How Banks Use AI: Real Examples, Risks & Your Rights

Banks use AI mainly to detect fraud, support lending and compliance decisions, answer customer questions, and speed up internal work. Most of it runs out of sight. Some of it you meet directly, such as a chatbot or a fraud alert on your phone. AI helps banks scan huge volumes of data quickly, but it also creates risks: false alerts, hard-to-explain decisions, biased outcomes, privacy exposure, and new tools for criminals. Banks remain legally responsible for their decisions, and your rights under existing credit, privacy, and consumer-protection laws still apply, whether or not AI was involved.

Key takeaways

•       Most bank AI is machine learning working in the background. Chatbots and generative AI are the visible, growing part.

•       Even accurate fraud models flag many legitimate payments. A worked example below shows why.

•       If a lender denies you credit, federal law requires a notice with reasons, or instructions for getting them, whether or not AI was used.

•       We found no general federal right to opt out of AI-based fraud screening or to demand a human reviewer. Bank policies vary.

•       The rules are moving. In April 2026, federal bank regulators replaced 15-year-old model risk guidance. In May 2025, the CFPB withdrew its circular on algorithmic credit decisions. States are passing their own laws.

•       Criminals use AI too. The FBI's 2025 report counted 22,364 AI-related complaints with more than $893 million in reported losses.

How we researched this guide

Current as of October 22, 2026. We researched this guide in October 2026 using official government and regulator documents, central-bank research, and primary company statements. We did not test any bank, chatbot, or AI product, and we did not rank banks or vendors. Sources were prioritized in this order: government and regulators; primary legal text; institutional research; and, only when those could not support a fact, established non-affiliate journalism and law-firm analysis, which we label as secondary. Named banks appear only where the bank's own statement documents a deployment, and those claims are company-reported and not independently verified. This article contains no affiliate links, referrals, or sponsored content. AI technology, regulation, and bank practices change quickly, so confirm details with your bank and official sources. This is educational content, not individualized financial, legal, or technical advice.

What does it mean when banks use AI?

Banks use AI in two broad ways. Behind the scenes, machine-learning models score risk, flag unusual activity, and sort alerts for staff. In front of customers, virtual assistants and, more recently, generative AI answer questions and personalize prompts.

Two cautions apply. First, 'AI' is used loosely. Many bank systems are still traditional statistical models or fixed rules, and banks differ in what they use and what they disclose. Second, AI usually supports human decisions rather than replacing them, but the amount of automation varies by bank and use case.

For scale, a Bank of England and Financial Conduct Authority survey of 118 UK financial firms, published in November 2024, found 75% already using AI and about one-third of AI use cases built by outside providers. That is UK data across financial services, not a U.S. banking figure. It still shows how widespread and vendor-dependent the technology has become.

Key terms

•       Artificial intelligence (AI) in banking: Software that performs tasks that normally need human judgment, such as spotting patterns in transactions, scoring risk, or understanding written questions.

•       Machine learning: An AI method in which a model learns patterns from historical data instead of following only hand-written rules.

•       Predictive vs. generative AI: Predictive AI estimates an outcome, such as the chance a payment is fraudulent. Generative AI creates new content, such as a drafted reply or a document summary.

•       Large language model (LLM) and natural language processing: An LLM is a generative AI system trained on large amounts of text to produce human-like language. Natural language processing is the broader field of helping computers understand language.

•       Rules-based system vs. machine-learning model: A rules-based system applies fixed instructions, such as 'flag any card purchase over a set amount abroad.' A machine-learning model weighs many signals at once and learns from data.

•       Agentic AI: AI that can plan and carry out multi-step tasks toward a goal with limited prompting, rather than only answering a question.

•       Human-in-the-loop: A design in which a person reviews or can override an automated result.

•       Third-party (vendor) risk: The risk that comes from relying on an outside company for models, data, or software.

How do rules, machine learning, and generative AI differ in banking?

Where do banks use AI? An overview of use cases

The table below summarizes the main uses. Oversight entries are dated and explained in later sections.

How do banks use AI to detect fraud?

Banks run each payment and login through models that compare it with your normal behavior and with known fraud patterns, then assign a risk score. A high score can trigger a decline, a text message, a step-up check such as a one-time code, or a review by a human analyst.

Key terms

•       Fraud detection model / risk score: A model that rates how likely an activity is to be fraud. The rating is the risk score.

•       Anomaly detection: Finding activity that departs from a customer's usual pattern.

•       Behavioral biometrics: Signals about how you use a device, such as typing rhythm or swipe patterns, used to help confirm it is you.

•       False positive vs. false negative: A false positive is a legitimate transaction flagged as fraud. A false negative is real fraud that gets through.

Signals can include amount, merchant type, location, time, device, whether the payee is new, and behavioral signals. Banks rarely publish the exact signals or thresholds they use.

Why does an 'accurate' fraud model still flag so many legitimate payments?

