BSP follows through to go beyond OTPs

After signaling that financial institutions must move beyond one-time passwords (OTPs), the Bangko Sentral ng Pilipinas (BSP) has rolled out calibrated guidelines to promote more secure multi-factor authentication (MFA) methods to protect consumers from digital fraud.

- By KEISHA TA-ASAN

BSP deputy director Maricris Salud said evolving cyberthreats have exposed the vulnerabilities of SMS-based OTPs, prompting the central bank to recommend that financial institutions adopt more advanced MFA solutions.

This follows the BSP's earlier push to shift liability to banks that fail to implement adequate security under the Anti-Financial Account Scamming Act (AFASA), a move first reported by The STAR in May.

"Banks and financial institutions can still do OTPs, but they have to look for other authentication methods to supplement the vulnerabilities of OTPs," Salud said in a press briefing.

Under Circular 1213, the BSP outlined a two-tiered set of fraud management system (FMS) requirements for supervised financial institutions offering electronic payment and financial services.