Many banks and e-wallets have phased out OTPs for authentication, BSP says

MANY Philippine banks and electronic wallet operators have already moved away from text- and e-mail-based one-time passwords (OTPs) before the June 25 deadline to shift to more secure authentication measures to improve consumer protection, the Bangko Sentral ng Pilipinas (BSP) said.

“Many are already implementing the enhancements in the lead-up to the deadline,” the central bank said in a statement on Wednesday.

“The BSP is equally dedicated to promoting innovation in financial services as to protecting customers from new forms of fraud, including technology-enabled fraud,” BSP Deputy Governor Lyn I. Javier said. “We are pleased that banks and e-wallet operators are stepping up on both fronts.”

The central bank gave its supervised financial institutions (BSFIs) until June 25, or a year after the Anti-Financial Account Scamming Act (AFASA) or Republic Act No. 12010 took effect, to replace OTPs with stronger authentication technologies like biometric, behavioral, adaptive, or password-less solutions.

This requirement applies for high-risk transactions and major account changes in digital financial applications of banks and e-wallet operators with at least P75 million in average monthly online transactions over six months.

For low-risk transactions, the BSP still allows financial institutions to use text-based OTPs.

BSFIs whose average monthly digital transactions are under P75 million are not required to shift to stronger verification tools within the same transition period, but the central bank still mandates them to regularly evaluate risks tied to their products and services and implement appropriate anti-fraud measures.

Banks are also required to strengthen their fraud management systems to better detect and prevent unauthorized transactions. “These systems must be capable of flagging unusual or suspicious activities, including unusually rapid transactions and those involving new recipients or unrecognized devices.”

“The BSP is committed to promoting a safe, secure, and resilient digital payments ecosystem while supporting the continued growth of digital financial services,” the central bank said. — Katherine K. Chan