Because fraud is rare. Even a small error rate on a huge pile of legitimate transactions produces many false alerts. Illustrative example, with generic numbers and no real bank:

•       A bank's model reviews 1,000,000 card transactions.

•       0.1% are fraud: 1,000 fraudulent and 999,000 legitimate.

•       The model catches 90% of fraud: 900 caught, 100 missed.

•       It wrongly flags 0.5% of legitimate transactions: 999,000 × 0.005 = 4,995 false alerts.

•       Total flagged: 900 + 4,995 = 5,895.

•       Share of flagged transactions that are truly fraud: 900 ÷ 5,895 ≈ 15.3%. About 85 of every 100 alerts are legitimate customers.

This is the gap between recall (the share of fraud caught, 90% here) and precision (the share of alerts that are right, about 15% here). Banks tune thresholds to balance the two. Suppose the bank tightens the model so it wrongly flags only 0.1% of legitimate transactions (999) but catches 70% of fraud (700). Flagged transactions fall to 1,699, and precision rises to 700 ÷ 1,699 ≈ 41.2%. But 300 frauds now slip through instead of 100. No setting removes both kinds of error.

What oversight applies to fraud models?

On April 17, 2026, the Federal Reserve, OCC, and FDIC issued revised model risk management guidance (Fed SR 26-2, OCC Bulletin 2026-13, FDIC FIL-15-2026). It replaced the 2011 framework. It is risk-based: validation and monitoring should match each model's risk, and relying on a vendor does not shift responsibility for model risk. This is supervisory guidance, not a consumer-facing law.

If a transaction you did not authorize posts to your account, report it quickly. Under Regulation E, your liability for unauthorized electronic transfers is generally capped at $50 if you report within two business days and up to $500 after that, and your exposure can grow if you wait.

How do banks use AI in lending and credit decisions?

Lenders use statistical and machine-learning models to estimate how likely you are to repay and to support decisions on approval, credit limits, and pricing. How much a human reviews varies by lender and product, and lenders rarely disclose model details. In the UK survey above, 55% of AI use cases involved some degree of automated decision-making, as summarized by a law firm. We found no comparable U.S. figure.

Key terms

•       Credit scoring model vs. underwriting model: A credit scoring model turns credit-report data into a score. An underwriting model is a lender's own system that combines scores with income, debts, and other data to recommend a decision.

•       Alternative data: Information beyond traditional credit-report data, such as bank-account cash flow, used to assess a borrower. Some lenders use it. We found no official source measuring how common it is among banks.

•       Explainability ('black-box' models): The ability to say in plain terms why a model produced a result. A black-box model is hard to explain.

•       Algorithmic bias / disparate impact: Algorithmic bias is a model producing systematically worse outcomes for some groups. Disparate impact is the legal idea that a neutral practice can unlawfully harm a protected group.

•       Adverse-action notice: A notice that a lender denied or otherwise took negative action on your application, with reasons or instructions for getting them.

What does the law require when a lender denies you?

These rules apply whether or not AI was used.

•       ECOA and Regulation B (federal law): Lenders may not discriminate on prohibited bases, including race, color, religion, national origin, sex, marital status, age, and receipt of public assistance income. A lender generally must tell you of its decision within 30 days of receiving a completed application. A denial notice must state the specific reasons or tell you that you can ask for them within 60 days.

•       FCRA (federal law): If your credit report was used in the decision, the notice must also name the credit bureau, disclose the credit score used and key factors, tell you that you can get a free copy of the report within 60 days, and tell you that you can dispute errors.

In June 2022, the CFPB issued Circular 2022-03, saying creditors using complex algorithms must still give specific reasons. The bureau withdrew that circular on May 12, 2025, along with 66 other guidance documents, and said it would keep reviewing which to retain. The withdrawal removed the bureau's guidance. It did not repeal ECOA or Regulation B, which still require specific reasons or instructions for getting them. We found no current federal rule that spells out how specific reasons must be for machine-learning models beyond those existing requirements.

Is there a state AI law for credit decisions?

Some states are acting. Colorado's governor signed SB 26-189 in May 2026, repealing and replacing the state's 2024 AI Act. According to law-firm summaries, the new law takes effect January 1, 2027 and focuses on notices, explanations, and appeal rights when automated tools drive major decisions, including lending. Whether and how a state law reaches a particular bank depends on its text and exemptions. California's privacy agency also adopted automated decision-making rules; a compliance-industry summary says businesses using such tools for significant decisions must comply starting January 1, 2027. Confirm coverage before assuming either applies to your bank.

What happens if an automated screen denies your loan?

Illustrative example, with no real lender: Maya applies online for a personal loan and receives a denial email within minutes.

1.      Read the notice. It should list the main reasons, or say how to request them within 60 days.

2.      Get the credit report named in the notice. You are entitled to a free copy within 60 days of the notice if your report was used.

