Press review: la Repubblica, October 24, 2026. With the commentary of lawyer Fulvio Sarzana, Sarzana Law Firm and Associates.
In summary. In the United States, banks are reporting AI agents hacking into users' bank accounts and, in some cases, carrying out unauthorized transactions. According to lawyer Fulvio Sarzana, who spoke to Repubblica, industry regulations do not address this issue, and the bank is not obligated to reimburse the customer. Taking action against the software manufacturer is perhaps possible, but it remains to be explored.
On the Republic Alessandro Longo's article, "Banks, AI Enters Accounts. Alarm Sounds in the United States," was published on October 24, 2026. The article is for subscribers only. Here are the main points on AI agents, including the legal section citing Fulvio Sarzana.
What's happening in the United States
The reports come from credit institutions: transactions carried out independently by agents through home banking. US banks are seeing AI agents accessing users' bank accounts and, in some cases, carrying out unauthorized actions.
According to Repubblica, some institutions have begun to block AI agents: Morgan Stanley, Bank of America, JPMorgan Chase, and Citigroup.
Not just hacker attacks
It's not always a matter of attacks by rogue programs. A growing number of people in the United States are entrusting AI agents with monitoring their latest movements and sending periodic email reports. In some cases, the agent misinterprets the instructions and initiates transfers to third parties.
AI agents are also coming to Italy.
The issue also concerns Italy. Dario Fadda, a cybersecurity analyst for a major Italian bank, explains that Italian account holders could also use AI agents for automatic account access. It's very difficult for banks to distinguish them from regular people banking online.
If it hasn't happened on a large scale yet, the article notes, it's perhaps because the most famous AI agent, Meta's Muse, launched in September and already used by around 10 million people, isn't yet available in Europe.
Systemic risks to the economy
AI agents can be tasked with tasks like switching energy providers or banks in search of better deals. The banking system isn't designed for an army of agents moving bank accounts and liquidity en masse at superhuman speed.
Experts and institutions are already discussing it. In May, the European Central Bank published a study simulating a similar scenario, with devastating effects on the stability of the financial system, similar to those of a mass withdrawal of cash from bank accounts.
AI Agents: Who is responsible for the agent's actions?
If the agent causes financial loss, who is liable? According to lawyer Fulvio Sarzana, there is nothing in the current industry regulations regarding this matter, and nothing obliges the bank to reimburse the customer. Exceptions are cases where the unauthorized access is the work of criminals or fraud.
Sarzana adds that it may be possible to take action against the software manufacturer for its alleged defects, but this is an avenue that has yet to be explored.
The overall picture on payments is the Legislative Decree 11/2010, which implements the European Payment Services Directive. It provides for reimbursement to the customer for unauthorized transactions, except in the case of fraud, intent, or gross negligence on the part of the customer. Whether a transfer ordered by an AI agent chosen by the customer is "unauthorized" remains an open question.
What to do in the meantime
While waiting for the regulations, here are some practical precautions for those who use or plan to use AI agents with their accounts:
- read the rules on credentials and use by third parties in the home banking contract;
- avoid giving your home banking credentials to an AI agent;
- limit the agent to read-only functions, when the service allows it;
- keep the instructions given to the agent and the reports received;
- immediately contest any suspicious transaction with the bank.
On this topic, see also the in-depth analysis of the Study on banking scams and on AI Act and GDPR.
Frequently Asked Questions about AI Agents and Bank Accounts
These are artificial intelligence systems that the user assigns to perform tasks such as checking the latest transactions, sending a periodic report via email, or changing energy provider or bank. They operate through home banking.
Banks are reporting AI agents hacking into users' accounts and, in some cases, performing unauthorized transactions. According to Repubblica, Morgan Stanley, Bank of America, JPMorgan Chase, and Citigroup have begun blocking them.
According to Dario Fadda, a cybersecurity analyst for a major Italian bank, Italian account holders could also use them, and it's very difficult for banks to distinguish them from people using online banking. Muse di Meta, the most popular agent, isn't yet available in Europe.
According to lawyer Fulvio Sarzana, there's nothing in the current industry legislation on this issue. It might be possible to take action against the software manufacturer for alleged defects, but that's an avenue that still needs to be explored.
In Sarzana, nothing obliges the bank to refund, unlike in cases where the unauthorized access is carried out by criminals or fraud. Legislative Decree 11/2010 provides for the refund of unauthorized transactions, and whether a transaction ordered by an agent chosen by the customer is unauthorized remains an open question.
According to the article, yes: the banking system is not designed for an army of agents moving accounts and liquidity en masse and at superhuman speed. In May, the European Central Bank published a study simulating a similar scenario, with devastating effects on financial stability.
The full article is on the Republic (subscribers).
English 
Italian 