THE Bangko Sentral ng Pilipinas (BSP) has ordered digital banking applications to stop using one-time passwords (OTPs) sent via SMS by June 30, 2026, as part of efforts to strengthen financial account security.
The move is in line with Section 6 of the Anti-Financial Account Scamming Act, which seeks to protect consumers from fraud and unauthorized access to financial accounts.
The BSP said SMS-based OTPs pose security risks because text messages can be intercepted or accessed by third parties. One major vulnerability stems from the Signaling System No. 7 (SS7), a decades-old telecommunications protocol used to route calls and messages across networks.
Originally designed in the 1970s for a small number of trusted telecom operators, SS7 has become increasingly vulnerable as telecommunications networks expanded. Cybersecurity experts have warned that attackers can exploit these weaknesses to reroute text messages, including OTPs, and gain unauthorized access to accounts.
To improve security, BSP Circular No. 1213 directs financial institutions to adopt stronger multi-factor
authentication methods.
These include biometric verification such as fingerprint and facial recognition, behavioral biometrics, passwordless authentication using security keys, and adaptive systems that can detect unusual or suspicious account activity.
The shift is aimed at reducing fraud risks and enhancing protection for users of digital financial services. / STE