The new version carries a “last modified” date of November 16, 2026, and the title of Section 15 now ends with, no kidding, “Automated Services and AI Agents.”

What Amex actually wrote

The rule is blunt: “Do not share your credentials with any third party, including any person or service, or any automated tool or AI agent.”

Then comes the part that matters. If you do share them, “you do so at your own risk. You may also be held responsible for any activity conducted by you, a third party, automated tool, or AI agent.” Amex adds that it “may rely on instructions and information submitted” by an agent using your credentials.

Translation: the agent’s clicks count as yours.

And if Amex reasonably believes an AI agent used your credentials in violation of its terms, it may start limiting “account access, transactions, enrollments, membership benefits, servicing, rewards.” That’s your points on the line too.

Amex isn’t alone. Doctor of Credit reported on November 9 that Bank of America, Citi and JPMorgan Chase have updated their terms to restrict agent access too. Axios broke the story on October 22, and Bank of America is reportedly limiting agents to read-only access.

Here’s the funny part. Back in April, Amex announced its own “Agent Purchase Protection” for purchases made by “registered” AI agents, available “in the future” through its developer kit. So Amex likes AI agents fine. It just wants them on its own pipes, not riding your password.

Why your fraud protection may not save you

Federal card rules cap your liability for unauthorized use at $50. But “unauthorized use” means use by someone without “actual, implied, or apparent authority.” For debit cards and bank transfers, the rule is even plainer: a transfer by someone you “furnished the access device” to doesn’t count as unauthorized until you tell the bank to stop honoring them.

Neither rule mentions AI agents. Your issuer doesn’t need one to. You typed in the password. You gave the authority.

Say your agent books a $1,200 nonrefundable flight on the wrong dates. If a stranger with a stolen card number had booked it, your liability would top out at $50. Your own agent with your own login gets you an argument with the airline.

That’s not fraud protection. That’s a customer service ticket.

Verdict: handing a bot your card login was questionable before. Now it’s questionable in writing.

What to do this week

Change your password on any card or bank account you’ve ever typed into an AI tool, browser agent or “assistant” extension. Changing it cuts off any copy the tool kept.

Turn on real-time purchase alerts in your card app. If something does slip through, you want to see it in minutes, not on the statement.

If you want software reading your accounts, use the connections your bank officially supports, the kind where you approve access on the bank’s own screen and never hand over the password. Amex’s terms say it supports that where available. A budgeting app connected that way is a different animal from a bot logged in as you. Our post on budgeting app bank data fees covers what those connections may start to cost.

Shopping for a card with stronger protections? Start at our best credit cards page and the credit cards hub.

How Candid Yak makes money. Some of the products we write about pay us if you apply or sign up through our links. That never changes our verdict, our rankings, or the numbers in this article. We call a bad deal a bad deal whether it pays us or not. Some brands shown in our comparison tools are placeholder examples while we finalize partner agreements, and we label them as such.