For years, the text message one-time password (OTP) was a familiar final checkpoint in digital banking: enter the code sent to your phone, and the transaction proceeds. But the same channel designed to protect financial accounts has become a target for fraudsters exploiting phishing, SIM-swap attacks and other methods of intercepting or stealing authentication codes.

The Philippines is now moving toward stronger alternatives. Under Bangko Sentral ng Pilipinas (BSP) Circular No. 1213, covered financial institutions were required to replace SMS- and email-based OTPs with stronger authentication methods for high-risk transactions by June 25, 2026. The shift is part of a broader effort to strengthen fraud management and implement provisions of the Anti-Financial Account Scamming Act (AFASA).

Maya’s introduction of biometric transaction approval offers a practical look at what that transition means for digital financial services. Rather than waiting for a code delivered over a mobile network, eligible users can approve certain money transfers using their face or fingerprint after setting their phone as a trusted device.

The change is more than a convenience upgrade. It reflects a shift in how financial institutions assess trust: away from relying solely on access to a registered phone number and toward authentication tied more closely to a device and the person authorizing a transaction.

SMS OTPs Have a Structural Weakness

SMS-based authentication became popular because it was relatively easy to deploy. Customers did not need a dedicated security key or specialized software; a mobile phone number was often enough to receive a verification code.

That accessibility, however, came with limitations. An SMS OTP can be stolen if a customer is deceived into sharing it through a phishing message or fraudulent customer-support interaction. Criminals may also exploit SIM-swap fraud to gain control of a victim’s number, while certain forms of malware can compromise the devices or communications through which authentication codes are received.

The problem is not that every SMS OTP is inherently insecure. It is that possession of a code delivered through a vulnerable channel does not necessarily establish that the person authorizing a transaction is the legitimate account holder.

That distinction matters as digital financial services become more embedded in everyday payments. An authentication method must do more than deliver a code reliably. It must help establish that the authorization is genuine and resistant to common forms of credential theft.

For financial institutions, the challenge is therefore not simply to replace text messages. It is to strengthen the relationship between a customer’s identity, the device being used and the transaction being approved.

Maya’s Move From Text Codes to Trusted Devices

Maya’s app updates introduced an option to approve eligible money transfers using facial or fingerprint recognition. According to the app’s published release notes, users can set a phone as a trusted device through the Maya app and review or remove trusted phones in its Security Center.

The practical difference is straightforward. Instead of retrieving an OTP from a text message and entering it into the app, an eligible customer can authorize a transfer using the device’s biometric authentication.

This reduces dependence on SMS delivery for supported transactions and removes a step that can interrupt the payment experience. It also changes the security model: the process relies on a trusted-device setup and biometric approval rather than treating a texted code as the final checkpoint.

Biometrics describe a way to verify or authorize a person, while passkeys use cryptographic credentials to authenticate a user. The two can work together: a fingerprint or facial scan may unlock a credential stored on a device. However, Maya’s public release notes confirm biometric approval for eligible transfers on trusted phones; they do not, by themselves, establish that this specific feature is implemented through passkeys or disclose its underlying cryptographic architecture.

The broader direction is clear, but the technical details matter. Financial institutions adopting stronger authentication should be assessed on the protections their systems actually implement, not simply on whether their apps offer a biometric prompt.

Nor does the feature establish that SMS OTPs have disappeared from every Maya workflow. The published description refers to certain transactions and a trusted-device setup. The extent to which alternative verification remains available for account recovery, device changes or other scenarios requires separate confirmation.

Regulation Is Changing the Cost of Authentication

The move away from SMS OTPs is not happening in isolation. BSP Circular No. 1213 amended information-technology risk-management rules to strengthen fraud management among covered financial institutions. The framework calls for stronger controls, including phishing-resistant multi-factor authentication, as well as fraud-monitoring capabilities designed to detect and respond to suspicious activity. The BSP’s listed authentication approaches include biometrics and passwordless methods.

The requirement is not a blanket declaration that every SMS message is prohibited for every purpose. The deadline concerns replacing SMS- and email-based OTPs for high-risk transactions at covered institutions. The specific requirements depend on the scope of the regulation and the institution concerned.

SMS may be familiar and relatively straightforward to integrate, but its cost cannot be measured solely by the price of sending a message. Institutions must also account for fraud exposure, customer support, failed deliveries, transaction abandonment and the operational burden of investigating disputed activity.

Stronger authentication has its own costs. Device-based systems require implementation, testing, compatibility management and secure procedures for enrollment and recovery. Customers may lose phones, replace devices or encounter problems with biometric recognition. Institutions must ensure that alternative paths do not become weaker entry points into otherwise better-protected accounts.

