Starting from March 1, 2027, banks will stop transfers if they detect malicious software on a client's phone or computer. For this purpose, financial organizations will be obliged to use certified protection tools.

If the system detects a virus or signs of remote device control, the payment will not be processed. This rule will apply to both bank card transfers and operations via the Faster Payments System (SBP).

The client will immediately be explained the reason for the refusal and offered a safe solution: repeat the operation from another device or contact a branch. By September 1, 2027, banks will have to offer every user to connect such protection or officially record their refusal of it.

If a bank misses a fraudulent transfer that it was obliged to stop, the money will have to be returned. Reimbursement will be given up to 30 days, but only after a criminal case of theft has been initiated.

The anti-fraud package also includes other measures. The number of bank cards is planned to be limited to twenty per person. It will now be possible to terminate a contract with a telecom operator only 90 days after its conclusion.