If you have ever received a suspicious text message pretending to be GCash asking for your OTP, you already understand why this change is happening.
GCash is rolling out In-App One-Time Passwords by June 22, replacing SMS-based authentication across the platform. The shift complies with a Bangko Sentral ng Pilipinas directive under the Anti-Financial Account Scamming Act, which requires digital finance platforms to phase out SMS-based OTPs by June 2026. But beyond regulatory compliance, the move addresses a security gap that scammers have been exploiting for years.
The problem with SMS OTPs is straightforward. A text message can be intercepted, spoofed, or delivered to the wrong person through SIM swapping attacks. Scammers have built entire playbooks around tricking users into handing over codes they received via text. In-App OTPs close that door by sending verification requests directly through secure push notifications inside the authenticated GCash app, which means only the person holding the actual device and logged into their verified account can receive and act on the code.
There is also a usability improvement baked in. One-tap authentication inside the app removes the need to switch between apps, manually type out a code, or wait for a text that sometimes takes longer than expected to arrive. Faster and more secure is a combination that does not come along often enough.
GCash Chief Information Security Officer Miguel Geronilla described the upgrade plainly: “We will shift users to instant, GCash app-verified authentication, to increase the security of their daily transactions.”
The In-App OTP rollout builds on existing security layers GCash already has in place, including Know-Your-Customer verification and Facial Recognition through its Double Safe feature. It also forms part of the company’s broader push toward Multi-Factor Authentication, an industry standard that layers multiple checkpoints to protect accounts even when passwords or MPINs are compromised.
Both Android and iOS users will need to switch over before the June 22 deadline. For the step-by-step guide, visit gcash.com.
