HB1034: HB1034 Georgia Tech Support Impersonation and Remote Access Protection Act; enact

26 LC 59 0193 House Bill 1034 By: Representatives Scott of the 76th, Schofield of the 63rd, and Davis of the 87th A BILL TO BE ENTITLED AN ACT To amend Chapter 1 of Title 7 of the Official Code of Georgia A nnotated, relating to1 financial institutions, so as to require that financial institutions provide customers the ability2 to place emergency holds on suspected fraudulent transactions; to amend Chapter 1 of Title3 10 of the Official Code of Georgia Annotated, relating to selling and other trade practices,4 so as to add internet and email fraud to the list of crimes con stituting unfair or deceptive5 practices in consumer transactions; to amend Chapter 9 of Title 16 of the Official Code of6 Georgia Annotated, relating to forgery and fraudulent practices , s o a s t o c r i m i n a l i z e7 electronic and voice communications intended to fraudulently solicit identifying information8 and gain remote access to electronic devices and accounts; to provide a short title; to amend9 Chapter 15 of Title 17 of the Official Code of Georgia Annotate d, relating to victim10 compensation, so as to provide victim relief fund access to vic tims of certain financial11 crimes; to amend Chapter 15 of Title 45 of the Official Code of Georgia Annotated, relating12 to general provisions relative to the attorney general, so as t o require that the Attorney13 General create public awareness and training initiatives regarding certain financial crimes;14 to provide for definitions; to provide for a short title; to provide for related matters; to repeal15 conflicting laws; and for other purposes.16 BE IT ENACTED BY THE GENERAL ASSEMBLY OF GEORGIA:17 H. B. 1034 - 1 - 26 LC 59 0193 SECTION 1.18 This Act shall be known and may be cited as the "Georgia Tech Support Impersonation and19 Remote Access Protection Act."20 SECTION 2.21 Chapter 1 of Title 7 of the Official Code of Georgia Annotated, relating to financial22 institutions, is amended in Article 9, relating to criminal and related provisions, by adding23 a new Code section to read as follows:24 "7-1-847.25 (a) As used in this Code section, the term:26 (1) 'Authorized push payment scam' means a process of falsely representing affiliation27 with a business or government entity to induce an individual to electronically convey28 money or information.29 (2) 'Financial in stitution' means a bank, credit union, trust company, or money30 transmitter licensed or operating in this state.31 (3) 'Covered transfer' means an electronic funds transfer under 12 C.F.R. Part 1005, an32 automated clearing house entry, or a peer-to-peer transfer init iated through a covered33 financial institution. Such term shall not include a payment order accepted under Article34 4A of Title 11 or a transfer over a federal reserve wire system after acceptance.35 (b) Financial institutions shall make available to all customers, at no charge, an account36 safety lock accessible by telephone and online. When activated, the institution shall block37 creation of new payees, set outbound covered transfer limits to zero, and terminate active38 online sessions until the customer reauthenticates his or her i dentity by in-person39 verification, notarized written instructions, or a verified callback number on file. Financial40 institutions shall offer customers the option to designate a tr usted contact whom the41 institution may contact solely to confirm the customer's safety and intent when fraud is42 suspected.43 H. B. 1034 - 2 - 26 LC 59 0193 (c) If a financial institution detects an active remote access session or remote44 administration software operating during initiation of a covered transfer, such institution45 shall pause the transaction and require high assurance reauthen tication or in-person46 verification.47 (d) Financial institutions shall implement measures reasonably designed to deter48 authorized push payment scams. Upon receiving a customer report of suspected fraudulent49 activity, a financial institution shall implement a temporary emergency hold on a covered50 transfer prior to final posting or settlement. Such hold may b e maintained for up to 7251 hours, unless sooner released upon completion of risk review. A single 72 hour extension52 may be granted upon a written request from law enforcement or u pon the customer's53 submission of a police report.54 (e) A financial institution may place a temporary emergency hold on a customer account55 when fraud indicators are present, including, but not limited t o, first-time or high-risk56 payees, anomalous device or geolocation data, detection of an active remote access session,57 or a beneficiary name or identifier mismatch.58 (f) A financial institution shall notify the customer within one business day after placing59 a hold on his or her account and provide an outcome within