S T A T E   O F   N E W   Y O R K
 ________________________________________________________________________
 
                                  9340--A
 
                           I N  A S S E M B L Y
 
                               March 6, 2024
                                ___________
 
 Introduced  by  M.  of  A.  LEE,  OTIS  -- read once and referred to the
   Committee on Consumer Affairs and Protection -- committee  discharged,
   bill  amended,  ordered  reprinted  as amended and recommitted to said
   committee
 
 AN ACT to amend the general business law, in  relation  to  peer-to-peer
   mobile  payment  service security; and to amend the financial services
   law, in relation to authorizing  the  financial  frauds  and  consumer
   protection unit to enforce such provisions
 
   THE  PEOPLE OF THE STATE OF NEW YORK, REPRESENTED IN SENATE AND ASSEM-
 BLY, DO ENACT AS FOLLOWS:
 
   Section 1. This act shall be known and may be cited as the  "Financial
 App Security Act".
   §  2. The general business law is amended by adding a new section 399-
 jj to read as follows:
   § 399-JJ. PEER-TO-PEER MOBILE PAYMENT SERVICE  SECURITY.  1.  FOR  THE
 PURPOSES OF THIS SECTION:
   (A)  "PEER-TO-PEER  MOBILE  SERVICE"  MEANS  ANY  APP  OR  APP SERVICE
 PROVIDED DIRECTLY TO USERS BY AN ENTITY THAT IS NOT AN INSURED DEPOSITO-
 RY INSTITUTION AND THAT:
   (1) DIRECTLY OR INDIRECTLY  RECEIVES  AND  HOLDS  MONEY  BELONGING  TO
 USERS,  OR  THAT  FACILITATES  TRANSACTIONS  BETWEEN  INSURED DEPOSITORY
 INSTITUTIONS BUT EXISTS SEPARATELY FROM SAID INSTITUTIONS; AND
   (2) WHOSE PRIMARY FUNCTIONALITY IS TO ALLOW USERS TO SEND AND  RECEIVE
 MONEY  THROUGH THEIR MOBILE DEVICES FROM A LINKED BANK ACCOUNT OR CREDIT
 CARD OR DEBIT CARD USING  A  RECIPIENT'S  CELL  PHONE  NUMBER  OR  EMAIL
 ADDRESS OR USERNAME.
   (B)  "BIOMETRIC AUTHENTICATION" MEANS EITHER FINGERPRINT OR FACE IDEN-
 TIFICATION FOR ACCESS TO A SERVICE, OR VERIFICATION OF AN IN-APP ACTION.
   2. EVERY PEER-TO-PEER MOBILE SERVICE SHALL REQUIRE USERS TO  CREATE  A
 PERSONAL  IDENTIFICATION CODE ASSOCIATED WITH THE USER'S ACCOUNT THAT IS
 A MINIMUM OF FOUR NUMERIC CHARACTERS ASSOCIATED WITH THE USER'S ACCOUNT.
 WHEN CERTAIN ACTIONS ARE TAKEN, INCLUDING BUT NOT  LIMITED  TO,  ACTIONS
 DEFINED IN SUBDIVISION FOUR OF THIS SECTION, THE PERSONAL IDENTIFICATION
 NUMBER  MUST  BE  USED  TO AUTHENTICATE THE USER'S IDENTITY.  THE USE OF
 
  EXPLANATION--Matter in ITALICS (underscored) is new; matter in brackets
                       [ ] is old law to be omitted.
              

