Starting November 16, a new requirement is being introduced in Uzbekistan: when attempting to log into a banking application from a different device or when resetting a password, all cards associated with the account will be automatically set to an inactive state. To restore access to the cards, it is necessary to confirm this operation using a one-time OTP code.
These new rules were approved by a resolution of the Central Bank's board, which was officially registered by the Ministry of Justice on August 14. The document also introduces a restriction on transferring funds between cards via websites.
Nevertheless, credit and payment organizations retain the right to independently determine the maximum amount for P2P transfers that will not require an OTP code or any other form of confirmation. Any transactions exceeding this established limit must undergo additional authenticity verification.
In the event of a fraudulent transfer within the permitted limit without additional confirmation, the financial organization will bear the responsibility. Furthermore, access to password recovery and login from a new device will only be possible after passing biometric identification.
The system also provides protection against threats: if signs of remote control of a smartphone or infection with malware are detected, the organization is obliged to immediately notify the client via SMS and push notification. Before executing any operation, the user will be shown a notification requesting confirmation that they are acting independently, without the involvement of fraudsters.
Previously, information indicated that the Legislative Chamber had approved a bill in its second reading, which provides for compensation of damages to clients by banks and payment services in case of cybersecurity standard violations.