thre e business days after60 release of such hold, including whether funds were released, reversed, or recalled.61 (g) All financial institutions shall retain records of account holds for five years and62 annually report to the department the number of holds, aggregate dollar amounts paused,63 reversals, recalls, and releases. The department shall publish an annual Georgia Financial64 Fraud Report summarizing this information state wide."65 SECTION 3.66 Chapter 1 of Title 10 of the Official Code of Georgia Annotated, relating to selling and other67 trade practices, is amended in subsection (b) of Code Section 10-1-393, relating to unfair or68 deceptive practices in consumer transactions unlawful and examples, by striking "and" at the69 H. B. 1034 - 3 - 26 LC 59 0193 end of subparagraph (D) of paragraph 36, by replacing the perio d at the end of paragraph70 (37) with "; and", and by adding a new paragraph to read as follows:71 "(38)(A) Any violation of Code Section 16-9-109.1.72 (B) In addition to any criminal penalties, the Attorney General may bring a civil action73 for injunctive relief, civil penalties, restitution, and other appropriate relief."74 SECTION 4.75 Chapter 9 of Title 16 of the Official Code of Georgia Annotated , relating to forgery and76 fraudulent practices, is amended by revising Code Section 16-9-109.1, relating to fraudulent77 business practices using internet or e-mail, definitions, penalties, sanctions, and immunity,78 as follows:79 "(a) As used in this part, the term:80 (0.1) 'Electronic communication' means any message sent by sho rt message service,81 multimedia message service, or internet based messaging platfor m, including links or82 codes that route a user to a web page or remote access session.83 (1) 'E-mail Email message' means a message sent to a unique destination, commonl y84 expressed as a string of characters, consisting of a unique use r name or mailbox,85 commonly referred to as the 'local part,' and a reference to an Internet internet domain,86 commonly referred to as the 'domain part,' whether or not displ ayed, to which an87 electronic message can be sent or delivered.88 (2) 'Employer' includes a business entity's officers, director s, parent corporation,89 subsidiaries, affiliates, and other corporate entities under common ownership or control90 within a business enterprise.91 (3) 'Identifying information' means, with respect to an individual, any of the following:92 (A) Social security number;93 (B) Driver's license number;94 (C) Bank account number;95 H. B. 1034 - 4 - 26 LC 59 0193 (D) Credit card or debit card number;96 (E) Personal identification number or PIN;97 (F) Automated or electronic signature;98 (G) Unique biometric data;99 (H) Account password; or100 (I) Any other piece of information that can be used to access an individual's financial101 accounts or to obtain goods or services.102 (4) 'Internet' shall have the meaning set forth in paragraph ( 10) of Code Section103 16-9-151.104 (4.1) 'Voice communication' means the conveyance of any messag e through human105 speech, including live speech, prerecorded or stored human spee ch, and simulated or106 artificially generated human speech produced by software or artificial intelligence.107 (5) 'Web page' means a location that has a single uniform resource locator or other single108 location with respect to the Internet internet.109 (b)(1) It shall be unlawful for any person with intent to defraud, by means of a web page,110 e-mail email message, voice communication, electronic communication, or otherwise111 through use of the Internet internet , to solicit, request, or take any action to induce112 another person to provide identifying information or remote access to an electronic device113 or account by representing himself, herself, or itself to be a business without the authority114 or approval of such business.115 (2) It shall be unlawful for any person, with actual knowledge, conscious avoidance of116 actual knowledge, or willfully, to possess with intent to use in a fraudulent manner, sell,117 or distribute any identifying information obtained in violation of paragraph (1) of this118 subsection.119 (c) Any person who intentionally violates subsection (b) of th is Code section shall be120 guilty of a felony and shall be punished by imprisonment for no t less than one nor more121 than 20 years, a fine of not less than $1,000.00 nor more than $500,000.00, or both.122 H. B. 1034 - 5 - 26 LC 59 0193 (d)(1) No employer shall be held criminally liable under this Code section as a result of123 any actions taken:124 (A) With respect to computer equipment used by its employees, contractors,125 subcontractors, agents, leased employees, or other staff which the employer owns,126 leases, or otherwise makes available or allows to be connected to the employer's127 network or other computer facilities when such equipment is