GCash is dropping SMS-based one-time passwords on June 22, switching to in-app verification codes delivered through push notifications, as the BSP’s deadline for phasing out text-based authentication draws near.
The Bangko Sentral ng Pilipinas (BSP) ordered banks and financial institutions to stop using SMS-based OTPs by June 30 under the Anti-Financial Account Scamming Act (AFASA), which aims to strengthen protection against phishing scams and other forms of online fraud. GCash is getting ahead of that cutoff by two weeks.
For GCash’s roughly 94 million registered users in the Philippines, the change means no more waiting for a text message to arrive before completing a transfer or login. OTP requests will go directly to the user’s verified GCash app, and a single tap approves the transaction – no switching apps, no typing codes, no waiting for SMS delivery.
SMS OTPs have long been vulnerable to phishing and SIM-swap attacks, making them a weak link in digital security. Scammers have exploited that weakness for years, tricking users into handing over codes through fake text messages or cloned sites. The in-app method sidesteps that entirely; verification codes will be delivered through secure push notifications directly within the authenticated GCash application rather than through text messages.
GCash chief information security officer Miguel Geronilla laid out the thinking plainly. “Our upgrade to In-App OTPs is a strategic move to put an end to phishable SMS OTPs,” Geronilla said.
GCash says the upgrade is part of its broader multi-factor authentication framework, which already includes Know Your Customer (KYC) verification and facial recognition through its DoubleSafe feature. The in-app OTP layer builds on top of those existing measures rather than replacing them.
GCash advised users to make sure push notifications are enabled on their phones to avoid any disruption to transactions and account activity once the switchover goes live. Users who have notifications turned off will want to check their settings before June 22.
GCash’s in-app OTP rollout takes effect on June 22, 2026, ahead of the BSP’s industry-wide SMS OTP deadline of June 30.
