Best Practices· 3 min read· By The SpideyChat Team

What a Bank Website Assistant Must Never Do

Banking sits inside strict regulation and high fraud risk. Myths about what a bank or building society website assistant can do, and the hard limits.


Banking is the sector where an assistant's limits matter most, for two reasons that pull in the same direction. The regulatory boundary around advice is strict, and the fraud risk around credentials is constant.

Here are the myths, and why each one matters.

Myth 1: checking a balance is a simple convenience

Reality: a website assistant answering from public pages has no access to accounts, and should never appear to. Anything account-specific belongs in an authenticated channel, and blurring that teaches customers to expect account access in places where it should not exist.

Myth 2: asking for a few details to verify is reasonable

Reality: it is the single most dangerous thing a bank's website could do. Customers are told constantly that a bank will never ask for a password or a one-time code. An assistant that asks for anything resembling credentials undermines every fraud message the bank sends.

Customer: Can you check why my payment failed? I can give you my card details. Assistant: Please do not share card details, passwords or codes here. The payments help page explains the common reasons a payment is declined. For anything specific to your account, please sign in to online banking or use the contact route shown there, where the team can verify you securely.

Myth 3: explaining products is advice

Reality: it is not, and it is valuable. Interest rates, eligibility criteria, fees, how to apply and what documents are needed are all publishable. What crosses the line is suggesting which product someone should choose, which is covered in where website answers end and regulated advice begins.

Myth 4: a customer in difficulty can be reassured

Reality: someone describing arrears, missed payments or financial hardship needs a real route to the support team and to free independent debt advice. Generic reassurance delays help and may imply forbearance the bank has not agreed.

Myth 5: fraud reports can wait in a queue

Reality: a customer reporting suspected fraud needs the fastest available route, prominently, without navigating a general enquiry flow. This is the banking equivalent of emergency routing.

Myth 6: vulnerable customers are a small minority

Reality: bereavement, illness, power of attorney and capacity issues arise constantly. These need a person, and the website's job is to make the right route obvious rather than to handle the conversation.

Myth 7: automation is inappropriate for banks

Reality: branch hours, product terms, how to open an account, what identification is needed, how to report a card lost and how to register a bereavement are all questions people ask constantly and struggle to find. Answering those well is genuinely useful, as member-owned institutions find, described in member questions credit unions answer every day.

Myth 8: promises can be softened

Reality: an assistant must never suggest an outcome, an approval or a timescale the bank has not published, which is the rule set out in what an AI receptionist must never promise and mirrored in other regulated fields, as in what a nutrition website must never prescribe.

Myth 9: complaints can be handled informally

Reality: complaints in financial services follow a defined process with timescales and rights attached. An assistant should capture the complaint and route it into that process, never attempt to resolve it or characterise it as something else, because how a complaint is logged affects what the customer is entitled to.

How SpideyChat handles it

SpideyChat for financial firms answers only from your published pages, never requests credentials, never accesses accounts and routes hardship, fraud and vulnerability to your team. You can see handover on the demo, and plans are on the pricing page.

Frequently asked questions

Can a bank chatbot access my account?
A website assistant answering from public pages cannot, and anything account-specific needs a verified channel.
Should a bank website assistant ever ask for a security code?
Never. Legitimate organisations do not request passwords or one-time codes, and an assistant that does trains customers to be defrauded.
Can a bank website recommend a product?
It can explain products and eligibility criteria, but recommending what someone should choose is regulated advice.

Want a 24/7 AI Employee for Your Website?

See how SpideyChat can answer customer questions, capture leads and handle enquiries while your team is offline.

No obligation. We will review your website and show you how SpideyChat could work for your business.

Keep reading