Uzbekistan to ban P2P transfers through websites

Tashkent, Uzbekistan (UzDaily.uz) — Uzbekistan will introduce new rules from 16 November to strengthen protection for financial services users against cyber fraud. Credit and payment organizations will be prohibited from processing P2P transfers through websites, while bank cards linked to an account will be temporarily deactivated when the account is accessed from a new device.

Credit and payment organizations will be allowed to set their own maximum P2P transfer amount that users can make without confirmation through a one-time password (OTP) or another authentication method. The limit will be determined based on each organization’s risk management policy.

Credit and payment organizations will be responsible for fraudulent transactions carried out without additional confirmation.

The new requirements also introduce additional safeguards when users access a mobile application from another device. To obtain the password for an existing account, users will have to undergo biometric identification. The same procedure will apply when attempting to access an account from a new device.

When an account is accessed from another device or a password is recovered, all bank cards linked to the account must automatically be deactivated. Reactivating the cards will require confirmation using an OTP code.

Separate requirements apply when threats are detected on a mobile device. If a financial organization identifies malicious software or signs that a device is being remotely controlled, it must immediately send the user a push notification and an SMS.

The notification must inform the customer that they need to contact the credit or payment organization to clarify the circumstances.

Additional confirmation will also be required before financial transactions are carried out through a mobile application. Before the transaction is confirmed, the organization must display a warning, after which the customer must independently confirm that the transaction is being made without interference from fraudsters.

The new rules also establish requirements for displaying personal data belonging to bank card holders. In mobile applications, the cardholder’s first and last name must be shown in partially masked form. The requirement also applies to participants in money transfers, with information about both the sender and recipient displayed with partially concealed personal data.