Banks Are Ditching OTP Texts By June—Here's How Your Money Stays Safe

Logging into your banking app may look a little different soon. The familiar step of waiting for a one-time password (OTP) via text message could soon disappear, as the Bangko Sentral ng Pilipinas (BSP) moves to strengthen the country's defenses against online scams.

The change is part of the implementation of the Anti-Financial Account Scamming Act (AFASA), a law designed to combat the rise of phishing attacks, SIM-swap fraud, and other forms of digital financial scams. In a draft memorandum, the BSP explained that the new framework aims to "reduce the risk of account takeover, device compromise, spoofing, and unauthorized credential changes."

So that six-digit code you've gotten used to typing in? It might soon be replaced by something smarter—and more secure.

SMS OTPs have long been the standard step for confirming logins and approving online transactions. It's simple, familiar, and quick—until scammers learned how to work around them.

According to the BSP, traditional OTPs sent through SMS or email are considered "interceptable authentication methods." That means cybercriminals can potentially trick telecom providers into transferring a victim's phone number to a new SIM card. The moment that number changes hands, OTP messages land straight in the scammer's inbox instead of the rightful owner's phone.

Financial institutions handling large volumes of digital transactions will need stronger safeguards moving forward. The BSP's updated framework pushes banks to upgrade their security systems as more Filipinos rely on mobile banking for everyday payments, transfers, and online shopping (yes, even those late-night checkout sprees).

Instead of waiting for a text message code, future logins and transactions may rely on more advanced—and sometimes invisible—security checks.

Some of the methods banks are expected to adopt include:

• Biometric authentication. This includes fingerprint scans or facial recognition to confirm your identity directly through your device.

• In-app OTPs or push notifications. Instead of receiving a code through SMS, verification may happen inside the banking app itself through secure notifications.

• Behavioral biometrics. Certain systems analyze patterns such as typing speed, swipe gestures, or device movement to verify that it's really you using the app.

• Silent authentication. This method verifies your mobile number directly through the telecom network without requiring you to manually input a code.

The transition won't happen overnight, but users can expect banks and financial apps to gradually roll out these updated security features before the June 30, 2026 deadline set by the BSP.

The guidelines also emphasize that new authentication systems must remain inclusive and accessible. Banks should consider users such as elderly individuals with worn or damaged fingerprints, as well as persons with disabilities, when designing biometric solutions.

At the same time, the BSP is requiring financial institutions to strengthen data protection. Banks must store biometric information as encrypted templates instead of raw images, and they must use safeguards like liveness detection and deepfake detection to ensure the system can distinguish real users from digital impersonations.

With stronger authentication tools on the way, the goal is simple: make sure the person accessing your bank account is actually you.