3.      Check for errors. Dispute inaccurate items with the credit bureau and the company that reported them.

4.      Ask for reconsideration. Ask the lender whether a person can review the file, and send corrected information in writing.

5.      Keep records. If you suspect discrimination, you can complain to the CFPB or your state regulator.

A lender is not required by federal law to grant a human review. Some choose to offer one.

How do banks use chatbots and generative AI in customer service?

Chatbots handle routine requests, such as balances, card controls, transaction questions, and FAQs, and route other requests to staff. Older bots follow scripts. Newer ones use large language models to answer in free-form language.

In a June 2023 issue spotlight, the CFPB found that each of the 10 largest commercial banks used chatbots of varying complexity. It cited an industry estimate that about 98 million people, roughly 37% of the U.S. population, interacted with a bank chatbot in 2022. The bureau flagged risks: inaccurate answers, failing to recognize when a customer invokes legal rights, privacy and security weaknesses, and 'doom loops' that trap customers without a path to a person. The spotlight says it imposes no obligations. Current bureau priorities differ, so treat it as a description of risks, not today's enforcement posture.

A company-reported example: In a March 10, 2026 press release, Bank of America said its virtual assistant Erica, launched in 2018, had passed 3.2 billion client interactions. That is the bank's own figure and says nothing about answer quality or how it compares with other banks. Separately, trade publication The Financial Brand reported on August 19, 2026 that the bank is adding generative AI to an internal employee tool and wants it to work well before using it in customer-facing applications without a human in between. That is secondary reporting.

Can you reach a human instead of a chatbot?

We found no general federal right to a human representative. Bank policies vary. Illustrative example: Priya disputes a card charge, but the chat assistant keeps repeating the same menu.

•       Type 'agent' or 'representative,' or call the number on the back of your card.

•       Use the bank's secure message center or visit a branch.

•       Note dates, times, and screenshots.

•       Report an unauthorized electronic transfer promptly, and within 60 days of the statement that shows it. Keep proof of when you reported.

•       If you cannot get a response, you can submit a complaint to the CFPB or your bank's regulator.

How do banks use AI for AML, KYC, and compliance?

Federal law requires banks to verify customer identities and watch for suspicious activity. AI helps by checking ID documents, monitoring transactions for patterns linked to money laundering or fraud, matching names against sanctions lists, and ranking alerts so investigators see the riskiest first.

Key terms

•       KYC (know your customer): The process of verifying who a customer is and understanding the expected use of the account.

•       AML (anti-money laundering): Rules and controls meant to stop criminals from moving illegal money through the financial system.

•       Transaction monitoring: Ongoing review of account activity for patterns that may indicate illegal activity.

An account review can follow unusual activity, such as a large first-time deposit, rapid movement of funds, or ID details that do not match. Federal law generally prohibits a bank from telling you whether it filed a suspicious activity report, so the bank may not explain why it restricted your account.

The April 2026 model risk guidance superseded the 2021 interagency statement on model risk for BSA/AML systems, so banks are now expected to manage those models under the revised guidance.

Illustrative example, with no real bank: Daniel, a freelancer, receives an $18,000 wire from a new client. The bank restricts his account pending review. Documents that typically help include the contract, invoices, proof of identity, and records showing where the money came from. Respond by the bank's deadline, call the number on your card to confirm requests are real, and ask which documents it needs. If the review drags on, ask for a supervisor or the complaints department, then consider a complaint to the CFPB or the bank's regulator.

Illustrative example for a small business: A shop that normally runs about $20,000 a month in card sales takes $90,000 in one week after a viral post, 4.5 times its usual volume. The payment processor holds funds for review. Contact the processor through its official channel, send invoices, shipping records, and campaign proof, and warn it before planned promotions. Consumer protections such as Regulation E generally cover consumer accounts, so business agreements may set different terms.

How do banks use AI for personalization, marketing, and internal work?

Banks use models to tailor alerts, spending insights, and product offers, and to speed internal work such as document review, summaries, and coding help. Bank of America describes Erica as giving proactive, personalized guidance, which is one company's description of this use.

What data do banks use? Typically account activity, balances, app and website behavior, and information described in the bank's privacy notice. Practices differ by bank.

Can you opt out? The Gramm-Leach-Bliley Act (GLBA) generally requires banks to give privacy notices and, with exceptions, lets you opt out of some sharing of your information with unaffiliated companies. We found no federal law giving a general right to stop a bank from using your data for its own analytics or to build its own models. State privacy laws vary and often carve out information covered by federal financial privacy law. Read your bank's privacy notice, check the settings in your app, and ask the bank directly.

The CFPB's open banking rule under Section 1033, finalized in October 2024, would give consumers more control over sharing account data with other providers. It is under reconsideration, and a Kentucky federal court barred the bureau from enforcing it during that process, according to compliance-industry reports. Check current status before relying on it.

Internal AI tools raise third-party risk. The April 2026 guidance says vendor reliance does not shift responsibility for model risk, so the bank still answers for outcomes.

