GCash rolls out in-app OTPs to curb fraud

ELECTRONIC wallet platform GCash has launched in-app one-time passwords (OTPs) to strengthen account security against phishing, scams, and fraud.

“Our upgrade to In-App OTPs is a strategic move to put an end to phishable SMS OTPs. We will shift users to instant, GCash app-verified authentication, to increase the security of their daily transactions,” GCash Chief Information Security Officer Miguel Geronilla said in a media release on Monday.

By the first quarter, users will receive OTPs directly through secure push notifications within the GCash application, instead of via text messages, the company said.

GCash said SMS-based OTPs have been a frequent target of scammers seeking unauthorized access to user accounts, adding that in-app OTPs are designed to address these vulnerabilities.

“By sending OTP requests directly to the user’s authenticated GCash app, GCash ensures that only the intended users can receive and use the unique OTPs, protecting them from unauthorized access,” the company said.

GCash also said the new system allows one-tap authentication, eliminating the need for users to switch applications or wait for OTPs delivered through text messages.

“In-App OTPs reflect commitment of GCash to providing secure, seamless financial services for its millions of users and set a new benchmark for digital finance security in the Philippines,” it said.

In December, Globe Telecom, Inc. and GCash announced the completion of initial tests for the implementation of a silent authentication system.

A silent authentication system verifies users through a secured network, replacing the need for one-time passwords.

Globe Fintech Innovations, Inc. (Mynt), the operator of GCash, is a partnership among Globe, Ayala Corp., and Ant International, a digital payments, digitization, and financial technology provider.

Last year, Globe and Bank of the Philippine Islands also announced that they are developing a proof of concept for silent network authentication to combat fraud.

The technology verifies a user’s identity by checking whether the mobile number provided matches the SIM card active in the current data session, Globe said, describing it as a powerful layer of defense against phishing and other SIM-based fraud.

At the local bourse on Monday, shares in Globe closed unchanged at P1,620 each. — Ashley Erika O. Jose