BANKO Sentral ng Pilipinas (BSP) has set a deadline for digital banking applications to move away from One-Time Pins (OTPs) via SMS starting Tuesday, June 30, 2026.
This move was in accordance with Section 6 of the “Anti-Financial Account Scamming Act (AFASA),” which aims to protect access to the clients’ financial account.
The BSP has identified SMS OTPs as security vulnerability due to the risk of interception and unauthorized sharing by third parties outside the transaction process.
The risk of SMS OTPs
Telecommunication companies, including those operating in the Philippines, depend on Signaling System No. 7 (SS7) protocols to manage the exchange of call and text information across networks. Often described as the postal system of telecommunications, SS7 enables carriers to determine a recipient’s location, identify the appropriate network for delivering calls or messages, check device availability, and efficiently route communications between different service providers.
The system was developed in the 1970s, a period when only a limited number of trusted telephone companies operated and interconnected their networks.
However, in today’s telecommunications landscape, the number of networks and service providers has significantly expanded. This growth has weakened the original trust-based model, making the system more vulnerable to potential exploitation and misuse by unauthorized or malicious actors.
In a YouTube video, Veritasium demonstrates how hackers can exploit SS7 vulnerabilities to intercept text messages by tricking the network into thinking a target’s phone is roaming, allowing them to reroute messages, including OTPs, to a number they control.
“It [SMS OTPs] is the only available option and sometimes that can even be for accounts that should be treated with the utmost of care like a bank account,” Linus Sebastian (LinusTechTips) said, raising concerns about the vulnerability of SMS-based OTPs.
The alternative
BSP Circular 1213 calls for the adoption of stronger multi-factor authentication measures to enhance the security of financial transactions.
These measures include biometric authentication such as fingerprint scanning and facial recognition, behavioral biometrics, passwordless methods like security keys, and adaptive authentication systems designed to detect unusual or suspicious activity. (Stephen Joseph T. Enrile)