The Bangko Sentral ng Pilipinas has drawn a hard line. By June 30, 2026, all BSP-supervised financial institutions must fully phase out SMS-based One-Time Passwords (OTPs) under the Anti-Financial Account Scamming Act (AFASA ), implemented through BSP Circular No. 1213. That deadline is not moving — as BSP Deputy Governor Elmore Capule recently confirmed in a Philippine Daily Tribune report.

Why the BSP Is Moving Away from SMS OTPs

For years, the SMS OTP has been the default second layer of security for mobile banking in the Philippines. But the BSP now considers it a liability. SMS-based authentication is highly vulnerable to SIM-swapping, text hijacking, and social engineering — tactics that scammers have refined into a reliable playbook, costing Filipino consumers millions in losses every year.

The verdict is clear: SMS OTPs are no longer strong enough to protect your customers or your business.

What Replaces Them

The BSP is pushing financial institutions toward stronger, phishing-resistant authentication methods:

In-App Authentication and Push Notifications — Transactions are approved within the secure, encrypted environment of the banking app itself, bypassing the telecom network entirely.
Biometric Verification — Fingerprint scanning and facial recognition, now standard across modern smartphones and enterprise endpoints.
Behavioral Biometrics — Advanced systems that authenticate users in the background based on unique patterns like typing speed, swipe behavior, and device movement.
Silent Authentication — A seamless background process that verifies a user's mobile number directly through the telecom network, with no manual input required.

What This Means Beyond Banking

This transition signals something larger than a banking policy update. It reflects a fundamental rethinking of how authentication should work across industries — and the ripple effects will be felt well beyond financial institutions. For businesses in financial services, healthcare, retail, and BPO, this is a clear signal: your security posture needs to keep pace with evolving threats and regulatory expectations.

How to Stay Secure and Compliant

Upgrading authentication is not just a compliance task. It is an infrastructure decision that touches your network, your endpoints, and your vendor integrations. The right approach starts with understanding where your current environment falls short.

At ABBE, we help organizations assess their IT and security infrastructure, identify the right authentication solutions, and modernize access controls — so you stay protected and ahead of compliance requirements, not scrambling to catch up.

The deadline is June 30, 2026. The time to act is now.

ABBE Technology Solutions