Starting on January 1, 2026, new rules for identifying transfers that banks and payment systems may regard as fraudulent will take effect in Russia. Checks will rely on dozens of indicators, including matches with blacklists and suspicious activity detected on a client’s phone.
The discussion followed remarks by Vadim Uvarov, head of the information security department at the Central Bank, who said last week that large self-transfers made through the Fast Payments System would be added to the list of suspicious transaction indicators. He said fraudsters can more easily steal money when it is concentrated in one account, especially if they have already gained access to it.
That statement prompted media reports that led many Russians to fear that any large transfer between their own accounts would be treated as suspicious. The Bank of Russia later published an order explaining how financial institutions should determine whether a transfer is being made without a person’s genuine consent.
According to the document, sending money to oneself is not, by itself, considered fraud. Questions may arise, however, if after a large self-transfer a client sends any amount to another person with whom they have had no transactions for at least six months. In that case, scrutiny would focus not on the first transfer but on the next one.
“On the one hand, it is clear that the schemes are becoming more sophisticated, and filters are necessary. On the other, sometimes you just want to transfer money спокойно without wondering whether it matches ‘typical behavior,’” the article says, summarizing reactions from Russians.
If a legitimate transaction is deemed suspicious, the bank may block the transfer and the card and begin a review. Once the review is completed, access to the funds should be restored. The article also cites a reader of T-Zh, who said cards from two different banks had been blocked twice in the past six months because of FPS transfers between the reader’s own accounts.
The order also sets out indicators of suspicious transactions involving the digital ruble. As with ordinary transfers, these include cases where the recipient matches a Central Bank blacklist or an internal list maintained by the digital ruble platform operator.