The Bangko Sentral ng Pilipinas (BSP) has mandated robust digital banking security measures under Circular No. 1213, s. 2025, requiring Philippine banks and e-wallets to adopt stronger authentication mechanisms by June 25, 2026.
BSP-supervised Financial Institutions (BSFIs) are now required to adopt biometric, behavioral, adaptive, or passwordless authentication to protect Filipino consumers against fraud, while ensuring the resilience of the country’s digital financial ecosystem.
Goal of Eradication of OTPs
In May 2025, BSP issued Circular No. 1213, requiring covered BSP-supervised financial institutions (BSFIs) to replace SMS and email-based one-time passwords (OTPs) with stronger authentication technologies.
These include biometric verification, behavioral analytics, adaptive authentication, and passwordless solutions.
The regulation applies to banks and e-wallet operators averaging more than ₱75 million in monthly online transactions, covering most universal and commercial banks, all digital banks, and selected cooperative, thrift, and rural banks.
Institutions must deploy these technologies for high-risk transactions, while lower-risk transactions may still use SMS-based OTPs. Additionally, BSFIs must strengthen fraud management systems capable of detecting suspicious activities such as rapid transactions or unrecognized devices.
Addressing the Root Problem
In recent years, the Philippines has seen a sharp increase in OTP-related scams.
Fraudsters exploit weaknesses in SMS and email OTP delivery by intercepting messages, tricking consumers through phishing links, or using social engineering tactics to obtain codes.
In 2024 alone, the local financial services industry recorded 38,370 phishing attacks, part of a global 83% rise in financial scams. Many of these attacks specifically targeted OTP mechanisms, which can be intercepted or shared with third parties.
TransUnion reported that the suspected digital fraud rate in the Philippines reached 13.4% in 2024, nearly 150% higher than the global average of 5.4%.
Over 74% of Filipinos said they were targeted by fraud attempts via email, phone calls, or text messages, with one-third reporting financial losses averaging ₱44,700 per victim.
These figures underscore the vulnerability of OTP-based systems, which remain the most common authentication method for online banking and e-wallet transactions.
Why OTPs are Vulnerable
OTPs delivered via SMS or email are susceptible to:
- SIM-swap attacks, where fraudsters gain control of a victim’s mobile number.
- Phishing schemes, tricking users into entering OTPs on fake websites.
- Man-in-the-middle attacks, intercepting OTPs during transmission.
- Social engineering, convincing victims to disclose OTPs under false pretenses.
These vulnerabilities have made OTPs a prime target for cybercriminals, leading BSP to mandate stronger authentication methods such as biometrics, behavioral analytics, and passwordless solutions.
Central Bank’s Promotion of Customer Protection
The Bangko Sentral ng Pilipinas (BSP) has long positioned itself as both a driver of financial innovation and the primary guardian of consumer protection in the Philippines.
Its mandate goes beyond monetary policy—it extends into ensuring that the rapid digitalization of financial services does not expose consumers to undue risks.
Central to this mission is the Financial Consumer Protection Framework (Circular No. 1160), which requires BSP-supervised financial institutions (BSFIs) to embed consumer protection principles into their governance and risk management structures.
These principles include disclosure and transparency, protection of client information, fair treatment, effective recourse, and fraud prevention.
BSP also enforces the Financial Products and Services Consumer Protection Act (R.A. 11765), which grants it quasi-judicial powers to adjudicate disputes and order restitution for consumers harmed by unfair practices.
In 2024, the government strengthened this framework further with the passage of the Anti-Financial Account Scamming Act (AFASA). This landmark legislation directly addresses the surge in OTP-based scams and other forms of digital fraud.
AFASA criminalizes the use of financial accounts for scams, identity theft, and money mule activities, while also mandating stricter authentication standards for financial institutions. Under AFASA, BSP is empowered to enforce compliance, investigate fraudulent activities, and impose penalties on institutions that fail to protect consumers.
Together, Circular No. 1160, RA 11765, and AFASA create a layered protection system.
BSP ensures that banks and e-wallets not only adopt advanced fraud detection technologies but also uphold consumer rights through transparent practices and effective redress mechanisms. This holistic approach reflects BSP’s recognition that consumer trust is the cornerstone of a resilient and inclusive financial system.
Duties of BSFIs
Banks and BSP-supervised financial institutions (BSFIs) carry a significant responsibility in ensuring customer protection within the Philippine financial system. Their duties extend beyond simply offering financial products and services; they are expected to embed consumer protection principles into every aspect of their operations.
This means that institutions must communicate product features, fees, and risks in a transparent manner, ensuring that customers fully understand the terms of engagement.
They are also tasked with safeguarding client information through robust IT infrastructure and strict confidentiality protocols, recognizing that data privacy is central to consumer trust.
Fair treatment is another cornerstone of their obligations, requiring banks and BSFIs to provide equitable service to all clients regardless of background or financial standing.
In addition, these institutions must maintain effective complaint resolution mechanisms, offering accessible and responsive channels for customers to report fraud or raise concerns
Finally, banks and BSFIs are duty-bound to protect consumer assets against misuse, ensuring that unauthorized transactions are resolved swiftly and that customers are compensated when necessary.
Philippine Platforms’ Support to the Financial Security Commitment
GCash and Maya have actively aligned with BSP directives. In 2025, both platforms removed gambling access features in compliance with BSP’s memorandum, reinforcing their commitment to safe digital environments.
Maya, as a BSP-licensed digital bank, has implemented multilayered security infrastructure, PDIC deposit insurance, advanced fraud prevention systems, and scam awareness education.
MariBank, operated by Sea Group, is among BSP’s licensed digital banks and adheres to the same compliance standards, ensuring biometric and adaptive authentication for its users.
LANDBANK, as a government-owned universal bank, has integrated BSP’s cybersecurity resilience plan into its operations, aligning with national initiatives such as the Financial Services Cyber Resilience Plan (FSCRP) launched in 2024.
DOPAY’s Compliance and Commitment
DOPAY, as a BSP-supervised financial institution, fully complies with Circular No. 1213 and the broader Financial Consumer Protection Framework.
Powered by blockchain technology, DOPAY provides payment, remittance, and financial accessibility through electronic money issuance with its E-Wallet and cryptocurrency exchange with its Crypto Wallet.
By adopting multi-factor authentication, adaptive fraud detection, and transparent consumer communication, DOPAY ensures that its users enjoy secure, reliable, and innovative financial services.
Its compliance underscores its dedication to protecting Filipino consumers while supporting the BSP’s vision of a safe and inclusive digital financial ecosystem.
Download the DOPAY app today!
