When your customer sends an AI agent instead of writing to you

This week the biggest banks in the country admitted they have a new kind of customer. CBS News reported on October 23 that banks are finding personal AI agents inside customer accounts. Customers handed their username and password to an assistant, and the assistant went to work. Mostly it did what it was told. In one example it called the bank with a complaint without checking with the account holder first.

JPMorgan’s answer was blunt. Jamie Dimon said on the bank’s earnings call that outside agents won’t operate inside JPMorgan, and the bank blocks them from acting on retail accounts. Reuters reported that Citi, Wells Fargo, Bank of America and Morgan Stanley are restricting them too. The compromise that keeps coming up is read-only access. An agent can look at balances. It can’t move money.

You probably don’t run a bank. But the same agents are headed for your inbox and your chat window, and you won’t have a fraud team to decide what to do with them.

The volume is real

Zendesk’s CEO, Tom Eggemeier, told Newsweek about the time he asked an agent to renegotiate his cable, internet, streaming and phone plans. It contacted those companies 37 times over four days and saved him $3,150. He plans to have it check in every month.

Think about that from the other side. One customer, one goal, 37 contacts. The agent doesn’t get tired, doesn’t feel awkward asking twice, and doesn’t give up when the first answer is no. A recent ad from a contact-center vendor puts it simply: one issue can turn into three or more interactions. That’s a sales pitch, but the arithmetic holds.

So the first change is load. The second one matters more.

The real question is authority

When a message says “I’m an assistant acting for Dana Ruiz, please cancel order 4412 and refund it to her card,” what does your support system do?

A person on your team would hesitate. Who is this? Is Dana actually asking? An AI agent on your side might not hesitate at all, because the message is polite, specific and confident. Confidence is exactly what an agent writing on someone’s behalf is good at.

The banks landed on the right rule, and it applies to a shop with three employees as well as it applies to Chase. What a request is allowed to do depends on proof of who sent it, not on how convincing it sounds. That proof has to be checked by something other than the AI reading the message, because the AI reading the message is the thing being persuaded.

Here’s a simple way to sort it.

Public answers: anyone can have them

Hours, shipping times, your return window, whether you carry a product. Answer these for anyone, human or agent. Blocking a bot from reading your return policy protects nothing, and Eggemeier is right that customers will increasingly reach you through their own assistants. Make the public stuff easy to get.

Account answers: only to the verified customer

Order status, what’s on file, past purchases. These go only to someone who proved they’re the customer. That means a signed-in session or a reply to the email address you already have on file. A message that claims to speak for Dana doesn’t count until it shows up through a channel you can tie to Dana.

Changes and money: proposals, not actions

Cancellations, address changes, refunds. Even with a verified customer, these should be checked by fixed rules before anything happens. Within the policy you wrote, and under the limits you set, it can go through. Anything outside that waits for a person. This is the read-only compromise the banks reached, scaled down to a small business.

Where we come down

We built IMCeleste around this split before customer agents were in the news, because the problem is the same whether the persuasive message comes from a person or a bot. Celeste proposes and hard code decides. She doesn’t give account answers without a verified session, and anything that changes an order or moves money is checked against your rules in code, outside the conversation, where a confident message can’t talk its way past them.

She also goes live one topic at a time. You can let her answer shipping questions for everyone while refunds stay with your team until you’ve watched her handle them in practice and trust what you see. Here’s how that works.

Customer agents aren’t a reason to panic or to block everything that looks like a bot. Plenty of them will be your best customers, just in a hurry. But decide now what each kind of request is allowed to do, and make sure the thing enforcing it can’t be argued with.