Around 40 financial technology (fintech) companies are now phasing out one-time passwords (OTPs) in their security systems, as the financial industry races to meet the Bangko Sentral ng Pilipinas’ (BSP) midyear deadline for adopting more advanced anti-fraud systems.

Lito Villanueva, founding chairman of FinTech Alliance.ph, told reporters last Tuesday, March 24, that around a third of the over 130-member fintech group have now begun steering away from SMS OTPs.

For one, e-wallet giant GCash has reportedly transitioned to in-app push notifications, where OTPs are now provided directly within the app. Such a mode is expected to eliminate or lessen the exposure of financial institutions to SIM-linked attacks.

Villanueva noted that fintech firms are facing challenges such as the massive costs required for the mandatory shift, maintaining that the industry will comply with the BSP’s order.

This shift forms part of a broader regulatory push under the Anti-Financial Account Scamming Act (AFASA), which aims to address the rising tide of account takeovers and unauthorized transactions.

OTPs, according to Villanueva, are deemed vulnerable to attacks because users can knowingly give them away, risking account takeover.

Instead of this authentication method, systems will soon rely on biometrics and device binding for stronger security. This means each digital account will be linked to a single registered smartphone, limiting access to that specific device.

Aside from device binding, more sophisticated defenses also include behavioral device intelligence, which uses pattern recognition to detect suspicious activity.

According to the fintech alliance chief, the central bank’s order is being complied with seriously, as the lack of a secure anti-fraud system shifts the liability to banks or fintech firms when customer accounts are compromised.

Villanueva earlier said the BSP holds the final decision on appeals to extend the implementation deadline in June 2026. The BSP has been pushing for the removal of OTPs, noting that most fraud-related complaints involve compromised credentials.

Recall that the BSP raised the stakes for noncompliance, previously warning it may exercise its authority to suspend banking licenses or hold lenders liable for client losses resulting from fraud if they fail to establish the required fraud management systems.