Topic starter
10/07/2026 9:14 pm
TL;DR: The Bangko Sentral ng Pilipinas has set June 30, 2026, as the deadline for Philippine banks to stop using SMS OTPs for high-risk transactions, while AFASA ties adequate authentication controls to liability protection and requires real-time fraud detection for larger institutions, according to Authsignal. The real shift is that authentication must now be intercept-resistant, layered, and auditable rather than merely available.
Editorial analysis by NHI Mgmt Group, based on content published by Authsignal: “BSP Circular 1213: Philippine banks must replace SMS OTPs by June 2026”.
Key questions
Q: What breaks when banks rely on SMS OTP as the only transaction authentication method?
A: Banks expose themselves to account takeover and transaction fraud because a stolen or relayed OTP proves only that a code was received, not that the session, device, or transaction is trustworthy.
Q: Why do banks need stronger authentication for large transfers and payee changes?
A: Those actions create direct fraud exposure, so the institution needs assurance that the transaction was authorised under conditions the attacker could not easily intercept or replay.
Q: How can security teams tell whether machine authentication is actually working?
A: Machine authentication is working only if each client has a unique, verifiable identity and its access is limited to the exact systems it should reach.
Practitioner guidance
- Retire SMS OTP from high-risk flows Remove SMS OTP from payee changes, large transfers, contact-detail updates, and any other critical account change covered by the circular.
- Move covered verification to server-side controls Use backend verification for biometrics and other covered factors so the bank, not the handset, owns the trust decision for the transaction.
- Layer authentication with fraud telemetry Combine device binding, behavioural signals, transaction risk scoring, and real-time fraud detection for institutions in scope of the volume threshold.
Bottom line: SMS OTP is no longer a defensible control for high-risk banking actions when the factor can be intercepted outside the bank's trust boundary.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
10/07/2026 9:37 pm
Interceptable authentication is now a liability boundary, not just a control weakness: Circular 1213 treats SMS OTP as unsuitable for high-risk banking actions because the factor can be intercepted outside the bank's control. That is a broader shift in governance logic: if an authentication method can be socially engineered or redirected mid-flow, it no longer provides defensible assurance for regulated transactions. Banks should read this as a change in the trust model, not a channel preference.
A question worth separating out:
Q: Who is accountable when weak authentication leads to payment fraud?
A: Accountability sits with the financial institution when it fails to meet regulatory authentication and fraud-prevention requirements. In practice, that means banks must be able to evidence their control design, implementation, and monitoring across the full transaction journey, not just at sign-in.
👉 Read our full editorial: BSP Circular 1213 pushes banks beyond SMS OTP for high-risk access