CA AB230

Requires businesses providing banking or financial services over the Internet to implement and maintain reasonable policies and procedures for authenticating and verifying the legitimacy of consumer transactions.

Mandates use of out-of-band, two-factor authentication solutions to ensure strong authentication and identity management for users performing transactions and accessing financial account information online.

Establishes a civil penalty of $3,000 for businesses that fail to comply with the authentication and verification requirements.

Allows customers injured by fraudulent transactions in violation of these requirements to file a civil action to recover damages.

Takes effect immediately as an urgency statute to protect consumers' financial account information from fraudulent activity.