The Central Bank of Russia published a list of nine indicators of potentially fraudulent ATM cash withdrawals and, from 1 September 2025, requires payment card-issuing banks to use them to identify cases where customers may be manipulated by fraudsters. If a withdrawal meets at least one indicator, the bank must immediately notify the customer and limit ATM cash withdrawals to RUB 50,000 per day for 48 hours, while allowing customers to request larger amounts at bank offices; the notification method must be set out in the bank-customer agreement and typically uses SMS or push notifications. The indicators include atypical withdrawal behaviour such as unusual time, amount, or ATM location, and non-standard withdrawal methods such as using a QR code or a digital card instead of a physical card. Banks are also expected to flag cases where they become aware that, at least six hours before the transaction, the customer’s phone call activity changed and the number of SMS and instant messages received from unknown numbers increased, as well as withdrawals within 24 hours after taking out a loan or microloan, raising a cash withdrawal limit (including on a credit card), receiving more than RUB 200,000 via the Faster Payments System from the customer’s own account at another bank, or closing a deposit of at least that amount early. Further signs cover changes to the telephone number used to log into online banking and information, including from mobile operators, that the customer’s device characteristics have changed or malware is installed; criteria for cash withdrawals using tokenised cards are set out separately.
Central Bank of Russia 2025-08-21
Central Bank of Russia mandates fraud checks for ATM cash withdrawals and a temporary RUB 50,000 daily cap when indicators are triggered
Starting 1 September 2025, the Central Bank of Russia requires banks to use nine indicators to detect potentially fraudulent ATM withdrawals. If any indicator is met, banks must notify the customer and limit withdrawals to RUB 50,000 per day for 48 hours, with larger amounts available at bank offices. Indicators include atypical withdrawal behavior, changes in phone activity, and recent large transactions or account changes.