Cybercrime Cases in Uzbekistan Surge 13-Fold

Tashkent, Uzbekistan (UzDaily.uz) — Registered cybercrime cases in Uzbekistan increased from 4,800 to more than 62,000 over the past five years, while the Central Bank of Uzbekistan is preparing to transition to risk-based supervision of bank cybersecurity. The figures and regulatory plans were disclosed by speakers during the "Trust at the Speed of AI: Cyber Resilience & Fraud Defence for Payment Rails" session at the Silk Road Finance and Technology Forum in Tashkent on 25 August 2026.

Session moderator Artyom Saidov, Head of Cybersecurity Practice at KPMG Uzbekistan, noted that the share of digital payment users in the country rose from 39 percent in 2021 to 72 percent in 2025.

According to Ministry of Internal Affairs data presented at the session, total damage from cybercrime over the five-year period exceeded 3.8 trillion soums, with more than half of that amount occurring in 2025.

Mirzabek Bobodjanov, Head of Department at the CERT-CBU Cybersecurity Center under the Central Bank of Uzbekistan, reported that banks and payment organizations have stopped approximately 18 million suspicious transactions since the start of 2026, driven by mandatory implementation of AI-based anti-fraud systems across banks.

Bobodjanov cited a social engineering case in which fraudsters initiated a video call posing as a central bank employee using deepfake technology to alter their appearance. The victim verified the employee's photo on the official central bank website before transferring a large sum to the scammers. He emphasized that while anti-fraud systems protect clients, they cannot offer a complete guarantee due to varying levels of public financial literacy.

Zokhir Mirzaev, Director of Information Security at Asakabank, stated that the influx of new payment system users means many are accessing digital financial services for the first time without basic data protection skills. He added that commercial banks bear a disproportionate share of the data protection burden because most small and medium-sized enterprise clients lack internal information security units.

Umid Khakimov, CEO of Ipak Yuli Bank, reported that the bank serves over 5 million clients, has issued more than 5 million Visa and local cards, and operates roughly 900 ATMs and over 20,000 POS terminals. He noted that AI application helps reduce costs amid growing competition, though solutions are implemented only after risk assessments, prioritizing security infrastructure over cost optimization.

Bobodjanov announced that the central bank is shifting from compliance-oriented supervision to a risk-based model. Under a digitalization project, regulators developed a banking sector cybersecurity strategy and a risk assessment methodology based on organizational maturity levels.

A new regulatory framework featuring four requirement tiers based on organizational scale and digital maturity is scheduled for launch next year, imposing stricter mandates on systemically important banks. Bobodjanov also noted that an incident-sharing platform operating among commercial banks launched approximately two months prior to the forum, with information sharing gradually improving after initial hesitancy.

Nikolay Belshtein, Senior Director for Consulting and Analytics at Visa CEMEA, stated that perpetrators increasingly target human trust rather than corporate infrastructure, using generative AI to produce phishing emails and deepfakes within minutes. He emphasized that real-time incident information sharing remains the single most critical measure for maintaining payment system trust.