A few years ago, cybersecurity was mainly a concern for IT specialists. Today, it affects everyone who carries at least one payment card in their wallet. Uzbekistan is rapidly transitioning to cashless payments — and in parallel, the state is building a legal framework designed to protect citizens' money.

Why the Issue Has Become So Urgent

Fraud schemes have long gone beyond simple "account hacking." Today they encompass a whole range of scenarios: SIM card reissuance in someone else's name, fake payment links, credential leaks through questionable online stores, calls from "security service representatives."

The logic is simple: the more operations move online, the more opportunities for abuse. The Central Bank reports that in 2024, complaints about unauthorized debits increased significantly. The problem isn't just the lost money — public confidence in digital services is at stake.

What Exactly Changed in Legislation

In 2025, a comprehensive set of measures against card fraud was introduced. The key point: the focus is not so much on punishment after the fact, but on prevention — making crime technically difficult and economically unprofitable.

  • Accountability has expanded. Presidential Decree No. PP-153 of April 30, 2025 strengthened sanctions for cybercrimes involving payment cards. Responsibility now extends not only to those who steal or illegally use cards, but also to "droppers" — people who pass their SIM cards and accounts to third parties. Previously, many considered such side work harmless; now it is an offense.
  • Banks have specific obligations. Decree No. PP-381 of November 30, 2023 approved a "roadmap" for protecting digital service consumers' rights. Under this framework, financial institutions deploy anti-fraud systems, automatically monitor sequences of three or more consecutive transfers, and activate biometrics and additional checks for large P2P transactions.
  • Public reporting has been introduced. The same PP-153 mandates monthly publication of banks and payment organizations with the highest number of cybercrimes in their systems. This serves as a reputation lever: any client can see the statistics and compare the reliability of different Uzbek banks before opening an account.
  • Damages can now be recovered. If money was lost because an organization failed to meet data protection requirements, it must compensate the client. Additionally, the Central Bank established a centralized anti-fraud system, connection to which is now mandatory for all market participants.

What This Means for Fintech Companies

The new rules send a mixed signal to the market. On one hand, costs increase: investment in technology, staff training, and process restructuring become necessary. On the other — this is a chance to distance yourself from weaker competitors. Where customers don't worry about their money, business grows faster.

  1. Cybersecurity investments stop being a "future" expense and become mandatory spending.
  2. Anti-fraud must be intelligent: not just blocking based on blacklists, but detecting unusual behavior patterns.
  3. Digital hygiene for employees and customers becomes part of the product, not optional.

How Life Changes for Cardholders

The main practical outcome — it's harder to lose money. The trade-off is obvious: you'll need to confirm operations more frequently, and some transfers will require additional verification. This is a reasonable price for preventing strangers from draining your account with a few taps.

Another important consequence — customers now have leverage. If a debit occurred without your consent, the bank must respond promptly, rather than sending you in circles. Record the operation time, save SMS messages and screenshots, file complaints in writing — this speeds up resolution.

What You Can Do Today

  • Never share your SIM card, payment card, or app access with anyone — not even family or "for a cut."
  • Set reasonable limits on transfers and online payments.
  • Check the website address before entering credentials: counterfeits differ by one or two characters in the domain.
  • Enable notifications for all transactions so you spot unauthorized debits immediately.
  • Never share an SMS code over the phone — no legitimate service requests it.

New regulations are more than just additional lines in a legal code. They form the foundation of trust in the digital economy: financial technology develops confidently only where people's money is truly protected.