How do criminals use AI against banks and customers?

Criminals use AI to make scams more convincing and cheaper to run, with cloned voices, fake video, synthetic identities, and polished phishing messages. Banks use AI to fight back, so both sides now rely on the same kind of technology.

Key terms

•       Deepfake: Realistic but fake audio, video, or images created with AI.

•       Synthetic identity fraud: Building a fake identity from a mix of real and invented details to open accounts or borrow money.

What the data shows. The FTC told Congress on March 25, 2026 that consumers filed 3 million fraud reports in 2025 and reported $15.9 billion in losses, up from 2.6 million reports and more than $12 billion in 2024. Imposter scams were the most reported, with more than 1 million reports and over $3.5 billion in losses. Investment scams caused the largest losses, at $7.9 billion. These figures cover all fraud, not only AI-assisted fraud.

The FBI's Internet Crime Complaint Center released its 2025 report on April 7, 2026. It logged 1,008,597 complaints and about $20.9 billion in reported losses. For the first time, it included a section on AI: 22,364 complaints with an AI connection and more than $893 million in losses. Because that count depends on what victims recognize and report, the true figure may be higher.

In a November 13, 2024 alert, FinCEN said banks had reported more suspicious activity involving deepfake media, including fake identity documents used to get past identity checks. The alert lists red flags for banks, such as inconsistent ID documents or a customer using a third-party webcam plug-in during live verification.

Illustrative example: A caller who sounds like your bank's fraud department says someone is trying to move $2,300 from your account. Caller ID shows your bank's name. The caller asks for the code just texted to you, or asks you to move money to a 'safe account.' Those are red flags. Here is what to do:

1.      Hang up. Do not press buttons or call back a number the caller gives you.

2.      Call the number on the back of your card or on the bank's official website.

3.      Never share one-time passcodes or passwords, and never move money to a 'safe account.'

4.      If you already sent money, call your bank immediately and ask about recalling the payment.

5.      Report the scam to the bank, to the FTC at ReportFraud.ftc.gov, and to the FBI at ic3.gov.

What are the benefits and risks of AI in banking?

AI can make fraud detection, credit decisions, and service faster and more consistent. The same tools can produce false alerts, opaque decisions, biased outcomes, and privacy and security problems. The table pairs each benefit with its risk and a documented safeguard or expectation.

Is AI in banking biased?

It can be, but it is not inherently biased or inherently fair. Models trained on historical data can repeat past patterns, which is why frameworks such as the NIST AI Risk Management Framework treat harmful bias as a risk to manage. Federal fair-lending law prohibits discrimination on protected bases regardless of technology. Many banks test their models, but testing practices and disclosures vary, and enforcement priorities differ by agency and over time.

Who regulates AI in banking?

No single regulator or AI-specific banking statute governs it. As of October 22, 2026, we found no federal statute that comprehensively regulates AI in banking. Instead, existing laws apply to AI-driven decisions, agencies issue guidance, and states are adding rules.

What does the April 2026 model risk guidance say?

On April 17, 2026, the Federal Reserve, OCC, and FDIC replaced the 2011 model risk framework (SR 11-7 and OCC 2011-12) with a risk-based approach. Banks should tailor model risk practices to their size, complexity, and risk. Validation should match each model's materiality. Using a vendor's model does not transfer responsibility. According to Davis Polk's summary, principles specific to AI are expected in future guidance. The revised guidance also superseded OCC's 1997 credit scoring examination guidance, per law-firm summaries.

What is the status of the CFPB?

The CFPB withdrew 67 guidance documents on May 12, 2025. Its funding has been contested: the administration argued the Federal Reserve could not fund it, and courts in Washington, D.C., California, and Oregon rejected that approach, according to the ABA Banking Journal on September 28, 2026. Law-firm analysts expected reduced supervision and enforcement in 2026. ECOA, FCRA, and Regulation E remain in force, and you can still submit complaints. Check the bureau's current status before relying on it.

What are your rights, and how can you protect yourself?

Your main rights come from existing laws, not AI-specific ones. The table separates law from bank policy.

If you cannot reach a human or resolve a problem, you can submit a complaint at consumerfinance.gov/complaint. For individual disputes, consider a legal aid organization, an attorney, or, for housing credit, a HUD-approved housing counselor. Some rules vary by state.

If you see this, do this

Fair-lending note: Credit decisions must not discriminate on prohibited bases, regardless of the technology used.

How do big banks, community banks, credit unions, and fintechs differ in using AI?

We found no authoritative U.S. comparison of AI adoption by institution size, so the patterns below are general, not measured. The UK survey found about one-third of AI use cases were third-party implementations, and the April 2026 guidance says banks may tailor model risk practices to their size and complexity.

What is next for AI in banking?

