NY State Senate Bill 2023-S8677

Current Bill Status - In Senate Committee Internet And Technology Committee

Introduced
- In Committee Assembly
- In Committee Senate
- On Floor Calendar Assembly
- On Floor Calendar Senate
- Passed Assembly
- Passed Senate
Delivered to Governor
Signed By Governor

Please enter your contact information

First Name

Last Name

Email Address

A valid email address is required.

Home address is used to determine the senate district in which you reside. Your support or opposition to this bill is then shared immediately with the senator who represents you.

Optional services from the NY State Senate:

Create an account. An account allows you to officially support or oppose key legislation, sign petitions with a single click, and follow issues, committees, and bills that matter to you. When you create an account, you agree to this platform's terms of participation.

Include a custom message for your Senator? (Optional)

Enter a message to your senator. Many New Yorkers use this to share the reasoning behind their support or opposition to the bill. Others might share a personal anecdote about how the bill would affect them or people they care about.

Actions

View Actions

	Assembly Actions - Lowercase Senate Actions - UPPERCASE
Feb 28, 2024	referred to internet and technology

2023-S8677 (ACTIVE) - Details

See Assembly Version of this Bill:: A9340
Current Committee:: Senate Internet And Technology
Law Section:: General Business Law
Laws Affected:: Add §399-jj, Gen Bus L; amd §403, Fin Serv L

2023-S8677 (ACTIVE) - Summary

Directs every peer-to-peer mobile service to require users to create a personal identification code associated with the user's account that is required to be used when certain actions are taken and to require users to set a monetary amount for intended transfers above which the use of a personal identification number will be required to authenticate the user's identity.

2023-S8677 (ACTIVE) - Sponsor Memo

                                 
BILL NUMBER: S8677

SPONSOR: HOYLMAN-SIGAL
 
TITLE OF BILL:

An act to amend the general business law, in relation to peer-to-peer
mobile payment service security; and to amend the financial services
law, in relation to authorizing the financial frauds and consumer
protection unit to enforce such provisions

 
PURPOSE:

To require companies that offer peer-to-peer mobile payment services to
enact security measures designed to protect consumers from financial
frauds and theft.

 
SUMMARY OF PROVISIONS:

Section 1 adds a new section 399-zzzzzzz to the General Business Law
which:

1. Defines terms used in the new section;

2. Requires mobile payment services to create a user PIN system that
must be used for certain actions;

3. Requires these services to have users set a monetary amount above
which use of the PIN is required;

4. Sets out specified actions for which the services must require the
user to enter their PIN;

5. Requires services to lock accounts if incorrect PIN is entered under
specified circumstances;

6. Establishes situations that will require services to hold funds for
48 hours and how it can be cancelled;

7. Prohibits any service that does not comply with this section from
offering its services to users residing in New York.

Section 2 amends subsection 3 of section 403 of the Financial Services
Law to assign the Financial Frauds and Consumer Protection Unit to the
enforcement of the newly created section.

Section 3 provides the effective date.

 
JUSTIFICATION:

The Financial App Security Act seeks to amend the General Business Law
by adding additional security requirements for mobile financial apps,
including certain measures found in traditional banking, in order to
continue offering their services in New York.

According to New York law enforcement, financial app thefts have signif-
icantly increased in recent years. While these apps are incredibly popu-
lar and widely used, the corporations have a responsibility to limit
fraud and abuse of their consumers.

Thefts via financial apps often involve an incident where an unauthor-
ized user gains access to unlocked devices and drain bank accounts of
significant sums of money. These apps, more than the smartphone itself,
are an increasingly lucrative target for scammers and robbers. Thousands
of dollars can be taken in mere seconds putting New Yorkers' financial,
and sometimes physical safety, at risk. This law would impose common-
sense security measures in place to deter future thefts.

 
LEGISLATIVE HISTORY:

New legislation.

 
LOCAL FISCAL IMPLICATIONS:

None.

2023-S8677 (ACTIVE) - Bill Text download pdf

                             
                     S T A T E   O F   N E W   Y O R K
 ________________________________________________________________________
 
                                   8677
 
                             I N  S E N A T E
 
                             February 28, 2024
                                ___________
 
 Introduced  by Sen. HOYLMAN-SIGAL -- read twice and ordered printed, and
   when printed to be committed to the Committee on Internet and Technol-
   ogy
 
 AN ACT to amend the general business law, in  relation  to  peer-to-peer
   mobile  payment  service security; and to amend the financial services
   law, in relation to authorizing  the  financial  frauds  and  consumer
   protection unit to enforce such provisions
 
   THE  PEOPLE OF THE STATE OF NEW YORK, REPRESENTED IN SENATE AND ASSEM-
 BLY, DO ENACT AS FOLLOWS:
 
