Tech Firm Warns of Rising Fraud, Urges Shift From OTPs to Biometrics

By Francis Allan L. Angelo

The Philippines is facing an inflection point in digital security, as the rapid evolution of cyber threats, particularly in financial services, renders outdated defenses like One-Time Passwords (OTPs) increasingly vulnerable to attack.

This was the core message of Michelle Anne Chan, country manager of ADVANCE.AI, in an exclusive interview with the Daily Guardian, where she outlined how banks and fintech institutions must modernize authentication and fraud prevention practices—or risk further losses amid a surge in cybercrime.

“The security landscape has changed—fraudsters are now a lot more sophisticated,” Chan said, citing a spike in attacks that exploit OTPs via SIM-swapping, phishing, malware, and even the use of fake mobile cell towers.

A new wave of fraud schemes is exploiting weaknesses in OTP-based systems by impersonating telecom providers, hijacking communications, or using advanced spyware to intercept sensitive data. According to Chan, these tactics are particularly concerning in a country where 76 million people use e-wallets and over 85 million are online—making personal data widely available and vulnerable.

Filipinos are increasingly targets of scams like fake job offers, romance frauds, and government impersonation—all of which lure victims into surrendering OTPs. “Once you do that, they are able to take over your accounts,” she said.

OTPs vs Biometrics and AI

While the Cybercrime Investigation and Coordinating Center (CICC) reported nearly PHP 198 million in cybercrime-related losses in 2024, Chan believes the actual figure is far higher.

“Many scams go unreported, and most fraudsters use a combination of tactics,” she said, adding that the exact share of OTP-related fraud is difficult to isolate but remains significant.

As the Bangko Sentral ng Pilipinas (BSP) urges the industry to move beyond OTPs, Chan argues that biometric authentication and AI-driven risk scoring offer a stronger alternative.

“Biometric authentication validates not just what you know, but who you are,” Chan said, referring to facial recognition with real-time liveness detection that requires users to verify their identity through physical actions like head movements or blinking.

These techniques prevent fraudsters from exploiting stolen information. In the case of a SIM swap, for example, the attacker might have access to the victim’s OTPs—but would still be blocked without a live biometric match.

Combined with AI-powered risk scoring, these systems provide a dynamic, layered defense. “We detect device integrity risks, behavioral anomalies, synthetic identities, and even deepfakes,” Chan said.

AI-based risk engines analyze numerous real-time signals such as geolocation, device health, typing patterns, and biometric data. If anomalies are found—such as someone logging in from abroad using mismatched ID and selfie photos—the system flags the transaction, suspends it, or routes it for human review.

“Each red flag adds to a dynamic risk score. If the score is high, the transaction is blocked or sent for further review—all within seconds,” Chan explained.

A Better User Experience

For the average Filipino, the shift toward biometrics and AI-backed verification means faster, safer, and more convenient access to financial services.

“Opening a bank account or applying for a loan will take just a few minutes with secure facial recognition or biometric scans—no more manual reviews or long queues,” Chan said.

As the need for OTPs diminishes, consumers can expect smarter, less intrusive authentication methods. “Systems will verify users using behavioral patterns and device intelligence—making logins faster but still secure,” she added.

Behind the scenes, financial institutions will run silent but powerful fraud detection processes that flag suspicious activity even without user action.

Importantly, the enhanced systems can also help expand access to credit. For many self-employed or underbanked Filipinos, AI models using alternative data—such as payment behavior or phone usage—can offer fairer credit scoring, Chan noted.

Facing the Deepfake Threat

Chan issued a stark warning about deepfakes and synthetic identities, which are already being deployed in phishing attacks and digital fraud schemes.

“With generative AI technology, it’s very easy and cheap to create a convincing deepfake video or selfie,” she said.

ADVANCE.AI is advocating for a “security-by-design” approach in digital systems, embedding fraud checks at every stage of the account lifecycle—not just during sign-up.

A multi-layered defense is essential, combining facial biometrics, liveness detection, document authentication, behavioral tracking, and device intelligence.

“Adaptive authentication and continuous product enhancement are key,” she stressed.

Global Standards vs. Local Practice

Internationally, countries like Singapore and India have moved quickly toward modern identity verification using facial biometrics, behavioral analytics, and real-time AI monitoring.

These markets lead in using “continuous authentication” that doesn’t just verify identity at the start but throughout the transaction.

In contrast, many banks in the Philippines still rely on outdated methods like manual ID checks, SMS-based OTPs, or in-branch verification.

According to Chan, the Philippines’ 3,000-plus rural and cooperative banks lag far behind in adopting electronic Know Your Customer (eKYC) and biometric tools, with most requiring physical visits.

Even among the country’s 40+ universal and commercial banks, advanced tools are largely limited to the onboarding stage, leaving vulnerabilities during account use and transactions.

Still, Chan praised the BSP for its proactive stance, citing initiatives like Circular No. 1140, which encourages AI-based digital verification and stronger consumer protection frameworks.

Lessons from Abroad

One of the key lessons from other countries, Chan said, is that innovation should not wait for regulation.

“In Singapore and India, financial institutions didn’t wait for mandates—they invested early in AI-powered fraud prevention,” she noted.

Chan called for a mindset shift among Filipino bank leaders: “Customer protection is no longer the job of just IT or compliance—it should be a leadership priority.”

Those who view digital onboarding and fraud prevention as strategic will lead the next wave of financial innovation and inclusion, she added.

Building Trust, Driving Inclusion

Better Know Your Customer (KYC) and Know Your Business (KYB) processes also help foster trust in digital finance, Chan emphasized.

“When banks and fintechs implement facial biometrics and document authentication, they show consumers that security is a priority,” she said.

This is particularly important as incidents of fake merchants and scam apps proliferate. A robust verification system helps protect customer data and ensure that businesses are who they claim to be.

Strong KYB processes also accelerate onboarding for SMEs, which in turn promotes financial inclusion and access to working capital.

Chan noted that biometrics can also lower barriers to financial access—particularly for rural residents and unbanked users who lack formal IDs or live far from physical branches.

“We’ve developed facial recognition solutions that work even in low-bandwidth settings and on entry-level smartphones,” she said.

Security tools like liveness detection and device intelligence help balance protection with accessibility, enabling safe digital participation across socioeconomic classes.

ADVANCE.AI also supports financial literacy initiatives, teaching consumers how to protect their data, spot scams, and engage safely with online services.

“Inclusion isn’t just about access; it’s about empowerment,” Chan said.

What Comes Next

Chan warned that the next generation of digital fraud will be “AI-powered and hyper-personalized,” using techniques like voice cloning, video impersonation, and identity theft-as-a-service.

“Fraud is shifting from account theft to synthetic identity markets where ready-made personas are sold to bypass security systems,” she explained.

As fraud techniques grow more sophisticated, financial institutions must move beyond static defenses.

Traditional authentication methods—passwords, OTPs, basic document checks—are no longer enough.

“The threat is very real and urgent,” Chan said.

The solution, she concluded, is a dynamic, AI-powered identity infrastructure that evolves alongside the threat landscape—keeping Filipino consumers protected while enabling them to fully participate in the digital economy.