GCash Fully Rolls Out In-App OTPs to Combat Phishing and Fraud

GCash, the leading finance super app in the Philippines, has fully rolled out its In-App One-Time Passwords (OTPs) system, replacing traditional SMS-based authentication by June 22, 2026, as reported by TechPinas . The upgrade aligns with the Bangko Sentral ng Pilipinas (BSP) directive under the Anti-Financial Account Scamming Act (AFASA), which mandates the phaseout of SMS OTPs across financial institutions.

With the new system, OTPs are delivered via secure push notifications directly through the authenticated GCash app, eliminating the need for users to switch apps or manually enter codes. This approach reduces the risk of OTP interception from phishing, SIM swap fraud, and social engineering attacks, ensuring that only legitimate account holders can verify transactions.

The shift addresses growing cybersecurity threats targeting digital wallet users in the Philippines. SMS-based OTPs, long a standard security layer, have become increasingly vulnerable to exploitation by cybercriminals. GCash’s in-app OTPs aim to provide stronger protection for the country’s largest cashless ecosystem.