Now banks will "look" into your phone before every transfer.
Starting in 2027, Russian banks will gain the right (and obligation) to refuse to process a transfer if malicious software is detected on the client's device. The rule applies to cards, the Faster Payments System (SBP), and electronic money. When blocking a transaction, the bank must immediately state the reason and offer to conduct the operation from another device or at a branch.
Here are a few headline options that capture the essence:
- Banks will start blocking transfers due to viruses on your phone. Your smartphone is now under surveillance
- Malware found — transfer won't go through. New anti-fraud rules from 2027
- Is your phone infected? The bank will refuse the transaction. How the new mechanism will work
- Anti-fraud 2.0: banks get the right to stop transfers when malware is detected
What this means in practice
Banks have long been analyzing device behavior: new hardware, suspicious apps, session anomalies. Now there is a direct obligation to block a transaction if the system detects the impact of malware.
Technically, this will work through:
- analysis of the session and device behavior,
- signatures of known banking trojans,
- possibly, integration of security tools (with client consent until September 2027).
If a bank ignores a signal of infection and the transfer turns out to be fraudulent, it will be obliged to reimburse the client's funds.
Pros and risks
Pro — real protection against banking trojans, which are currently mass-infecting Android devices and allowing thieves to steal money directly from the app session.
Risks — false positives. Antivirus and anti-fraud systems are not perfect. Theoretically, a "clean" phone could be mistaken for an infected one, and the transfer would be halted. There is also a privacy question: how deeply will the bank look into the device.
What to do right now
- Keep your system and apps updated.
- Do not install anything from unknown sources.
- Use official app stores.
- If you suspect infection — check the device with a third-party antivirus and change your passwords.
The innovation is logical from the standpoint of fighting fraud. But as always, the devil will be in the details of implementation and in how carefully banks distinguish real threats from false positives.