The economic question is therefore not whether one method is always cheaper than another. It is whether the cost of implementing and maintaining stronger authentication is justified by the reduction in risk, operational friction and potential losses.

As regulatory requirements evolve, authentication is increasingly part of a financial institution’s core risk-management infrastructure—not merely a final screen in the payment process.

The Trade-Off

For customers, biometric approval can make a familiar action faster. There is no need to switch between an app and a text-message inbox to retrieve a code when the feature is available and working as intended.

But convenience should not be mistaken for comprehensive fraud prevention.

Biometric verification does not, on its own, establish that a recipient is trustworthy, that a transaction is legitimate or that an account has not been compromised through another route. A customer can still be manipulated into initiating a transfer, and a compromised device can present risks that authentication alone may not resolve.

Effective protection therefore requires several layers: authentication, transaction monitoring, customer notifications, controls over new devices and recipients, and processes for identifying suspicious behavior.

This is consistent with the direction of the BSP’s wider framework, which pairs stronger authentication with fraud-management controls.

The customer experience also depends on what happens when the normal route fails. A biometric prompt may be convenient on a supported, properly configured device, but a lost phone, damaged sensor, changed device or failed enrollment can turn a streamlined process into a support problem.

For financial institutions, the objective should not be to eliminate friction at any cost. It should be to place friction where it meaningfully reduces risk—and make recovery secure enough that customers are not forced toward weaker workarounds.

The Accessibility Gap Cannot Be Ignored

A transition to device-based authentication raises a question that product teams cannot answer through security metrics alone: who might have difficulty using the new system?

Customers may use older phones, devices without suitable biometric capabilities or shared devices on which more than one person has registered a face or fingerprint. Others may have difficulty with biometric recognition or lack reliable access to the device they originally registered.

The precise impact depends on how a provider implements authentication, which devices it supports and what alternatives it offers. Maya’s public feature description does not establish how every unsupported-device or recovery scenario is handled, so the scale of any accessibility gap cannot be determined from the announcement alone.

Nevertheless, these are essential design considerations for any institution moving away from SMS OTPs.

A secure alternative must be available to customers who cannot use the preferred method without undermining the protections the transition is intended to provide. Recovery processes must also be designed carefully: if a financial institution replaces SMS as a weak point but relies on easily manipulated procedures to register a new device, some of the security gains may be lost.

The challenge is to make stronger authentication usable across different devices and customer circumstances without making exceptions easier to exploit.

Beyond SMS: Authentication as a System

Biometric approval is one part of a wider evolution in digital authentication. Other approaches include passkeys, hardware security keys, behavioral signals and adaptive authentication, which can adjust verification requirements according to factors such as the device, location or activity involved.

These methods address different parts of the problem. Cryptographic credentials can reduce reliance on reusable secrets that users may be tricked into disclosing. Behavioral and transaction monitoring can help identify activity that appears unusual even when a customer has passed an initial authentication step. Additional verification can be required when risk signals warrant it.

No single method eliminates fraud. Their value depends on how they are implemented, combined and supported by the institution’s broader controls.

For product managers, that means evaluating authentication against more than completion speed. Relevant measures include fraud rates, account-takeover attempts, false declines, failed enrollment, recovery incidents, customer support volume and the share of customers who can use the intended method successfully.

For fraud-prevention teams, the transition requires examining whether stronger authentication is integrated with transaction monitoring and response procedures. For security architects, it requires understanding how devices are enrolled, how credentials are protected and how access is revoked when a device is lost or no longer trusted.

Maya’s trusted-device feature illustrates the customer-facing side of this transition. The BSP’s rules establish the broader regulatory pressure. Together, they point to a market in which SMS OTPs are no longer sufficient as the default protection for high-risk digital financial transactions.

The End of Cheap Authentication

The SMS OTP is not necessarily disappearing from every digital service or every banking workflow. It is losing its position as an adequate standalone safeguard for high-risk transactions at institutions covered by the new requirements.

That is a more consequential shift than a simple change in how customers approve transfers. It forces financial institutions to treat authentication as a combination of technology, risk management and customer experience—and to account for the costs of getting any of those elements wrong.

Maya’s biometric approval feature offers a visible example of what the transition can look like: eligible transfers can be authorized through a trusted phone instead of a code delivered by SMS. The full security value, however, depends on the underlying implementation, the integrity of device enrollment, recovery procedures and the other controls surrounding a transaction.

The next phase of digital banking security will not be defined by whether a customer receives a text message. It will be defined by how confidently a financial institution can establish that a transaction is being authorized legitimately—and how well it can detect and contain fraud when authentication alone is not enough.

‍