Georgia CommonsHB 1034: Georgia Tech Support Impersonation and Remote Access Protection Act; enact
Introduced version, the latest LegiScan holds · Last action January 29, 2026 · Introduced
The text as LegiScan holds it, read from the PDF the legislature publishes with its margin line numbers, running heads, and page footers removed. Line breaks are joined into paragraphs here; no word is changed.
Underlined words are what the bill adds to current law and struck-through words are what it removes, as the printed bill shows them.
House Bill 1034
By: Representatives Scott of the 76th, Schofield of the 63rd, and Davis of the 87th
A BILL TO BE ENTITLED
AN ACT
To amend Chapter 1 of Title 7 of the Official Code of Georgia Annotated, relating to financial institutions, so as to require that financial institutions provide customers the ability to place emergency holds on suspected fraudulent transactions; to amend Chapter 1 of Title 10 of the Official Code of Georgia Annotated, relating to selling and other trade practices, so as to add internet and email fraud to the list of crimes constituting unfair or deceptive practices in consumer transactions; to amend Chapter 9 of Title 16 of the Official Code of Georgia Annotated, relating to forgery and fraudulent practices, so as to criminalize electronic and voice communications intended to fraudulently solicit identifying information and gain remote access to electronic devices and accounts; to provide a short title; to amend Chapter 15 of Title 17 of the Official Code of Georgia Annotated, relating to victim compensation, so as to provide victim relief fund access to victims of certain financial crimes; to amend Chapter 15 of Title 45 of the Official Code of Georgia Annotated, relating to general provisions relative to the attorney general, so as to require that the Attorney General create public awareness and training initiatives regarding certain financial crimes; to provide for definitions; to provide for a short title; to provide for related matters; to repeal conflicting laws; and for other purposes.
BE IT ENACTED BY THE GENERAL ASSEMBLY OF GEORGIA:
SECTION 1.
This Act shall be known and may be cited as the "Georgia Tech Support Impersonation and Remote Access Protection Act."
SECTION 2.
Chapter 1 of Title 7 of the Official Code of Georgia Annotated, relating to financial institutions, is amended in Article 9, relating to criminal and related provisions, by adding a new Code section to read as follows:
"7-1-847.
(a) As used in this Code section, the term:
(1) 'Authorized push payment scam' means a process of falsely representing affiliation with a business or government entity to induce an individual to electronically convey money or information.
(2) 'Financial institution' means a bank, credit union, trust company, or money transmitter licensed or operating in this state.
(3) 'Covered transfer' means an electronic funds transfer under 12 C.F.R. Part 1005, an automated clearing house entry, or a peer-to-peer transfer initiated through a covered financial institution. Such term shall not include a payment order accepted under Article 4A of Title 11 or a transfer over a federal reserve wire system after acceptance.
(b) Financial institutions shall make available to all customers, at no charge, an account safety lock accessible by telephone and online. When activated, the institution shall block creation of new payees, set outbound covered transfer limits to zero, and terminate active online sessions until the customer reauthenticates his or her identity by in-person verification, notarized written instructions, or a verified callback number on file. Financial institutions shall offer customers the option to designate a trusted contact whom the institution may contact solely to confirm the customer's safety and intent when fraud is suspected.
(c) If a financial institution detects an active remote access session or remote administration software operating during initiation of a covered transfer, such institution shall pause the transaction and require high assurance reauthentication or in-person verification.
(d) Financial institutions shall implement measures reasonably designed to deter authorized push payment scams. Upon receiving a customer report of suspected fraudulent activity, a financial institution shall implement a temporary emergency hold on a covered transfer prior to final posting or settlement. Such hold may be maintained for up to 72 hours, unless sooner released upon completion of risk review. A single 72 hour extension may be granted upon a written request from law enforcement or upon the customer's submission of a police report.
(e) A financial institution may place a temporary emergency hold on a customer account when fraud indicators are present, including, but not limited to, first-time or high-risk payees, anomalous device or geolocation data, detection of an active remote access session, or a beneficiary name or identifier mismatch.
(f) A financial institution shall notify the customer within one business day after placing a hold on his or her account and provide an outcome within three business days after release of such hold, including whether funds were released, reversed, or recalled.
(g) All financial institutions shall retain records of account holds for five years and annually report to the department the number of holds, aggregate dollar amounts paused, reversals, recalls, and releases. The department shall publish an annual Georgia Financial Fraud Report summarizing this information state wide."
SECTION 3.
Chapter 1 of Title 10 of the Official Code of Georgia Annotated, relating to selling and other trade practices, is amended in subsection (b) of Code Section 10-1-393, relating to unfair or deceptive practices in consumer transactions unlawful and examples, by striking "and" at the end of subparagraph (D) of paragraph 36, by replacing the period at the end of paragraph
(37) with "; and", and by adding a new paragraph to read as follows: "(38)(A) Any violation of Code Section 16-9-109.1.
(B) In addition to any criminal penalties, the Attorney General may bring a civil action for injunctive relief, civil penalties, restitution, and other appropriate relief."
SECTION 4.
Chapter 9 of Title 16 of the Official Code of Georgia Annotated, relating to forgery and fraudulent practices, is amended by revising Code Section 16-9-109.1, relating to fraudulent business practices using internet or e-mail, definitions, penalties, sanctions, and immunity, as follows:
"(a) As used in this part, the term:
(0.1) 'Electronic communication' means any message sent by short message service, multimedia message service, or internet based messaging platform, including links or codes that route a user to a web page or remote access session.
(1) 'E-mail Email message' means a message sent to a unique destination, commonly expressed as a string of characters, consisting of a unique user name or mailbox, commonly referred to as the 'local part,' and a reference to an Internet internet domain, commonly referred to as the 'domain part,' whether or not displayed, to which an electronic message can be sent or delivered.