   Section 1. This act shall be known and may be cited as the  "Financial
 App Security Act".
   §  2. The general business law is amended by adding a new section 399-
 jj to read as follows:
   § 399-JJ. PEER-TO-PEER MOBILE PAYMENT SERVICE  SECURITY.  1.  FOR  THE
 PURPOSES OF THIS SECTION:
   (A)  "PEER-TO-PEER  MOBILE  SERVICE" MEANS ANY APP OR APP SERVICE THAT
 ALLOWS USERS TO SEND AND RECEIVE MONEY FROM THEIR MOBILE DEVICES THROUGH
 A LINKED BANK ACCOUNT OR CREDIT CARD OR DEBIT CARD USING ONLY A  RECIPI-
 ENT'S CELL PHONE NUMBER OR EMAIL ADDRESS.
   (B)  "BIOMETRIC AUTHENTICATION" MEANS EITHER FINGERPRINT OR FACE IDEN-
 TIFICATION FOR ACCESS TO A SERVICE, OR VERIFICATION OF AN IN-APP ACTION.
   2. EVERY PEER-TO-PEER MOBILE SERVICE SHALL REQUIRE USERS TO  CREATE  A
 PERSONAL  IDENTIFICATION CODE ASSOCIATED WITH THE USER'S ACCOUNT THAT IS
 A MINIMUM OF FOUR ALPHA-NUMERIC CHARACTERS ASSOCIATED  WITH  THE  USER'S
 ACCOUNT.  WHEN  CERTAIN ACTIONS ARE TAKEN, INCLUDING BUT NOT LIMITED TO,
 ACTIONS DEFINED IN SUBDIVISION FOUR OF THIS SECTION, THE PERSONAL  IDEN-
 TIFICATION NUMBER MUST BE USED TO AUTHENTICATE THE USER'S IDENTITY.  THE
 USE  OF SUCH PERSONAL IDENTIFICATION CODE MAY NOT BE SUBSTITUTED FOR ANY
 FORM OF BIOMETRIC AUTHENTICATION.
   3. EVERY PEER-TO-PEER MOBILE SERVICE SHALL  REQUIRE  USERS  TO  SET  A
 MONETARY AMOUNT FOR INTENDED TRANSFERS ABOVE WHICH THE USE OF A PERSONAL
 IDENTIFICATION  NUMBER WILL BE REQUIRED TO AUTHENTICATE THE USER'S IDEN-
 TITY.
 
  EXPLANATION--Matter in ITALICS (underscored) is new; matter in brackets
                       [ ] is old law to be omitted.
                                                            LBD14473-02-4

