31/05/2026
"Bakit Wala Na Akong OTP?" The June 30 Deadline That Changes How You Log Into Your Bank.
Starting June 30, 2026 — that is less than five weeks from now — the way you verify your banking transactions is about to change permanently.
If you have been relying on a six-digit code sent via text to approve your transfers, add a new payee, or log into your banking app, that system is on its way out. And it is being replaced by something significantly harder to steal.
What is happening and why:
By June 30, 2026, every bank, e-money issuer, and payment operator supervised by the Bangko Sentral ng Pilipinas must have phased out SMS and email OTPs for high-risk transactions.
This is mandated under BSP Circular 1213, issued in June 2025 as the implementing regulation for AFASA (Republic Act No. 12010) — the same Anti-Financial Account Scamming Act designed to protect Filipinos from digital fraud.
The Philippines' digital fraud rate stands at 13.4 percent, nearly triple the global average, with Filipinos losing an average of ₱44,700 per fraud incident. That staggering number is a direct consequence of how easy it is to intercept an SMS OTP.
Why SMS OTPs are the problem:
SMS OTPs travel over the telecom network, which the bank has no control over. SIM swap fraud lets attackers receive OTP messages intended for the account holder. Phishing pages harvest codes in real time. Smishing tricks users into reading the code aloud over the phone. Each of these attacks works because the authentication factor has to leave the bank's systems and pass through a channel anyone can potentially intercept.
In short: the six-digit code you type in is only as safe as the text message that carries it — and text messages are not safe enough.
What replaces the SMS OTP:
High-risk transactions and critical account changes must now use phishing-resistant, device-bound alternatives: server-side biometrics validated against bank-held templates, or FIDO2/WebAuthn-standard passkeys with device attestation in place.
In plain terms: expect face ID, fingerprint authentication, and in-app push approvals to become the new standard for authorizing transactions — methods that live on your device and cannot be intercepted by a scammer on a different phone.
What still uses OTP:
OTPs retain one permitted use: confirming the existence or ownership of a registered mobile number. They remain in the toolkit — just not as a way to authorize transactions.
What counts as a "high-risk transaction" under the new rules:
Adding a new payee, updating your registered contact details, initiating large transfers, logging in from a new device — any action that could expose your account to significant loss now requires the stronger authentication method.
Is the deadline being extended?
No. In January 2026, BSP Deputy Governor Elmore Capule confirmed publicly that the central bank is not extending the June 2026 deadline, telling reporters that institutions have to catch up. Banks that are still using outdated technology when fraud occurs face liability for customer losses under AFASA.
What this means for you as a bank customer:
In the coming weeks, your banking apps — GCash, Maya, BPI, BDO, GoTyme, UnionBank, and every other BSP-supervised platform — should be prompting you to set up or enable biometric authentication if you have not already. If your app has been asking you to enable Face ID or fingerprint login and you have been clicking "skip" — now is the time to turn it on.
Three things to do before June 30:
Enable biometric login on every banking and e-wallet app you use. Update your app to the latest version — authentication upgrades are typically delivered through app updates. Verify your registered mobile number with each bank is still active and correct, since number ownership confirmation via OTP remains allowed.
The government is finally closing the gap that scammers have been exploiting for years. Your job is to make sure your apps are ready when June 30 arrives.
