Bill Text: NY S08677 | 2023-2024 | General Assembly | Amended

NOTE: There are more recent revisions of this legislation. Read Latest Draft

---

Bill Title: Directs every peer-to-peer mobile service to require users to create a personal identification code associated with the user's account that is required to be used when certain actions are taken and to require users to set a monetary amount for intended transfers above which the use of a personal identification number will be required to authenticate the user's identity.

Spectrum: Partisan Bill (Democrat 1-0)

Status: (Introduced) 2024-06-05 - SUBSTITUTED BY A9340A [S08677 Detail]

Download: New_York-2023-S08677-Amended.html

---

                STATE OF NEW YORK
        ________________________________________________________________________

                                         8677--A

                    IN SENATE

                                    February 28, 2024
                                       ___________

        Introduced  by Sen. HOYLMAN-SIGAL -- read twice and ordered printed, and
          when printed to be committed to the Committee on Internet and Technol-
          ogy --  committee  discharged,  bill  amended,  ordered  reprinted  as
          amended and recommitted to said committee

        AN  ACT  to  amend the general business law, in relation to peer-to-peer
          mobile payment service security; and to amend the  financial  services
          law,  in  relation  to  authorizing  the financial frauds and consumer
          protection unit to enforce such provisions

          The People of the State of New York, represented in Senate and  Assem-
        bly, do enact as follows:

     1    Section  1. This act shall be known and may be cited as the "Financial
     2  App Security Act".
     3    § 2. The general business law is amended by adding a new section  399-
     4  jj to read as follows:
     5    § 399-jj. Peer-to-peer  mobile  payment  service  security. 1. For the
     6  purposes of this section:
     7    (a) "Peer-to-peer  mobile  service"  means  any  app  or  app  service
     8  provided directly to users by an entity that is not an insured deposito-
     9  ry institution and that:
    10    (1)  directly  or  indirectly  receives  and  holds money belonging to
    11  users, or  that  facilitates  transactions  between  insured  depository
    12  institutions but exists separately from said institutions; and
    13    (2)  that  allows users to send and receive money through their mobile
    14  devices from a linked bank account or credit card or debit card using  a
    15  recipient's cell phone number or email address or username.
    16    (b)  "Biometric authentication" means either fingerprint or face iden-
    17  tification for access to a service, or verification of an in-app action.
    18    2. Every peer-to-peer mobile service shall require users to  create  a
    19  personal  identification code associated with the user's account that is
    20  a minimum of four numeric characters associated with the user's account.
    21  When certain actions are taken, including but not  limited  to,  actions
    22  defined in subdivision four of this section, the personal identification
    23  number  must  be  used  to authenticate the user's identity.  The use of

         EXPLANATION--Matter in italics (underscored) is new; matter in brackets
                              [ ] is old law to be omitted.
                                                                   LBD14473-05-4
        S. 8677--A                          2

     1  such personal identification code may not be substituted for any form of
     2  biometric authentication.
     3    3.  Every  peer-to-peer  mobile  service  shall require users to set a
     4  monetary amount for intended transfers above which the use of a personal
     5  identification number will be required to authenticate the user's  iden-
     6  tity and provide an option for users to opt-in of such requirement.
     7    4.  The  following  actions  require  use of a personal identification
     8  number when using a peer-to-peer mobile service:
     9    (a) any payment transaction initiated by the user exceeding the  mone-
    10  tary limit set by said user;
    11    (b)  payment  transactions initiated by the user that would bring said
    12  users twenty-four-hour payment transaction amount exceeding the monetary
    13  limit set by said user starting from the first transaction;
    14    (c) payment transactions initiated by the user to another  user  whose
    15  account  was  created  less  than twenty-four hours prior to said trans-
    16  action;
    17    (d) any  payment  transactions  initiated  by  the  user  after  three
    18  successful  payment  transactions  initiated  by the user have been made
    19  within sixty minutes for amounts under the user's set monetary limit;
    20    (e) any attempt to sign in to the service by the user to a new  and/or
    21  unrecognized device; and
    22    (f)  any  attempt to sign in to the service after the account password
    23  has been reset in any manner, including but  not  limited  to,  password
    24  recovery service offered by the service.
    25    5.  A  user's  account will be locked after five unsuccessful attempts
    26  within a twenty-four hour period to input said user's personal identifi-
    27  cation number when required. The peer-to-peer mobile service can  unlock
    28  said  account  after  twenty-four  hours  if said user is able to verify
    29  their identity through a telephone call or security questions created by
    30  the user.
    31    6. Any payment transactions initiated by the user after three success-
    32  ful payment transactions initiated by the user  have  been  made  within
    33  sixty  minutes  after the first successful payment to the same recipient
    34  for amounts, despite the input of the user's correct personal  identifi-
    35  cation  number,  will  require  additional  identity verification of the
    36  recipient if:
    37    (a) any of the transactions exceed the greater amount  of  either  the
    38  user's set monetary limit or one thousand dollars; or
    39    (b) the aggregate amount of the transactions exceed the greater amount
    40  of either the user's set monetary limit or one thousand dollars; or
    41    (c) the recipient is a first time transaction to the user.
    42    7.  Any transaction that could be the result of fraud can be cancelled
    43  by the user making the payment after timely notification is made to  the
    44  peer-to-peer mobile service.
    45    8.  Any  peer-to-peer  mobile  service  that does not comply with this
    46  section is prohibited from offering its services to  users  residing  in
    47  the state of New York.
    48    §  3.  Subsection  (b) of section 403 of the financial services law is
    49  amended to read as follows:
    50    (b) The financial frauds and consumer protection unit shall be a qual-
    51  ified agency, as defined in section eight  hundred  thirty-five  of  the
    52  executive  law,  to  enforce  the provisions of this article and article
    53  four of the insurance law and  article  II-B  of  the  banking  law  and
    54  section 399-jj of the general business law.
    55    § 4. This act shall take effect on the one hundred eightieth day after
    56  it shall have become a law.