New rules protecting users from cyber fraud take effect in Uzbekistan on November 16. The main changes include a complete ban on money transfers through web interfaces and shifting financial liability for transactions without OTP codes to banks and payment services. UzDaily reports.
What happened
Credit and payment organizations will be banned from processing P2P transfers via websites. All transactional activity shifts to mobile apps, where security requirements are also tightening.
When logging into an account from a new device or recovering a password, users must pass biometric identification. At this point, all bank cards linked to the profile will automatically become inactive. To use them again, the client must confirm activation via a one-time OTP code.
The approach to limits has changed. Financial organizations can determine the maximum P2P transfer amount that does not require an OTP code, based on their own risk assessment systems. However, if fraudsters execute a transaction within this limit without additional confirmation, the payment organization itself will reimburse the damage.
New privacy and notification rules are also being introduced:
- The cardholder’s first and last name, as well as the sender and recipient data, must be partially masked in the app.
- Before confirming a transaction, the app must display a warning, and the client must confirm they are acting without outside interference.
- If the bank detects malware or signs of remote control on the device, it must immediately send the client a push notification and an SMS requesting them to contact support.
Country and market
Uzbekistan continues to systematically change the rules of the payment market, trying to curb the growth of social engineering and card fraud. For a long time, the main protection tool was blanket restrictions, which created friction for users.
The new set of requirements looks like an attempt to strike a balance: the regulator gives banks freedom in setting limits but strictly regulates the device change process, which fraudsters most often use to steal accounts.
Why it matters
For fintech companies, the ban on web transfers means closing an entire service channel. Although the share of such transactions in the market is small compared to mobile apps, some players will have to rebuild their product lines and focus entirely on mobile development.
Shifting liability for non-OTP transactions to the platforms themselves will force banks to invest in internal anti-fraud systems rather than simply writing off losses to customer negligence.
What’s next
The key task for banks and payment services until mid-November will be updating their app logic. They must implement automatic card deactivation upon device change and configure malware detection systems. This will require additional resources from development and information security teams.