TL;DR: The Bangko Sentral ng Pilipinas has set June 30, 2026, as the deadline for Philippine banks to stop using SMS OTPs for high-risk transactions, while AFASA ties adequate authentication controls to liability protection and requires real-time fraud detection for larger institutions, according to Authsignal. The real shift is that authentication must now be intercept-resistant, layered, and auditable rather than merely available.
At a glance
What this is: This is Authsignal's analysis of Philippine banking rules that force institutions away from SMS OTPs for high-risk access and toward intercept-resistant, layered authentication.
Why it matters: IAM and fraud teams need to treat authentication method choice as a control and liability decision, not just a user experience issue, because high-risk banking actions now sit under stronger regulatory scrutiny.
Context
The security gap here is simple: SMS OTPs are a reachable authentication factor, not a controlled one. When the code has to travel through a telecom channel, the bank loses direct control over interception, phishing, SIM swap abuse, and social engineering.
For IAM and fraud programmes, the issue is not whether one factor is available, but whether it can survive real attack paths at transaction time. Philippine banks now have to treat high-risk access as an authentication governance problem, not a login-only problem.
Circular 1213 also extends the question beyond sign-in. Payee changes, contact-detail updates, and large transfers all fall under the same decision space, which means authentication design, fraud detection, and liability posture now move together.
Key questions
Q: What breaks when banks rely on SMS OTP as the only transaction authentication method?
A: Banks expose themselves to account takeover and transaction fraud because a stolen or relayed OTP proves only that a code was received, not that the session, device, or transaction is trustworthy. Once the attacker controls the channel or the user is socially engineered, the code becomes a weak hurdle rather than a real assurance step.
Q: Why do banks need stronger authentication for large transfers and payee changes?
A: Those actions create direct fraud exposure, so the institution needs assurance that the transaction was authorised under conditions the attacker could not easily intercept or replay. The control has to protect the action itself, not just the login event.
Q: How can security teams tell whether machine authentication is actually working?
A: Machine authentication is working only if each client has a unique, verifiable identity and its access is limited to the exact systems it should reach. If credentials are shared, embedded broadly, or accepted across unrelated workflows, authentication may still succeed while governance fails. A good signal is whether revocation of one identity affects only one machine path.
Q: Who is accountable when weak authentication leads to payment fraud?
A: Accountability sits with the financial institution when it fails to meet regulatory authentication and fraud-prevention requirements. In practice, that means banks must be able to evidence their control design, implementation, and monitoring across the full transaction journey, not just at sign-in.
Technical breakdown
Why SMS OTP breaks down for high-risk banking actions
SMS OTP is weak for high-risk access because it depends on a delivery path the institution does not control. Once the code leaves the bank and moves through the telecom network, attackers can intercept it through SIM swap fraud, phishing, or smishing. In practical terms, the bank is outsourcing part of authentication assurance to a channel that can be socially engineered or redirected. Circular 1213 therefore targets the mechanism, not just the factor type. The control problem is not that the code is short-lived. It is that the trust boundary is external to the bank at the exact moment authorisation matters.
Practical implication: replace any authentication step that can be intercepted outside the bank's trust boundary for high-risk transactions.
Server-side biometrics versus device-side checks
The circular's biometric guidance makes an important architectural distinction. Device-side biometrics only prove that a phone can unlock an app, which fails if the device is compromised. Server-side biometrics move the verification into the bank's backend, where identity can be checked against stored templates independently of the handset state. That does not make biometrics standalone. The article notes that templates must be encrypted, liveness and deepfake detection are required, and biometrics must be layered with other signals. This is a governance shift from authentication as a single event to authentication as a controlled decision chain.
Practical implication: use backend verification and layered signals for covered transactions rather than treating mobile device unlock as proof of identity.
Why layered and risk-based authentication is now the baseline
Circular 1213 ties compliance to risk tiering, not to one prescribed method. That means the same institution may use different flows for balance checks, new payees, and large transfers, with device binding, behavioural signals, and transaction risk scoring working together. The article also notes that larger institutions must pair authentication with real-time fraud detection. For IAM teams, the lesson is that authentication cannot be isolated from fraud telemetry, vendor due diligence, or auditability. The control objective is to make high-risk action authorisation resistant to interception and responsive to context, not merely frictionful.
Practical implication: design authentication policies around transaction risk, then align fraud detection and vendor controls to the same risk model.
Threat narrative
Attacker objective: The objective is to bypass account-holder verification for a high-risk banking transaction and move money or alter account settings under fraudulent control.
- Entry occurs when attackers exploit a reachable factor such as SMS OTP through phishing, smishing, or SIM swap fraud.
- Credential harvesting happens in real time when the victim reveals or receives the OTP and the attacker uses it before expiry.
- Impact follows when the attacker authorises a high-risk banking action such as adding a payee, changing contact details, or initiating a large transfer.
Breaches seen in the wild
- New York Times GitHub breach 2024: An exposed GitHub token gave an attacker The New York Times' repositories; the 270GB leak held 4,875 unique secrets.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Interceptable authentication is now a liability boundary, not just a control weakness: Circular 1213 treats SMS OTP as unsuitable for high-risk banking actions because the factor can be intercepted outside the bank's control. That is a broader shift in governance logic: if an authentication method can be socially engineered or redirected mid-flow, it no longer provides defensible assurance for regulated transactions. Banks should read this as a change in the trust model, not a channel preference.