This section is an outlook, not settled fact. Banks and vendors are exploring agentic AI, which would act on multi-step tasks with less human prompting. Regulators have not finalized AI-specific model risk principles. Colorado's law takes effect January 1, 2027, and the EU's high-risk credit-scoring rules are now scheduled for December 2, 2027. Federal policy remains unsettled: the December 2025 executive order and a March 2026 White House legislative framework push toward a single national approach, but Congress had not passed a preempting AI law in the sources we reviewed. The CFPB's data-rights rule is under reconsideration. Meanwhile, fraud reports rose in 2025, so verification habits matter more, not less.

Common mistakes

1.      Assuming 'AI' means no human is involved, so there is no one to ask.

2.      Ignoring bank fraud alerts.

3.      Not setting up account alerts and multi-factor authentication.

4.      Skipping the adverse-action notice after a denial.

5.      Not checking your credit reports after a denial.

6.      Sharing one-time passcodes with a 'bank representative.'

7.      Trusting caller ID.

8.      Sending money to a 'safe account.'

9.      Relying on a chatbot for legal or tax conclusions.

10.   Giving up when a chatbot fails instead of escalating.

11.   Ignoring privacy notices and app privacy settings.

12.   Assuming scam losses are always reimbursed.

13.   Not documenting disputes with dates, names, and screenshots.

14.   Banking on public Wi-Fi.

15.   Reusing passwords.

16.   Assuming a flagged transaction means your account was hacked.

Common misconceptions

Quick-start checklist

Use these questions as a starting point. They are not a substitute for confirming details with your bank or a qualified professional.

•       Do I know how my bank alerts me to suspicious activity?

•       Have I set up alerts and multi-factor authentication?

•       Do I know how to reach a human at my bank?

•       Have I reviewed my credit reports?

•       Do I know where my bank's privacy notice and settings are?

•       Do I know how to verify a caller claiming to be my bank?

•       Do I know how to file a complaint?

Glossary

•       Adverse-action notice: A lender's notice that it denied or took other negative action on your application.

•       Agentic AI: AI that plans and carries out multi-step tasks with limited prompting.

•       Algorithmic bias / disparate impact: Systematically worse outcomes for a group, or a neutral practice that disproportionately harms a protected group.

•       Alternative data: Information beyond traditional credit-report data used to assess borrowers.

•       AML: Anti-money laundering rules and controls.

•       Anomaly detection: Finding activity that departs from a usual pattern.

•       Artificial intelligence (AI) in banking: Software performing tasks that normally need human judgment.

•       Behavioral biometrics: Device-use patterns, such as typing rhythm, used to confirm identity.

•       CFPB: Consumer Financial Protection Bureau, the federal consumer finance agency.

•       CIP: Customer Identification Program, rules requiring banks to verify identity at account opening.

•       Credit scoring model vs. underwriting model: A formula producing a score vs. a lender's system recommending a decision.

•       Deepfake: AI-made fake audio, video, or images.

•       ECOA: Equal Credit Opportunity Act, which bars credit discrimination on prohibited bases.

•       EU AI Act: The European Union's AI law, which treats credit scoring as high-risk.

•       Explainability: Ability to explain in plain terms why a model gave a result.

•       False positive vs. false negative: A legitimate activity flagged as fraud vs. real fraud missed.

•       FCRA: Fair Credit Reporting Act, governing credit reports and related notices.

•       FDIC: Federal Deposit Insurance Corporation, which insures deposits and supervises certain banks.

•       FFIEC: Federal Financial Institutions Examination Council, an interagency body setting examination standards.

•       FinCEN: Financial Crimes Enforcement Network, the Treasury bureau overseeing anti-money laundering rules.

•       Fraud detection model / risk score: A model and its rating of how likely activity is fraud.

•       Generative AI: AI that creates new text, images, code, or audio.

•       GLBA: Gramm-Leach-Bliley Act, which requires financial privacy notices.

•       Human-in-the-loop: A person reviews or can override automated output.

•       KYC: Know your customer, verifying who a customer is.

•       Large language model (LLM): A generative AI system trained on large amounts of text.

•       Machine learning: Models that learn patterns from data.

•       Model risk management: Validating, monitoring, and governing models to limit harm from errors.

•       Natural language processing: Helping computers understand human language.

•       NIST AI RMF: A voluntary AI risk management framework from the National Institute of Standards and Technology.

•       OCC: Office of the Comptroller of the Currency, which supervises national banks.

•       Open banking: Letting consumers share account data with providers they authorize.

•       Predictive AI: AI that estimates an outcome.

•       Regulation B: The rule implementing ECOA.

•       Regulation E: The rule implementing the Electronic Fund Transfer Act, covering unauthorized transfers and error resolution.

•       Rules-based system vs. machine-learning model: Fixed instructions vs. data-learned patterns.

•       SAR: Suspicious activity report, a confidential report banks file with FinCEN.

•       Synthetic identity fraud: Fraud using a fake identity built from real and invented details.

•       Third-party (vendor) risk: Risk from relying on outside providers.