(2) 'Employer' includes a business entity's officers, directors, parent corporation, subsidiaries, affiliates, and other corporate entities under common ownership or control within a business enterprise.
(3) 'Identifying information' means, with respect to an individual, any of the following:
(A) Social security number;
(B) Driver's license number;
(C) Bank account number;
(D) Credit card or debit card number;
(E) Personal identification number or PIN;
(F) Automated or electronic signature;
(G) Unique biometric data;
(H) Account password; or
(I) Any other piece of information that can be used to access an individual's financial accounts or to obtain goods or services.
(4) 'Internet' shall have the meaning set forth in paragraph (10) of Code Section
16-9-151.
(4.1) 'Voice communication' means the conveyance of any message through human speech, including live speech, prerecorded or stored human speech, and simulated or artificially generated human speech produced by software or artificial intelligence.
(5) 'Web page' means a location that has a single uniform resource locator or other single location with respect to the Internet internet. (b)(1) It shall be unlawful for any person with intent to defraud, by means of a web page, e-mail email message, voice communication, electronic communication, or otherwise through use of the Internet internet, to solicit, request, or take any action to induce another person to provide identifying information or remote access to an electronic device or account by representing himself, herself, or itself to be a business without the authority or approval of such business.
(2) It shall be unlawful for any person, with actual knowledge, conscious avoidance of actual knowledge, or willfully, to possess with intent to use in a fraudulent manner, sell, or distribute any identifying information obtained in violation of paragraph (1) of this subsection.
(c) Any person who intentionally violates subsection (b) of this Code section shall be guilty of a felony and shall be punished by imprisonment for not less than one nor more than 20 years, a fine of not less than $1,000.00 nor more than $500,000.00, or both. (d)(1) No employer shall be held criminally liable under this Code section as a result of any actions taken:
(A) With respect to computer equipment used by its employees, contractors, subcontractors, agents, leased employees, or other staff which the employer owns, leases, or otherwise makes available or allows to be connected to the employer's network or other computer facilities when such equipment is used for an illegal purpose without the employer's knowledge, consent, or approval; or
(B) By employees, contractors, subcontractors, agents, leased employees, or other staff who misuse an employer's computer equipment for an illegal purpose without the employer's knowledge, consent, or approval.
(2) No person shall be held criminally liable under this Code section when its protected computers, computer equipment, or software product has been used by unauthorized users to violate this Code section without such person's knowledge, consent, or approval.
(e) This Code section shall not apply to a telecommunications provider's or Internet internet service provider's good faith transmission or routing of, or intermediate temporary storing or caching of, identifying information.
(f) No provider of an interactive computer service may be held liable in a civil action under any law of this state, or any of its political subdivisions, for removing or disabling access to content on an Internet a website or other online location controlled or operated by such provider, when such provider believes in good faith that such content has been used to engage in a violation of this part."
SECTION 5.
Chapter 15 of Title 17 of the Official Code of Georgia Annotated, relating to victim compensation, is amended by adding a new Code section to read as follows:
"17-15-18.
(a) This Code section shall be known and may be cited as the 'Georgia Financial Fraud Victims Relief Fund.'
(b) As used in this Code section, the term:
(1) 'Eligible financial fraud' means a violation of Code Section 16-9-109.1 or other fraud resulting in a covered transfer, as such term is defined in Code Section 7-1-847, where funds are not otherwise reimbursable under federal or state law or by a financial institution.
(2) 'Eligible victim' means a person residing in this state who promptly reports suspected fraud to a financial institution, cooperates in any investigation or recovery efforts, and has not received reimbursement from any other source for the loss.
(c) There is created the Georgia Financial Fraud Victims Relief Fund, to be administered by the Criminal Justice Coordinating Council. The fund shall consist of moneys appropriated by the General Assembly; civil penalties and settlement proceeds recovered by the state for violations of Code Section 16-9-109.1; and gifts, grants, and donations. The council shall promulgate rules necessary to implement this Code section.
(d) Awards shall reimburse uncompensated pecuniary loss up to $10,000.00 per incident and $20,000.00 per claimant per calendar year, subject to available funds. Any amounts recovered by the victim after such reimbursement shall be repaid to the fund to the extent of the award. No award shall duplicate compensation available from any other source.
(e) An eligible victim shall apply within one year of discovery of the fraud, subject to equitable tolling for good cause.
(f) The council shall issue an eligibility determination within 90 days of receipt of a complete application.
(g) The council shall publish an annual report on claims received, awards granted or denied, and aggregate losses and recoveries."
SECTION 6.
Chapter 15 of Title 45 of the Official Code of Georgia Annotated, relating to general provisions relative to the attorney general, is amended by adding a new Code section to read as follows:
"45-15-21.
(a) The Attorney General shall create and maintain a centralized web portal and a toll-free hotline dedicated to violations of Code Section 16-9-109.1 integrated with existing consumer complaint systems and capable of referral to applicable federal portals.
(b) All reports shall receive an acknowledgment within 48 hours and a status update within ten business days. The Attorney General shall coordinate referrals with the Georgia Bureau of Investigation, the Department of Banking and Finance, and applicable federal agencies.
(c) The Attorney General shall conduct an annual public awareness campaign focused on recognizing fraudulent electronic solicitations, authorized push payment scams, and remote access fraud.
(d) The Attorney General shall develop training programs for state and local law enforcement agencies and district attorneys regarding technology enabled fraud, including artificial intelligence generated voice impersonation, deceptive remote access, and investigative best practices.
(e) The Attorney General may promulgate rules and enter into memoranda of understanding necessary to implement this Code section."
SECTION 7.
All laws and parts of laws in conflict with this Act are repealed.