This empirical juridical study examines the implementation of Bank Indonesia Regulation Number 2 of 2024 on information system security and cyber resilience as a framework for strengthening consumer protection at the Bank Indonesia Representative Office in Central Java Province. The expansion of QRIS, BI-FAST, electronic wallets, mobile banking, and other digital payment services has improved transaction efficiency while increasing exposure to system disruptions, personal data misuse, phishing, account takeover, and social engineering. The study used a descriptive-analytical design. Primary data were obtained through interviews and observations at the Bank Indonesia Representative Office in Central Java Province between December 2025 and February 2026, while secondary data consisted of legislation, regulatory documents, institutional reports, books, and peer-reviewed literature. The data were analyzed qualitatively by relating the applicable legal framework to empirical implementation. The findings show that the regulation has shifted protection toward preventive, risk-based supervision through governance, identification, protection, detection, response, recovery, reporting, and inter-agency coordination. Nevertheless, implementation is constrained by centralized supervisory authority, uneven technological and human-resource capacity among payment service providers, incomplete incident reporting, and low consumer digital-security literacy. The study concludes that the regulation provides a strong legal basis, but its effectiveness depends on coordinated supervision, provider compliance, interoperable incident handling, and sustained public education. The article also notes the issuance of Bank Indonesia Regulation Number 6 of 2026 after data collection as a subsequent development in the consumer-protection framework.