Bill Text: NY S08677 | 2023-2024 | General Assembly | Amended

---

Bill Title: Directs every peer-to-peer mobile service to require users to create a personal identification code associated with the user's account that is required to be used when certain actions are taken and to require users to set a monetary amount for intended transfers above which the use of a personal identification number will be required to authenticate the user's identity.

Spectrum: Partisan Bill (Democrat 1-0)

Status: (Introduced) 2024-06-05 - SUBSTITUTED BY A9340A [S08677 Detail]

Download: New_York-2023-S08677-Amended.html

---

                STATE OF NEW YORK
        ________________________________________________________________________

                                         8677--B

                    IN SENATE

                                    February 28, 2024
                                       ___________

        Introduced  by Sen. HOYLMAN-SIGAL -- read twice and ordered printed, and
          when printed to be committed to the Committee on Internet and Technol-
          ogy --  committee  discharged,  bill  amended,  ordered  reprinted  as
          amended  and  recommitted  to  said committee -- committee discharged,
          bill amended, ordered reprinted as amended  and  recommitted  to  said
          committee

        AN  ACT  to  amend the general business law, in relation to peer-to-peer
          mobile payment service security; and to amend the  financial  services
          law,  in  relation  to  authorizing  the financial frauds and consumer
          protection unit to enforce such provisions

          The People of the State of New York, represented in Senate and  Assem-
        bly, do enact as follows:

     1    Section  1. This act shall be known and may be cited as the "Financial
     2  App Security Act".
     3    § 2. The general business law is amended by adding a new section  399-
     4  jj to read as follows:
     5    § 399-jj. Peer-to-peer  mobile  payment  service  security. 1. For the
     6  purposes of this section:
     7    (a) "Peer-to-peer  mobile  service"  means  any  app  or  app  service
     8  provided directly to users by an entity that is not an insured deposito-
     9  ry institution and that:
    10    (1)  directly  or  indirectly  receives  and  holds money belonging to
    11  users, or  that  facilitates  transactions  between  insured  depository
    12  institutions but exists separately from said institutions; and
    13    (2)  whose primary functionality is to allow users to send and receive
    14  money through their mobile devices from a linked bank account or  credit
    15  card  or  debit  card  using  a  recipient's  cell phone number or email
    16  address or username.
    17    (b) "Biometric authentication" means either fingerprint or face  iden-
    18  tification for access to a service, or verification of an in-app action.
    19    2.  Every  peer-to-peer mobile service shall require users to create a
    20  personal identification code associated with the user's account that  is
    21  a minimum of four numeric characters associated with the user's account.
    22  When  certain  actions  are taken, including but not limited to, actions
    23  defined in subdivision four of this section, the personal identification
    24  number must be used to authenticate the user's identity.    The  use  of

         EXPLANATION--Matter in italics (underscored) is new; matter in brackets
                              [ ] is old law to be omitted.
                                                                   LBD14473-07-4
        S. 8677--B                          2

     1  such personal identification code may not be substituted for any form of
     2  biometric authentication.
     3    3.  Every  peer-to-peer  mobile  service  shall require users to set a
     4  monetary amount for intended transfers above which the use of a personal
     5  identification number will be required to authenticate the user's  iden-
     6  tity and provide an option for users to opt-in of such requirement.
     7    4.  The  following  actions  require  use of a personal identification
     8  number when using a peer-to-peer mobile service:
     9    (a) any payment transaction initiated by the user exceeding the  mone-
    10  tary limit set by said user;
    11    (b)  payment  transactions initiated by the user that would bring said
    12  users twenty-four-hour payment transaction amount exceeding the monetary
    13  limit set by said user starting from the first transaction;
    14    (c) payment transactions initiated by the user to another  user  whose
    15  account  was  created  less  than twenty-four hours prior to said trans-
    16  action;
    17    (d) any  payment  transactions  initiated  by  the  user  after  three
    18  successful  payment  transactions  initiated  by the user have been made
    19  within sixty minutes for amounts under the user's set monetary limit;
    20    (e) any attempt to sign in to the service by the user to a new  and/or
    21  unrecognized device; and
    22    (f)  any  attempt to sign in to the service after the account password
    23  has been reset in any manner, including but  not  limited  to,  password
    24  recovery service offered by the service.
    25    5.  A  user's  account will be locked after five unsuccessful attempts
    26  within a twenty-four hour period to input said user's personal identifi-
    27  cation number when required. The peer-to-peer mobile service can  unlock
    28  said  account  after  twenty-four  hours  if said user is able to verify
    29  their identity through a telephone call or security questions created by
    30  the user.
    31    6. Any payment transactions initiated by the user after three success-
    32  ful payment transactions initiated by the user  have  been  made  within
    33  sixty  minutes  after the first successful payment to the same recipient
    34  for amounts, despite the input of the user's correct personal  identifi-
    35  cation  number,  will  require  additional  identity verification of the
    36  recipient if:
    37    (a) any of the transactions exceed the greater amount  of  either  the
    38  user's set monetary limit or one thousand dollars; or
    39    (b) the aggregate amount of the transactions exceed the greater amount
    40  of either the user's set monetary limit or one thousand dollars; or
    41    (c) the recipient is a first time transaction to the user.
    42    7.  Any transaction that could be the result of fraud can be cancelled
    43  by the user making the payment after timely notification is made to  the
    44  peer-to-peer mobile service.
    45    8.  Any  peer-to-peer  mobile  service  that does not comply with this
    46  section is prohibited from offering its services to  users  residing  in
    47  the state of New York.
    48    §  3.  Subsection  (b) of section 403 of the financial services law is
    49  amended to read as follows:
    50    (b) The financial frauds and consumer protection unit shall be a qual-
    51  ified agency, as defined in section eight  hundred  thirty-five  of  the
    52  executive  law,  to  enforce  the provisions of this article and article
    53  four of the insurance law and  article  II-B  of  the  banking  law  and
    54  section three hundred ninety-nine-jj of the general business law.
    55    § 4. This act shall take effect on the one hundred eightieth day after
    56  it shall have become a law.