                                                            LBD14473-08-4
 A. 9340--A                          2
 
 SUCH PERSONAL IDENTIFICATION CODE MAY NOT BE SUBSTITUTED FOR ANY FORM OF
 BIOMETRIC AUTHENTICATION.
   3.  EVERY  PEER-TO-PEER  MOBILE  SERVICE  SHALL REQUIRE USERS TO SET A
 MONETARY AMOUNT FOR INTENDED TRANSFERS ABOVE WHICH THE USE OF A PERSONAL
 IDENTIFICATION NUMBER WILL BE REQUIRED TO AUTHENTICATE THE USER'S  IDEN-
 TITY AND PROVIDE AN OPTION FOR USERS TO OPT-IN OF SUCH REQUIREMENT.
   4.  THE  FOLLOWING  ACTIONS  REQUIRE  USE OF A PERSONAL IDENTIFICATION
 NUMBER WHEN USING A PEER-TO-PEER MOBILE SERVICE:
   (A) ANY PAYMENT TRANSACTION INITIATED BY THE USER EXCEEDING THE  MONE-
 TARY LIMIT SET BY SAID USER;
   (B)  PAYMENT  TRANSACTIONS INITIATED BY THE USER THAT WOULD BRING SAID
 USERS TWENTY-FOUR-HOUR PAYMENT TRANSACTION AMOUNT EXCEEDING THE MONETARY
 LIMIT SET BY SAID USER STARTING FROM THE FIRST TRANSACTION;
   (C) PAYMENT TRANSACTIONS INITIATED BY THE USER TO ANOTHER  USER  WHOSE
 ACCOUNT  WAS  CREATED  LESS  THAN TWENTY-FOUR HOURS PRIOR TO SAID TRANS-
 ACTION;
   (D) ANY  PAYMENT  TRANSACTIONS  INITIATED  BY  THE  USER  AFTER  THREE
 SUCCESSFUL  PAYMENT  TRANSACTIONS  INITIATED  BY THE USER HAVE BEEN MADE
 WITHIN SIXTY MINUTES FOR AMOUNTS UNDER THE USER'S SET MONETARY LIMIT;
   (E) ANY ATTEMPT TO SIGN IN TO THE SERVICE BY THE USER TO A NEW  AND/OR
 UNRECOGNIZED DEVICE; AND
   (F)  ANY  ATTEMPT TO SIGN IN TO THE SERVICE AFTER THE ACCOUNT PASSWORD
 HAS BEEN RESET IN ANY MANNER, INCLUDING BUT  NOT  LIMITED  TO,  PASSWORD
 RECOVERY SERVICE OFFERED BY THE SERVICE.
   5.  A  USER'S  ACCOUNT WILL BE LOCKED AFTER FIVE UNSUCCESSFUL ATTEMPTS
 WITHIN A TWENTY-FOUR HOUR PERIOD TO INPUT SAID USER'S PERSONAL IDENTIFI-
 CATION NUMBER WHEN REQUIRED. THE PEER-TO-PEER MOBILE SERVICE CAN  UNLOCK
 SAID  ACCOUNT  AFTER  TWENTY-FOUR  HOURS  IF SAID USER IS ABLE TO VERIFY
 THEIR IDENTITY THROUGH A TELEPHONE CALL OR SECURITY QUESTIONS CREATED BY
 THE USER.
   6. ANY PAYMENT TRANSACTIONS INITIATED BY THE USER AFTER THREE SUCCESS-
 FUL PAYMENT TRANSACTIONS INITIATED BY THE USER  HAVE  BEEN  MADE  WITHIN
 SIXTY  MINUTES  AFTER THE FIRST SUCCESSFUL PAYMENT TO THE SAME RECIPIENT
 FOR AMOUNTS, DESPITE THE INPUT OF THE USER'S CORRECT PERSONAL  IDENTIFI-
 CATION  NUMBER,  WILL  REQUIRE  ADDITIONAL  IDENTITY VERIFICATION OF THE
 RECIPIENT IF:
   (A) ANY OF THE TRANSACTIONS EXCEED THE GREATER AMOUNT  OF  EITHER  THE
 USER'S SET MONETARY LIMIT OR ONE THOUSAND DOLLARS; OR
   (B) THE AGGREGATE AMOUNT OF THE TRANSACTIONS EXCEED THE GREATER AMOUNT
 OF EITHER THE USER'S SET MONETARY LIMIT OR ONE THOUSAND DOLLARS; OR
   (C) THE RECIPIENT IS A FIRST TIME TRANSACTION TO THE USER.
   7.  ANY TRANSACTION THAT COULD BE THE RESULT OF FRAUD CAN BE CANCELLED
 BY THE USER MAKING THE PAYMENT AFTER TIMELY NOTIFICATION IS MADE TO  THE
 PEER-TO-PEER MOBILE SERVICE.
   8.  ANY  PEER-TO-PEER  MOBILE  SERVICE  THAT DOES NOT COMPLY WITH THIS
 SECTION IS PROHIBITED FROM OFFERING ITS SERVICES TO  USERS  RESIDING  IN
 THE STATE OF NEW YORK.
   §  3.  Subsection  (b) of section 403 of the financial services law is
 amended to read as follows:
   (b) The financial frauds and consumer protection unit shall be a qual-
 ified agency, as defined in section eight  hundred  thirty-five  of  the
 executive  law,  to  enforce  the provisions of this article and article
 four of the insurance law and  article  II-B  of  the  banking  law  AND
 SECTION THREE HUNDRED NINETY-NINE-JJ OF THE GENERAL BUSINESS LAW.
   § 4. This act shall take effect on the one hundred eightieth day after
 it shall have become a law.