Two-factor authentication and limit control: what innovations await card users
27 March 16:03
VIDEO
Starting October 1, 2025 , the National Bank of Ukraine (NBU) will introduce new rules for the use of payment cards. This is part of a comprehensive strategy to strengthen consumer protection, combat financial fraud and harmonize Ukrainian legislation with EU standards, Komersant ukrainskyi reports citing the website of the national financial regulator.
The innovations will affect both cardholders and financial institutions.
The NBU says that changes in the rules for using payment cards are a step towards strengthening the security of financial transactions and consumer protection. They will also help reduce fraud and bring Ukraine closer to European standards. Preparing for the new requirements will not require significant efforts from users, but will provide greater security and control over finances.
New rules for using payment cards: what will change from October 1, 2025
1. Enhanced authentication. All online payments and some offline transactions will require two-factor authentication (2FA). This may include the use of:
- a code from an SMS;
- biometric data (fingerprint or face recognition);
- dynamic tokens from the banking application.
The NBU explains that such measures significantly reduce the risk of unauthorized access to the account, especially in case of fraudulent attacks.
2. Restrictions on transactions and regions. Users will be able to set geographical restrictions on the use of the card. This will be useful to protect against fraud when traveling abroad.
3. Transaction limits. Banks will be able to offer individual restrictions on certain types of transactions (cash withdrawals, online purchases, transfers).
4. Temporary card blocking. If there are suspicions of fraud, the customer will be able to instantly block the card through the mobile application.
5. Transparency and information. Banks will be obliged to transparently inform customers about all fees during transactions. Before each transaction, the user will receive a detailed description of payment terms and fees.
In practice, this will mean that
- acquirers will be obliged to provide the issuer with information about the payer and/or recipient, including the business entity (EDRPOU code) and the individual (unique payment instrument number);
- clarify the requirements for the acquirer to generate payment instructions and determine their mandatory details;
- require the acquirer to inform the user of the payment instrument of its full name before initiating a payment transaction if it is carried out on the Internet.
“Now, every time you transfer money on your card, you will see to whom you have transferred it, regardless of whether you are in the same bank or not. The same applies to online payments,” explains economist Ilya Neskhodovsky.
Neskhodovsky believes that this decision should have been made a long time ago. It would have helped prevent fraud.
6. Simplification of financial management.
- The ability to instantly unlock the card after it has been temporarily blocked.
- Flexible limit setting without the need to visit the bank.
- Access to detailed transaction history and advanced reports through banking applications.
What will change for banks and financial institutions
Increased cybersecurity requirements. Financial institutions are required to implement more reliable systems for detecting suspicious transactions.
Information exchange. Banks will be obliged to cooperate with the regulator and submit reports on cybersecurity incidents.
Personal data protection. The NBU requires banks to ensure compliance with the new standards for processing and storing personal information of customers.
Why is the NBU introducing these changes?
1. Protection against fraud. The number of cyberattacks and cases of bank card fraud in Ukraine continues to grow. In 2023, the NBU recorded losses from cyber fraud of over UAH 1.5 billion.
Stronger authentication will reduce these risks by making transactions more secure.
2. Harmonization with European standards. Ukraine is seeking to integrate its financial system with EU markets, so these new rules bring Ukrainian legislation closer to the PSD2 (Revised Payment Services Directive), which is in force in the European Union.
3. Improving financial literacy. The NBU is also planning information campaigns to teach users how to use payment cards safely and avoid fraudulent schemes.
Read also: Restrictions on card transfers from June 1, 2025: how to prepare
How to prepare for the changes
Ukrainians are advised to
- update banking applications. Make sure your application supports two-factor authentication;
- check your contacts. Check whether the selected bank has up-to-date phone numbers and e-mail for notifications.
- set limits. Consider setting personal limits on transactions.
- use protection. Enable additional security features, such as push notifications about transactions.
