Banks drop OTPs as fraud drives SNA adoption

66% of critical attacks now target the finance sector.

As cyberattacks surge across the financial sector, Philippine banks are shifting away from traditional one-time passwords (OTPs) toward silent network authentication (SNA) to reduce fraud, improve customer trust, and streamline digital transactions.

“While SMS OTPs and email authentication links have become largely favored due to consumer familiarity, they’ve become increasingly insecure,” said Marlon Cruz, Senior Director, Consulting & Architecture at Globe Business. “They became a source of huge volumes of fraud and financial loss.”

Cruz pointed to vulnerabilities like lack of encryption, SIM swap scams, phishing, and smishing as the primary weaknesses of conventional OTPs. “The security problem is anything that can be copied, pasted and shared is fundamentally insecure,” he said.

SNA, which works in the background using the mobile network to verify users silently, is gaining traction for its security and simplicity. “For consumers, it enhances security, significantly lowering the risk of fraud and phishing attacks,” said Cruz. “It simplifies the user experience by eliminating the need to input OTPs, leading to quicker and more convenient transactions.”

For businesses, Cruz noted, SNA is not only about security but also efficiency. “It streamlines operations by simplifying the authentication process, potentially reducing customer support costs,” he explained. “It allows businesses to focus on service improvement and increases confidence in transactions.”

However, SNA implementation comes with technical hurdles—particularly in integrating with major telcos. To address these, Globe advocates a layered approach. “SNA is designed to be seamless and fast, often working in the background. If it cannot verify user identity, OTPs act as a second layer of security,” he explained.

On the privacy front, Cruz emphasised that “no personal identifiable information is accessed.” Only necessary data—like phone numbers and network status—is processed and encrypted. “Strict rules like the Data Privacy Act in the Philippines are being followed,” he said. “Telcos must anonymise and pseudonymise data when possible and restrict access to authorised personnel.”