The Bangko Sentral ng Pilipinas (BSP) will require banks and e-wallet providers to stop using SMS and email one-time passwords (OTPs) starting June 30, 2026.
The change is part of BSP Circular 1213, issued in June 2025 under the Anti-Financial Account Scamming Act (AFASA), also known as Republic Act No. 12010.
Under the new rules, banks, e-money issuers, and payment operators supervised by the BSP must replace SMS OTPs with stronger authentication methods for sensitive transactions.
Instead of six-digit codes sent through text messages, users will begin using biometric verification and device-based authentication methods such as fingerprint scanning, Face ID, and in-app approval prompts.
Since SMS messages travel through telecom networks outside the bank’s direct control, fraudsters can sometimes gain access to OTPs and use them to approve unauthorized transactions.
OTP verification will still be allowed for confirming ownership of a registered mobile number, but no longer for authorizing sensitive transactions.
BSP Deputy Governor Elmore Capule earlier confirmed that the June 2026 deadline will not be extended. Financial institutions that fail to comply may face liability for customer losses linked to fraud incidents under AFASA.
In the coming weeks, banking and e-wallet apps such as GCash, Maya, BPI, BDO, GoTyme, and UnionBank are expected to roll out updates prompting users to enable biometric authentication.
Users are advised to update their banking apps, enable biometric login features, and make sure their registered mobile numbers remain active before the June 30 deadline.
ManilaShaker is a tech media producing insightful and helpful content for our local and growing international audience. Our goal is to create a premier Philippine digital consumer electronics resource that provides the most objective reviews and comparisons globally.
