Topic starter
14/07/2026 4:22 pm
TL;DR: Bangko Sentral ng Pilipinas Circular 1213 will make SMS OTP non-compliant for high-risk transactions in Philippine banks and licensed digital financial services providers, with reimbursement liability for scam losses landing on institutions that fail to comply, according to Smile Identity. The circular shifts authentication from device-controlled one-time codes to stronger, server-side proof that the account holder is present.
Editorial analysis by NHI Mgmt Group, based on content published by Smile Identity: “SMS OTP is out, robust Biometric Authentication is in.”.
Key questions
Q: What breaks when banks rely on SMS OTP as the only transaction authentication method?
A: Banks expose themselves to account takeover and transaction fraud because a stolen or relayed OTP proves only that a code was received, not that the session, device, or transaction is trustworthy.
Q: Why do banks need server-side biometric authentication instead of device-side biometrics?
A: Banks need server-side biometric authentication because the decision must sit with the institution, not with the user’s handset.
Q: What are the signs that SMS MFA is failing as a security control?
A: The clearest signs are repeated account takeovers despite MFA, users reporting unexpected login prompts or code requests, and reliance on SMS for privileged or high-value accounts.
Practitioner guidance
- Retire SMS OTP for high-risk transactions Inventory every transaction flow that still uses SMS OTP and classify it by risk level, customer impact, and regulatory exposure.
- Move proof-of-presence into the bank backend Use server-side biometric authentication for transaction approval so the institution, not the device, evaluates the biometric assertion and associated risk signals before release.
- Separate login assurance from transaction authorisation Do not treat a phone unlock or app presence as sufficient evidence for high-risk transfers.
Bottom line: SMS OTP no longer provides sufficient assurance for high-risk transactions in Philippine banking, so institutions must rework how they prove who is initiating payment or transfer activity.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
14/07/2026 4:30 pm
SMS OTP has become a control mismatch for high-risk banking. The problem is not that SMS is old, but that it proves possession without proving trustworthy presence. In a fraud environment shaped by device compromise and account takeover, that gap is now large enough to become a regulatory failure mode. Practitioners should read this as a control redesign issue, not a channel preference issue.
A few things that frame the scale:
- U.S. fraud losses are projected to reach $40 billion by 2027.
A question worth separating out:
Q: Who is accountable when a bank keeps weak authentication in place after the rule change?
A: The institution is accountable, because the circular ties non-compliance to direct reimbursement exposure for scam losses. In practice that means IAM, fraud, operations, and legal teams need a shared view of risk ownership, while executive leadership treats high-risk authentication as a regulated control, not a discretionary product choice.
👉 Read our full editorial: BSP Circular 1213 forces banks beyond SMS OTP for high-risk auth