 S. 8677                             2
 
   4. THE FOLLOWING ACTIONS REQUIRE  USE  OF  A  PERSONAL  IDENTIFICATION
 NUMBER WHEN USING A PEER-TO-PEER MOBILE SERVICE:
   (A)  ANY PAYMENT TRANSACTION INITIATED BY THE USER EXCEEDING THE MONE-
 TARY LIMIT SET BY SAID USER;
   (B) PAYMENT TRANSACTIONS INITIATED BY THE USER THAT WOULD  BRING  SAID
 USERS TWENTY-FOUR-HOUR PAYMENT TRANSACTION AMOUNT EXCEEDING THE MONETARY
 LIMIT SET BY SAID USER STARTING FROM THE FIRST TRANSACTION;
   (C)  PAYMENT  TRANSACTIONS INITIATED BY THE USER TO ANOTHER USER WHOSE
 ACCOUNT WAS CREATED LESS THAN TWENTY-FOUR HOURS  PRIOR  TO  SAID  TRANS-
 ACTION;
   (D)  PAYMENT TRANSACTIONS INITIATED BY THE USER THAT APPEAR SUSPICIOUS
 BASED ON SAID USER'S BEHAVIOR AND/OR GEOLOCATION PROFILE  AS  DETERMINED
 BY THE SERVICE'S EXISTING BEHAVIORAL ANALYTICS;
   (E)  ANY  PAYMENT  TRANSACTIONS  INITIATED  BY  THE  USER  AFTER THREE
 SUCCESSFUL PAYMENT TRANSACTIONS INITIATED BY THE  USER  HAVE  BEEN  MADE
 WITHIN SIXTY MINUTES FOR AMOUNTS UNDER THE USER'S SET MONETARY LIMIT;
   (F)  ANY ATTEMPT TO SIGN IN TO THE SERVICE BY THE USER TO A NEW AND/OR
 UNRECOGNIZED DEVICE;
   (G) ANY ATTEMPT TO SIGN IN TO THE SERVICE AFTER THE  ACCOUNT  PASSWORD
 HAS  BEEN  RESET  IN  ANY MANNER, INCLUDING BUT NOT LIMITED TO, PASSWORD
 RECOVERY SERVICE OFFERED BY THE SERVICE; AND
   (H) ANY ATTEMPT TO SIGN IN TO THE SERVICE BY THE USER AFTER THE DEVICE
 PASSWORD HAS BEEN RESET.
   5. A USER'S ACCOUNT WILL BE LOCKED AFTER  FIVE  UNSUCCESSFUL  ATTEMPTS
 WITHIN A TWENTY-FOUR HOUR PERIOD TO INPUT SAID USER'S PERSONAL IDENTIFI-
 CATION  NUMBER WHEN REQUIRED. THE PEER-TO-PEER MOBILE SERVICE CAN UNLOCK
 SAID ACCOUNT AFTER TWENTY-FOUR HOURS IF SAID  USER  IS  ABLE  TO  VERIFY
 THEIR IDENTITY THROUGH A TELEPHONE CALL.
   6. ANY PAYMENT TRANSACTIONS INITIATED BY THE USER AFTER THREE SUCCESS-
 FUL  PAYMENT  TRANSACTIONS  INITIATED  BY THE USER HAVE BEEN MADE WITHIN
 SIXTY MINUTES AFTER THE FIRST SUCCESSFUL PAYMENT  FOR  AMOUNTS,  DESPITE
 THE  INPUT  OF  THE  USER'S CORRECT PERSONAL IDENTIFICATION NUMBER, WILL
 HAVE A FORTY-EIGHT HOUR HOLD BEFORE THE FUNDS WILL BE  RELEASED  TO  THE
 RECIPIENT IF:
   (A) ANY OF THE TRANSACTIONS EXCEEDS THE USER'S SET MONETARY LIMIT; OR
   (B)  THE  AGGREGATE  AMOUNT OF THE TRANSACTIONS EXCEEDS THE USER'S SET
 MONETARY LIMIT.
   7. ANY TRANSACTION PLACED ON A FORTY-EIGHT-HOUR HOLD CAN BE  CANCELLED
 BY THE USER MAKING THE PAYMENT IN THE EVENT OF FRAUD OR USER-ERROR AFTER
 TIMELY NOTIFICATION IS MADE TO THE PEER-TO-PEER MOBILE SERVICE.
   8.  ANY  PEER-TO-PEER  MOBILE  SERVICE  THAT DOES NOT COMPLY WITH THIS
 SECTION IS PROHIBITED FROM OFFERING ITS SERVICES TO  USERS  RESIDING  IN
 THE STATE OF NEW YORK.
   §  3.  Subsection  (b) of section 403 of the financial services law is
 amended to read as follows:
   (b) The financial frauds and consumer protection unit shall be a qual-
 ified agency, as defined in section eight  hundred  thirty-five  of  the
 executive  law,  to  enforce  the provisions of this article and article
 four of the insurance law and  article  II-B  of  the  banking  law  AND
 SECTION 399-JJ OF THE GENERAL BUSINESS LAW.
   §  4.  This  act  shall take effect on the sixtieth day after it shall
 have become a law.

Comments

Open Legislation is a forum for New York State legislation. All comments are subject to review and community moderation is encouraged.

Comments deemed off-topic, commercial, campaign-related, self-promotional; or that contain profanity, hate or toxic speech; or that link to sites outside of the nysenate.gov domain are not permitted, and will not be published. Attempts to intimidate and silence contributors or deliberately deceive the public, including excessive or extraneous posting/posts, or coordinated activity, are prohibited and may result in the temporary or permanent banning of the user. Comment moderation is generally performed Monday through Friday. By contributing or voting you agree to the Terms of Participation and verify you are over 13.

Create an account. An account allows you to sign petitions with a single click, officially support or oppose key legislation, and follow issues, committees, and bills that matter to you. When you create an account, you agree to this platform's terms of participation.

Senate Bill S8677

Sponsored By

Current Bill Status - In Senate Committee Internet And Technology Committee

2023-S8677 (ACTIVE) - Details

2023-S8677 (ACTIVE) - Summary

2023-S8677 (ACTIVE) - Sponsor Memo

2023-S8677 (ACTIVE) - Bill Text download pdf

Comments

Senate Bill S8677

Share this bill

Sponsored By

Brad Hoylman-Sigal

Current Bill Status - In Senate Committee Internet And Technology Committee

2023-S8677 (ACTIVE) - Details

2023-S8677 (ACTIVE) - Summary

2023-S8677 (ACTIVE) - Sponsor Memo

2023-S8677 (ACTIVE) - Bill Text download pdf

Comments