S T A T E   O F   N E W   Y O R K
 ________________________________________________________________________
 
                                   9340
 
                           I N  A S S E M B L Y
 
                               March 6, 2024
                                ___________
 
 Introduced by M. of A. LEE -- read once and referred to the Committee on
   Consumer Affairs and Protection
 
 AN  ACT  to  amend the general business law, in relation to peer-to-peer
   mobile payment service security; and to amend the  financial  services
   law,  in  relation  to  authorizing  the financial frauds and consumer
   protection unit to enforce such provisions

   THE PEOPLE OF THE STATE OF NEW YORK, REPRESENTED IN SENATE AND  ASSEM-
 BLY, DO ENACT AS FOLLOWS:
 
   Section  1. This act shall be known and may be cited as the "Financial
 App Security Act".
   § 2. The general business law is amended by adding a new section  399-
 jj to read as follows:
   § 399-JJ. PEER-TO-PEER  MOBILE  PAYMENT  SERVICE  SECURITY. 1. FOR THE
 PURPOSES OF THIS SECTION:
   (A) "PEER-TO-PEER MOBILE SERVICE" MEANS ANY APP OR  APP  SERVICE  THAT
 ALLOWS USERS TO SEND AND RECEIVE MONEY FROM THEIR MOBILE DEVICES THROUGH
 A  LINKED BANK ACCOUNT OR CREDIT CARD OR DEBIT CARD USING ONLY A RECIPI-
 ENT'S CELL PHONE NUMBER OR EMAIL ADDRESS.
   (B) "BIOMETRIC AUTHENTICATION" MEANS EITHER FINGERPRINT OR FACE  IDEN-
 TIFICATION FOR ACCESS TO A SERVICE, OR VERIFICATION OF AN IN-APP ACTION.
   2.  EVERY  PEER-TO-PEER MOBILE SERVICE SHALL REQUIRE USERS TO CREATE A
 PERSONAL IDENTIFICATION CODE ASSOCIATED WITH THE USER'S ACCOUNT THAT  IS
 A  MINIMUM  OF  FOUR ALPHA-NUMERIC CHARACTERS ASSOCIATED WITH THE USER'S
 ACCOUNT. WHEN CERTAIN ACTIONS ARE TAKEN, INCLUDING BUT NOT  LIMITED  TO,
 ACTIONS  DEFINED IN SUBDIVISION FOUR OF THIS SECTION, THE PERSONAL IDEN-
 TIFICATION NUMBER MUST BE USED TO AUTHENTICATE THE USER'S IDENTITY.  THE
 USE OF SUCH PERSONAL IDENTIFICATION CODE MAY NOT BE SUBSTITUTED FOR  ANY
 FORM OF BIOMETRIC AUTHENTICATION.
   3.  EVERY  PEER-TO-PEER  MOBILE  SERVICE  SHALL REQUIRE USERS TO SET A
 MONETARY AMOUNT FOR INTENDED TRANSFERS ABOVE WHICH THE USE OF A PERSONAL
 IDENTIFICATION NUMBER WILL BE REQUIRED TO AUTHENTICATE THE USER'S  IDEN-
 TITY.
   4.  THE  FOLLOWING  ACTIONS  REQUIRE  USE OF A PERSONAL IDENTIFICATION
 NUMBER WHEN USING A PEER-TO-PEER MOBILE SERVICE:
 
  EXPLANATION--Matter in ITALICS (underscored) is new; matter in brackets
                       [ ] is old law to be omitted.
              