•       Transaction monitoring: Ongoing review of account activity for suspicious patterns.

•       UDAAP: Unfair, deceptive, or abusive acts or practices, prohibited under the CFPA.

Frequently asked questions

How do banks use AI?

Banks use AI mainly to detect fraud, support credit decisions, answer customer questions, screen for money laundering, personalize offers, and automate internal tasks such as summarizing documents. Most of it runs in the background, and the amount of human review varies by bank and use case. Many systems called AI are traditional statistical models or fixed rules.

What are examples of AI in banking?

Examples include fraud-scoring models that review card payments, credit-risk models that support loan decisions, chatbots that answer account questions, and identity-verification tools. In a March 10, 2026 press release, Bank of America said its virtual assistant Erica had passed 3.2 billion interactions since 2018. That figure is the bank's own and is not independently verified.

How do banks use AI for fraud detection?

Models compare each payment or login with your usual behavior and with known fraud patterns, then produce a risk score. Depending on the score, the bank may approve the transaction, decline it, alert you, require extra verification, or send it to a human analyst. Banks rarely publish the exact signals or thresholds they use.

Why was my legitimate transaction flagged or declined?

Fraud is rare, so even a small false-alert rate flags many legitimate purchases. In our illustrative example, a model that catches 90% of fraud still produces alerts of which only about 15% are real fraud. Unusual amounts, new merchants, travel, or a new device can trigger a flag. A flag does not mean your account was hacked. Respond through your bank's app or the number on your card.

Can AI deny my loan?

A lender can use automated models to support or make a credit decision, and the degree of human review varies by lender and product. Federal law still applies: lenders may not discriminate on prohibited bases, and a denial must come with specific reasons or instructions for requesting them. We found no federal right to a human review, though some lenders offer one.

Does a human review AI loan decisions?

It depends on the lender, product, and loan size. Lenders generally use automated screening for routine decisions and route exceptions to staff, but we found no authoritative U.S. data on how common this is. A 2024 UK regulator survey found 55% of AI use cases involved some automated decision-making. Ask your lender how to request a person's review.

What if I'm denied credit?

The lender must give you an adverse-action notice with specific reasons, or tell you how to ask for them within 60 days. If a credit report was used, you also receive the score used, the bureau's contact details, and the right to a free report within 60 days and to dispute errors. Review the notice, check the report, and ask for reconsideration.

Do banks use alternative data or AI to set credit limits and pricing?

Some lenders use models and alternative data, such as bank-account cash flow, to assess borrowers and set terms. We found no official source measuring how common this is at banks, and lenders rarely disclose their models. Fair-lending law applies to limits and pricing as well as approvals. Terms based on a credit report may trigger a notice.

Are bank chatbots safe?

Chatbots can handle routine tasks, but the CFPB's June 2023 spotlight documented risks: inaccurate answers, failure to recognize when you invoke legal rights, privacy and security weaknesses, and loops with no path to a person. Use your bank's official app, never share one-time passcodes in chat, and confirm important answers in writing.

Can I reach a human instead of a chatbot?

Often yes, but we found no general federal right to a human representative, and bank policies vary. Try typing 'agent,' calling the number on your card, using secure messaging, or visiting a branch. Keep dates and screenshots. If you cannot get help with a dispute, you can submit a complaint to the CFPB or your bank's regulator.

How do banks use generative AI?

Reported uses include employee tasks such as summarizing documents, drafting text, and coding help, with more caution for customer-facing roles. The Financial Brand reported on August 19, 2026 that Bank of America is adding generative AI to an internal employee tool. Bank claims are self-reported, so check each bank's own statements.

How do banks use AI for AML and KYC, and why might my account be reviewed?

Banks use AI to check identity documents, monitor transactions, match names against sanctions lists, and rank alerts for investigators. A review can follow unusual activity, mismatched ID details, or sudden large transfers. Federal law generally bars banks from telling you whether they filed a suspicious activity report, so explanations may be limited. Respond promptly with documents.

Do banks use my data to train AI, and can I opt out?

Banks describe how they collect and use data in privacy notices, and practices vary. GLBA generally gives you notice and a right to opt out of some sharing with unaffiliated companies, with exceptions. We found no federal law giving a general right to stop a bank from using your data for its own models. Check your notice, app settings, and state law, and ask your bank.

How are criminals using AI against bank customers?

Reported tactics include cloned voices, deepfake video, synthetic identities, and polished phishing messages. The FBI's 2025 report logged 22,364 AI-related complaints with more than $893 million in losses. Because the count depends on what victims recognize, the true figure may be higher. FinCEN warned in November 2024 about deepfakes used to get past bank identity checks.

Is AI in banking biased?

It can be, but it is not inherently biased or inherently fair. Models trained on historical data can repeat past patterns, so frameworks such as the NIST AI Risk Management Framework treat harmful bias as a risk to manage. Federal fair-lending law prohibits discrimination on protected bases regardless of technology, and many banks test models, though practices vary.