used for an illegal purpose128 without the employer's knowledge, consent, or approval; or129 (B) By employees, contractors, subcontractors, agents, leased employees, or other staff130 who misuse an employer's computer equipment for an illegal purp ose without the131 employer's knowledge, consent, or approval.132 (2) No person shall be held criminally liable under this Code section when its protected133 computers, computer equipment, or software product has been use d by unauthorized134 users to violate this Code section without such person's knowledge, consent, or approval.135 (e) This Code section shall not apply to a telecommunications provider's or Internet136 internet service provider's good faith transmission or routing of, or intermediate temporary137 storing or caching of, identifying information.138 (f) No provider of an interactive computer service may be held liable in a civil action139 under any law of this state, or any of its political subdivisions, for removing or disabling140 access to content on an Internet a website or other online location controlled or operated141 by such provider, when such provider believes in good faith tha t such content has been142 used to engage in a violation of this part."143 SECTION 5.144 Chapter 15 of Title 17 of the Official Code of Georgia Annotate d, relating to victim145 compensation, is amended by adding a new Code section to read as follows:146 H. B. 1034 - 6 - 26 LC 59 0193 "17-15-18.147 (a) This Code section shall be known and may be cited as the ' Georgia Financial Fraud148 Victims Relief Fund.'149 (b) As used in this Code section, the term:150 (1) 'Eligible financial fraud' means a violation of Code Section 16-9-109.1 or other fraud151 resulting in a covered transfer, as such term is defined in Code Section 7-1-847, where152 funds are not otherwise reimbursable under federal or state law or by a financial153 institution.154 (2) 'Eligible victim' means a person residing in this state who promptly reports suspected155 fraud to a financial institution, cooperates in any investigation or recovery efforts, and has156 not received reimbursement from any other source for the loss.157 (c) There is created the Georgia Financial Fraud Victims Relief Fund, to be administered158 by the Criminal Justice Coordinating Council. The fund shall c onsist of moneys159 appropriated by the General Assembly; civil penalties and settlement proceeds recovered160 by the state for violations of Code Section 16-9-109.1; and gif ts, grants, and donations. 161 The council shall promulgate rules necessary to implement this Code section.162 (d) Awards shall reimburse uncompensated pecuniary loss up to $10,000.00 per incident163 and $20,000.00 per claimant per calendar year, subject to available funds. Any amounts164 recovered by the victim after such reimbursement shall be repaid to the fund to the extent165 of the award. No award shall duplicate compensation available from any other source.166 (e) An eligible victim shall apply within one year of discover y of the fraud, subject to167 equitable tolling for good cause.168 (f) The council shall issue an eligibility determination withi n 90 days of receipt of a169 complete application.170 (g) The council shall publish an annual report on claims recei ved, awards granted or171 denied, and aggregate losses and recoveries."172 H. B. 1034 - 7 - 26 LC 59 0193 SECTION 6.173 Chapter 15 of Title 45 of the Official Code of Georgia Annotate d, relating to general174 provisions relative to the attorney general, is amended by adding a new Code section to read175 as follows:176 "45-15-21.177 (a) The Attorney General shall create and maintain a centralized web portal and a toll-free178 hotline dedicated to violations of Code Section 16-9-109.1 inte grated with existing179 consumer complaint systems and capable of referral to applicable federal portals.180 (b) All reports shall receive an acknowledgment within 48 hours and a status update within181 ten business days. The Attorney General shall coordinate refer rals with the Georgia182 Bureau of Investigation, the Department of Banking and Finance, and applicable federal183 agencies.184 (c) The Attorney General shall conduct an annual public awareness campaign focused on185 recognizing fraudulent electronic solicitations, authorized push payment scams, and remote186 access fraud.187 (d) The Attorney General shall develop training programs for s tate and local law188 enforcement agencies and district attorneys regarding technology enabled fraud, including189 artificial intelligence generated voice impersonation, deceptiv e remote access, and190 investigative best practices.191 (e) The Attorney General may promulgate rules and enter into m emoranda of192 understanding necessary to implement this Code section."193 SECTION 7.194 All laws and parts of laws in conflict with this Act are repealed.195 H. B. 1034 - 8 -