                                                            LBD14473-02-4
 A. 9340                             2
 
   (A) ANY PAYMENT TRANSACTION INITIATED BY THE USER EXCEEDING THE  MONE-
 TARY LIMIT SET BY SAID USER;
   (B)  PAYMENT  TRANSACTIONS INITIATED BY THE USER THAT WOULD BRING SAID
 USERS TWENTY-FOUR-HOUR PAYMENT TRANSACTION AMOUNT EXCEEDING THE MONETARY
 LIMIT SET BY SAID USER STARTING FROM THE FIRST TRANSACTION;
   (C) PAYMENT TRANSACTIONS INITIATED BY THE USER TO ANOTHER  USER  WHOSE
 ACCOUNT  WAS  CREATED  LESS  THAN TWENTY-FOUR HOURS PRIOR TO SAID TRANS-
 ACTION;
   (D) PAYMENT TRANSACTIONS INITIATED BY THE USER THAT APPEAR  SUSPICIOUS
 BASED  ON  SAID USER'S BEHAVIOR AND/OR GEOLOCATION PROFILE AS DETERMINED
 BY THE SERVICE'S EXISTING BEHAVIORAL ANALYTICS;
   (E) ANY  PAYMENT  TRANSACTIONS  INITIATED  BY  THE  USER  AFTER  THREE
 SUCCESSFUL  PAYMENT  TRANSACTIONS  INITIATED  BY THE USER HAVE BEEN MADE
 WITHIN SIXTY MINUTES FOR AMOUNTS UNDER THE USER'S SET MONETARY LIMIT;
   (F) ANY ATTEMPT TO SIGN IN TO THE SERVICE BY THE USER TO A NEW  AND/OR
 UNRECOGNIZED DEVICE;
   (G)  ANY  ATTEMPT TO SIGN IN TO THE SERVICE AFTER THE ACCOUNT PASSWORD
 HAS BEEN RESET IN ANY MANNER, INCLUDING BUT  NOT  LIMITED  TO,  PASSWORD
 RECOVERY SERVICE OFFERED BY THE SERVICE; AND
   (H) ANY ATTEMPT TO SIGN IN TO THE SERVICE BY THE USER AFTER THE DEVICE
 PASSWORD HAS BEEN RESET.
   5.  A  USER'S  ACCOUNT WILL BE LOCKED AFTER FIVE UNSUCCESSFUL ATTEMPTS
 WITHIN A TWENTY-FOUR HOUR PERIOD TO INPUT SAID USER'S PERSONAL IDENTIFI-
 CATION NUMBER WHEN REQUIRED. THE PEER-TO-PEER MOBILE SERVICE CAN  UNLOCK
 SAID  ACCOUNT  AFTER  TWENTY-FOUR  HOURS  IF SAID USER IS ABLE TO VERIFY
 THEIR IDENTITY THROUGH A TELEPHONE CALL.
   6. ANY PAYMENT TRANSACTIONS INITIATED BY THE USER AFTER THREE SUCCESS-
 FUL PAYMENT TRANSACTIONS INITIATED BY THE USER  HAVE  BEEN  MADE  WITHIN
 SIXTY  MINUTES  AFTER  THE FIRST SUCCESSFUL PAYMENT FOR AMOUNTS, DESPITE
 THE INPUT OF THE USER'S CORRECT  PERSONAL  IDENTIFICATION  NUMBER,  WILL
 HAVE  A  FORTY-EIGHT  HOUR HOLD BEFORE THE FUNDS WILL BE RELEASED TO THE
 RECIPIENT IF:
   (A) ANY OF THE TRANSACTIONS EXCEEDS THE USER'S SET MONETARY LIMIT; OR
   (B) THE AGGREGATE AMOUNT OF THE TRANSACTIONS EXCEEDS  THE  USER'S  SET
 MONETARY LIMIT.
   7.  ANY TRANSACTION PLACED ON A FORTY-EIGHT-HOUR HOLD CAN BE CANCELLED
 BY THE USER MAKING THE PAYMENT IN THE EVENT OF FRAUD OR USER-ERROR AFTER
 TIMELY NOTIFICATION IS MADE TO THE PEER-TO-PEER MOBILE SERVICE.
   8. ANY PEER-TO-PEER MOBILE SERVICE THAT  DOES  NOT  COMPLY  WITH  THIS
 SECTION  IS  PROHIBITED  FROM OFFERING ITS SERVICES TO USERS RESIDING IN
 THE STATE OF NEW YORK.
   § 3. Subsection (b) of section 403 of the financial  services  law  is
 amended to read as follows:
   (b) The financial frauds and consumer protection unit shall be a qual-
 ified  agency,  as  defined  in section eight hundred thirty-five of the
 executive law, to enforce the provisions of  this  article  and  article
 four  of  the  insurance  law  and  article  II-B of the banking law AND
 SECTION 399-JJ OF THE GENERAL BUSINESS LAW.
   § 4. This act shall take effect on the sixtieth  day  after  it  shall
 have become a law.