Who regulates AI in banking?

No single AI regulator exists. The Fed, OCC, and FDIC set supervisory expectations, such as the April 17, 2026 model risk guidance. The CFPB enforces consumer finance laws, FinCEN oversees AML rules, and states are adding their own laws. Existing laws such as ECOA, FCRA, and Regulation E apply regardless of technology. Federal AI policy is still in flux.

Is there a federal AI banking law?

As of October 22, 2026, we found no federal statute that comprehensively regulates AI in banking. Existing laws still apply, and agencies have issued guidance, including the April 2026 model risk guidance and Treasury's February 2026 AI resources. A December 2025 executive order seeks to challenge conflicting state AI laws, but an executive order is not a statute.

Does Regulation E protect me from AI-powered scams?

Regulation E limits your liability for unauthorized electronic transfers, generally $50 if you report within two business days and up to $500 after. Whether a payment you initiated after being tricked counts as unauthorized is contested, and we found no federal rule requiring reimbursement. Some banks and networks have voluntary policies, which are policy, not law. Report fast.

Is it safe to bank with a bank that uses AI?

AI is neither automatically safer nor riskier. It adds capabilities and new risks, and regulators expect banks to govern their models, including vendor tools. Deposit insurance at insured banks and consumer-protection laws do not depend on whether a bank uses AI. Safety still depends on habits: alerts, multi-factor authentication, verifying callers, and reviewing statements.

What is agentic AI in banking?

Agentic AI can plan and carry out multi-step tasks with limited prompting, such as gathering documents or handling a service request from start to finish. Banks and regulators are still working out oversight. According to one law-firm summary, the April 2026 model risk guidance signals that AI-specific principles will follow. Treat current claims as early-stage outlook.

How do community banks and credit unions use AI?

Smaller institutions generally rely more on vendors for tools such as fraud monitoring and chatbots, though we found no authoritative U.S. comparison by size. The April 2026 guidance says vendor reliance does not transfer responsibility for model risk. The ICBA noted that Treasury's AI risk framework is designed to scale for community banks and multinational institutions alike.

How can I protect myself and use my rights when AI is involved?

Turn on account alerts and multi-factor authentication, use the bank's official app, and verify callers by hanging up and calling the number on your card. Read adverse-action notices, check your credit reports after a denial, and keep records of disputes. If the bank does not resolve a problem, file a CFPB complaint or contact your state regulator.

Sources

Government and regulators

•       Federal Reserve, OCC, and FDIC. Revised interagency guidance on model risk management (Fed SR 26-2; OCC Bulletin 2026-13; FDIC FIL-15-2026), April 17, 2026. OCC: https://www.occ.gov/news-issuances/bulletins/2026/bulletin-2026-13.html. FDIC: https://www.fdic.gov/news/press-releases/2026/agencies-issue-revised-model-risk-guidance

•       CFPB. Chatbots in Consumer Finance (issue spotlight), June 2023. https://files.consumerfinance.gov/f/documents/cfpb_chatbot-issue-spotlight_2023-06.pdf

•       CFPB. CFPB Issue Spotlight Analyzes 'Artificial Intelligence' Chatbots in Banking (press release), June 2023. https://www.consumerfinance.gov/about-us/newsroom/cfpb-issue-spotlight-analyzes-artificial-intelligence-chatbots-in-banking

•       CFPB. What is a notice of adverse action? (Ask CFPB). https://www.consumerfinance.gov/ask-cfpb/what-is-a-notice-of-adverse-action-en-1253/

•       CFPB Circular 2022-03, adverse action notification requirements for credit decisions based on complex algorithms (June 14, 2022), shown as withdrawn by 90 Fed. Reg. 20,084 (May 12, 2025), via the NCLC library: https://library.nclc.org/companion-material/consumer-financial-protection-circular-2022-03-adverse-action-notification

•       Federal Register, July 15, 2011, Regulation B and FCRA adverse-action model notices and credit score disclosures. https://www.govinfo.gov/content/pkg/FR-2011-07-15/html/2011-17585.htm

•       FTC. Testimony before the Joint Economic Committee on the rising scam economy, March 25, 2026. https://www.ftc.gov/system/files/ftc_gov/pdf/ftc-testimony-jec-hearing-on-the-rising-scam-economy.pdf. Press release: https://www.ftc.gov/news-events/news/press-releases/2026/03/ftc-testifies-joint-economic-committee-agencys-efforts-combat-fraud

•       FinCEN. Alert FIN-2024-Alert004, Fraud Schemes Involving Deepfake Media Targeting Financial Institutions, November 13, 2024. https://fincen.gov/news/news-releases/fincen-issues-alert-fraud-schemes-involving-deepfake-media-targeting-financial

•       Bank of England and FCA. Artificial intelligence in UK financial services, 2024 (November 2024). https://www.bankofengland.co.uk/report/2024/artificial-intelligence-in-uk-financial-services-2024