Risk-tiered authentication is replacing one-size-fits-all login controls: The article makes clear that the regulated decision is not whether a user can sign in, but whether a specific transaction deserves stronger proofing. That matters because identity programmes have historically over-invested in login friction and under-invested in authorisation-time assurance. The practitioner takeaway is that transaction class must drive control strength, especially where fraud liability is explicit.
Biometrics are only acceptable when the assurance path stays under bank control: Server-side biometric validation, encrypted templates, liveness checks, and layered signals are doing the governance work here, not biometrics alone. The article reinforces a recurring NHI lesson: a credential is only as strong as the trust boundary around its issuance, storage, and verification. For financial institutions, the control conversation shifts from factor type to evidence quality and backend integrity.
AFASA turns authentication design into a financial accountability issue: The liability framework means weak controls can now become direct reimbursement exposure. That makes authentication architecture part of operational risk management, legal exposure, and fraud governance at the same time. Institutions that still treat authentication as an IT implementation detail will underestimate how quickly control gaps become balance-sheet problems.
Named concept, intercept-resistant authorisation: This article defines the practical control standard as authorising high-risk actions through mechanisms that cannot be intercepted, replayed, or socially engineered out of the user. That is a more exact benchmark than MFA in general, and it is the right lens for banks facing similar rules. Practitioners should anchor their programme to that assurance target, not to channel replacement alone.
What this signals
Intercept resistance is the new control test: Banks should evaluate authentication by whether an attacker can intercept, replay, or socially engineer the factor out of the user during a covered transaction. That standard is more useful than counting how many methods are supported.
Transaction risk should drive assurance strength: If a balance check and a new-payee transfer use the same verification path, the programme is flattening risk that the regulator now expects to be differentiated. Banks need transaction-class policy, not generic login policy.
Vendor governance now sits inside authentication design: Where a third party provides biometric or verification capabilities, contracts, audits, and data protection terms become part of the control, not procurement afterthoughts. That changes how IAM and fraud teams scope ownership.
For practitioners
- Retire SMS OTP from high-risk flows Remove SMS OTP from payee changes, large transfers, contact-detail updates, and any other critical account change covered by the circular.
- Move covered verification to server-side controls Use backend verification for biometrics and other covered factors so the bank, not the handset, owns the trust decision for the transaction.
- Layer authentication with fraud telemetry Combine device binding, behavioural signals, transaction risk scoring, and real-time fraud detection for institutions in scope of the volume threshold.
- Audit third-party authentication vendors Review vendor security architecture, contract data protection clauses, and independent audit rights before relying on external biometric or verification services.
- Document liability-aligned control coverage Map which transaction types receive adequate authentication controls so reimbursement exposure can be assessed against AFASA obligations.
Key takeaways
- SMS OTP is no longer a defensible control for high-risk banking actions when the factor can be intercepted outside the bank's trust boundary.
- The article ties compliance to both authentication design and fraud management, which means identity and fraud teams now share responsibility for the same control outcome.
- Banks that keep relying on interceptable factors risk both fraud exposure and reimbursement liability, so the practical standard is backend-controlled, layered authentication.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-04 — Insecure Authentication | The article is about authentication methods that remain interceptable in high-risk flows. |
| NHI-02 — Secret Leakage | OTP codes can be exposed through phishing, smishing, and SIM swap interception. | |
| Recommendation — Replace interceptable authentication mechanisms with bank-controlled verification for covered transactions. Treat one-time codes as exposed credentials when they can be intercepted outside the trust boundary. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | The circular changes how authenticator lifecycles and control strength are managed. |
| IA-9 — Service Authentication | Server-side verification and backend-controlled checking align with machine-mediated authentication assurance. | |
| Recommendation — Apply authenticator management to phase out weak transaction factors and enforce stronger covered-flow controls. Use backend-authenticated verification paths for high-risk actions instead of relying on device-held proof alone. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is fundamentally about stronger authorisation for banking actions, not only login. |
| Recommendation — Tie transaction authorisation strength to risk so high-impact actions receive stronger access control. | ||
| MITRE ATT&CK | TA0006;TA0001 — Credential Access; Initial Access | SIM swap, phishing, and smishing are the dominant ways attackers obtain OTP credentials. |
| Recommendation — Map OTP abuse to credential access and initial access patterns in fraud detection and response playbooks. | ||
Key terms
- Interceptable Authentication Mechanism: Any authentication method that must travel through a channel outside the issuer's direct control before the authorisation decision is complete. In banking, SMS OTP is the clearest example because telecom interception, phishing, and smishing can all break the assurance chain.
- Server-Side Biometrics: An authenticator pattern where the bank verifies biometric evidence against templates stored in its own backend. The control keeps the assurance decision inside the institution's trust boundary, which makes it stronger than device-only checks when the device itself may be compromised.
- Risk-Based Authentication: An access model that changes verification requirements based on the estimated risk of the request. It combines identity assurance, device posture, application sensitivity, and contextual signals to decide whether to allow, block, or step up verification before access is granted.
- Layered Authentication: Layered authentication combines more than one signal, such as biometrics, device binding, and behavioural analytics, to raise assurance for critical actions. The value is not redundancy for its own sake, but resilience when one signal can be social-engineered or compromised.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.
Published by the NHIMG editorial team on July 10, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org