Company-reported

•       Bank of America. BofA AI and Digital Innovations Fuel 30 Billion Client Interactions (press release), March 10, 2026. https://newsroom.bankofamerica.com/content/newsroom/press-releases/2026/03/bofa-ai-and-digital-innovations-fuel-30-billion-client-interacti.html

Secondary sources (law-firm, industry, and trade press), used where primary text was not directly reviewed

•       Davis Polk. Key changes under the federal banking agencies' revised model risk management guidance, April 2026. https://www.davispolk.com/sites/default/files/2026-04/key-changes-under-the-federal-banking-agencies-revised-model-risk-management-guidance.pdf

•       KPMG. Model Risk Management: Revised Interagency Guidance (Reg Alert), April 2026. https://kpmg.com/us/en/articles/2026/model-risk-management-revised-interagency-guidance-reg-alert.html

•       JD Supra. Agencies Overhaul Model Risk Management Guidance for Banks: Here's What Changed. https://www.jdsupra.com/legalnews/agencies-overhaul-model-risk-management-9027604/

•       Holland & Knight. CFPB Rescinds 67 Guidance Documents, May 12, 2025. https://www.hklaw.com/en/insights/publications/2025/05/cfpb-rescinds-67-guidance-documents

•       ABA Banking Journal. Third court rules against Trump administration over CFPB funding, September 28, 2026. https://bankingjournal.aba.com/2026/09/third-court-rules-against-trump-administration-over-cfpb-funding/

•       ICBA. New AI Risk Management Guides Can Help Community Banks (describing Treasury's AI Lexicon and Financial Services AI Risk Management Framework, February 2026). https://www.icba.org/w/ai-risk-management-guides-for-community-banks [VERIFY: add link to Treasury's primary release]

•       SecureWorld. FBI: AI-Enabled Fraud Topped $893M in 2025 (summary of the FBI IC3 2025 Internet Crime Report, April 7, 2026). https://www.secureworld.io/industry-news/ai-enabled-fraud-topped-893m-fbi [VERIFY: add link to the primary report at ic3.gov]

•       Eckert Seamans. Colorado Repeals and Replaces Its Landmark AI Statute (SB 26-189), June 12, 2026. https://www.eckertseamans.com/legal-updates/colorado-repeals-and-replaces-its-landmark-ai-statute-what-businesses-need-to-know

•       White & Case. State AI laws under federal scrutiny: Executive Order 14365. https://whitecase.com/insight-alert/state-ai-laws-under-federal-scrutiny-key-takeaways-executive-order-establishing

•       Gibson Dunn. EU AI Act Omnibus Agreement. https://www.gibsondunn.com/eu-ai-act-omnibus-agreement-postponed-high-risk-deadlines-and-other-key-changes/

•       Secure Privacy. EU AI Act Digital Omnibus: new high-risk deadlines after Council approval. https://secureprivacy.ai/blog/eu-ai-act-digital-omnibus-the-new-high-risk-ai-deadlines-after-council-approval; Colorado ADMT Act 2026 guide (California ADMT dates). https://secureprivacy.ai/blog/colorado-admt-act-2026-guide

•       Banker's Compliance Consulting. Section 1033 Compliance Date Further Delayed. https://blog.bankerscompliance.com/en/section-1033-compliance-date-further-delayed

•       Davis Wright Tremaine. CFPB unauthorized transfer consumer liability (Regulation E FAQs), 2021. https://www.dwt.com/blogs/financial-services-law-advisor/2021/06/cfpb-unauthorized-transfer-consumer-liability

•       A&O Shearman. Bank of England and FCA findings on the third AI survey. https://finreg.aoshearman.com/bank-of-england-and-uk-financial-conduct-authorit

•       The Financial Brand. BofA Augments Internal EricaAssist with GenAI, August 19, 2026. https://thefinancialbrand.com/news/banking-technology/bofa-augments-internal-ericaassist-with-genai-eyes-erica-virtual-assistant-next-199107

Where to complain or report: CFPB (consumerfinance.gov/complaint), FTC (ReportFraud.ftc.gov), FBI IC3 (ic3.gov), HUD for housing discrimination, and your state regulator or attorney general.

Conclusion

Banks use AI mostly to detect fraud, support credit and compliance decisions, and handle service and operations, often with human oversight that varies by use case. The technology brings real benefits, such as speed and pattern detection, and real risks, including false alerts, opaque decisions, bias, privacy exposure, and vendor dependence. Existing consumer-protection, fair-lending, credit-reporting, and privacy laws still apply whether or not AI is involved.

Agency guidance, state laws, and bank practices are changing, so confirm details with official sources and your bank. You have rights, including notices of the reasons for a credit denial and limits on liability for unauthorized transfers, and you have practical steps you can take. Fraud involving AI is growing, so verification habits matter. This guide is a starting framework, not a final word.