GCash Maya Security 2026: What Every OFW Must Know About the New OTP Rules and E-Wallet Scams

Key Takeaway: What Every OFW Must Know About GCash and Maya Security Changes in 2026 — GCash Maya Security Guide

• 📱 SMS OTPs are ending for high-risk transactions: Starting June 25, 2026, BSP Circular No. 1213 requires all major banks and e-wallets to replace SMS- and email-based one-time passwords with in-app push notifications, biometrics, or passwordless authentication for high-risk transactions. GCash began its phased transition on June 22, 2026, affecting 94 million users.
• 🎯 OFW families are prime scam targets: A TransUnion May 2026 survey found 70% of Philippine consumers were targeted by digital fraud between August and December 2025. The median loss was ₱50,000 ($850). Scammers specifically impersonate remittance confirmations, fake GCash/Maya support agents, and send fraudulent “reward” links.
• 🛡️ In-app authentication is safer but requires family preparation: GCash’s new push-notification OTPs eliminate SMS hijacking and SIM-swap attacks, but elderly family members in the Philippines may struggle with the transition. OFWs need to remotely guide relatives through enabling push notifications and recognizing legitimate app alerts.
• 🚨 Quishing and fake support scams are surging: GCash blocked over 4,900 fraudulent merchants using fake QR codes (“quishing”) in 2026 alone. Scammers also pose as GCash or Maya support representatives calling family members and demanding verification codes — something no legitimate platform ever does.
• 💡 What families must do this week: Enable push notifications on GCash and Maya apps immediately. Never click links in SMS or email — even if they appear to come from GCash or Maya. Use the GCash Kill Switch to instantly lock accounts if suspicious activity is detected. Report scams to CICC, NBI Cybercrime Division, and the platform directly.

The June 2026 Deadline That Changes Everything for OFW Families

On June 25, 2026, a regulatory change quietly took effect that will reshape how 94 million GCash users and millions of Maya account holders in the Philippines verify their transactions. Bangko Sentral ng Pilipinas Circular No. 1213, issued in May 2025, mandates that all BSP-supervised financial institutions averaging more than ₱75 million in monthly online transactions must abandon SMS- and email-based one-time passwords for high-risk transactions. In their place: in-app push notifications, biometric verification, behavioral authentication, and passwordless solutions.

For Overseas Filipino Workers, this is not a distant policy change. It is a direct, practical shift that affects how their families back home send, receive, and protect money. OFWs who send remittances through GCash or Maya need to understand the new system. Families who receive those remittances need to adapt to it. And everyone needs to recognize that scammers are already exploiting the transition — sending fake “security update” links, impersonating support agents, and preying on confusion about the new authentication rules.

This article explains what changed, why it changed, what scams are exploiting the transition, and — most importantly — what OFWs and their families must do to stay protected.

Why SMS OTPs Had to Die: The ₱50,000 Average Loss

The decision to phase out SMS-based one-time passwords was not regulatory overreach. It was a response to data showing that Philippine digital fraud has exceeded global rates for six consecutive years.

In May 2026, TransUnion Philippines released its annual fraud survey with alarming figures for the domestic market. The Philippines’ digital fraud rate stood at 4.1% versus a global average of 3.8%. More tellingly, 70% of Philippine consumers reported being targeted by digital fraud between August and December 2025 — compared to 53% globally. The median loss per victim was approximately ₱50,000 ($850), lower than the global median of ₱98,000 ($1,671), but the frequency made the aggregate damage severe.

Yogesh Daware, TransUnion Philippines Chief Commercial Officer, summarized the pattern: “Our data indicates that fraud in the Philippines is more driven by scale than severity. The breadth and frequency of these incidents make digital fraud a concern.” In other words, Philippine consumers do not face occasional massive scams. They face constant, smaller attacks — and SMS OTPs are the primary entry point.

The vulnerability is architectural. SMS messages travel through mobile networks, which can be intercepted, spoofed, or redirected through SIM-swap attacks. A scammer who convinces a telco to port a victim’s phone number to a new SIM instantly receives all OTPs and verification codes. Email-based OTPs are similarly vulnerable to phishing, credential stuffing, and account takeover. Moving authentication inside the GCash or Maya app — where the user must already be logged in and biometrically verified — closes this attack vector entirely.

What Changed on June 25, 2026: BSP Circular No. 1213 Explained

BSP Circular No. 1213 is not a suggestion. It is a compliance directive with a hard deadline. The circular applies to all BSP-supervised financial institutions that process more than ₱75 million in average monthly digital transactions. This includes all universal and commercial banks, all digital banks, and select cooperative, thrift, and rural banks. It also covers the major e-wallet operators: GCash, Maya, and other significant non-bank financial institutions.

Under the circular, covered institutions must replace SMS- and email-based OTPs with stronger authentication methods for high-risk transactions. The BSP defines “high-risk” based on multiple factors: the payee profile, transaction value, customer behavior patterns, transaction history, and the nature of the product or service. A ₱50,000 remittance sent to a new recipient for the first time would trigger high-risk authentication. A ₱500 payment to a previously saved merchant would not.

The acceptable replacements include biometric verification (fingerprint or facial recognition), behavioral authentication (analyzing typing patterns, swipe behavior, or device orientation), and passwordless solutions (FIDO2-compliant security keys or device-bound credentials). For most Philippine users, the practical implementation is simpler: in-app push notifications that require the user to confirm a transaction within the authenticated app itself.

BSP Deputy Governor Lyn Javier stated: “The BSP is equally dedicated to promoting innovation in financial services as to protecting customers from new forms of fraud, including technology-enabled fraud. We are pleased that banks and e-wallet operators are stepping up on both fronts.” The BSP also required covered institutions to upgrade fraud management systems to flag rapid transactions, new recipients, and unrecognized devices — giving platforms tools to block suspicious activity before authentication is even requested.

GCash’s Response: 94 Million Users Move to In-App OTPs

GCash — with 94 million registered users, reaching approximately 8 out of 10 Filipinos — began its phased transition on June 22, 2026, three days before the BSP deadline. The platform announced that all one-time passwords will now be delivered exclusively through push notifications inside the GCash app, eliminating SMS OTPs entirely.

Miguel Geronilla, GCash Chief Information Officer, explained the rationale: “Our upgrade to in-app OTPs is a strategic move to put an end to phishable SMS OTPs. We will shift users to instant, GCash app-verified authentication, to increase the security of their daily transactions.” The practical implication is that when a family member initiates a high-risk transaction, they will no longer receive a text message with a six-digit code. Instead, a push notification will appear on their phone screen, requiring them to open the GCash app and confirm the transaction using their registered biometric or PIN.

For OFW families, this change has both security benefits and usability challenges. The security benefit is clear: a scammer in another province cannot intercept a push notification the way they can intercept an SMS. The usability challenge is that elderly family members, household help, or relatives with older smartphones may not understand why their usual SMS codes stopped arriving. OFWs who manage family finances remotely need to proactively communicate this change and verify that their relatives’ phones support push notifications and have the latest GCash app update.

The Six Scams Targeting OFW E-Wallet Users Right Now

Scammers do not pause for regulatory transitions. They exploit them. The shift from SMS OTPs to in-app authentication has created a temporary window of confusion that fraudsters are actively weaponizing. Here are the six most common e-wallet scams affecting OFW families as of July 2026.

Scam 1: Fake “Security Update” Links

Scammers send SMS or email messages claiming that the recipient must “update their GCash/Maya security settings immediately” to comply with the June 25 BSP directive. The message includes a link that leads to a phishing site identical to the real GCash or Maya login page. Victims enter their mobile number, MPIN, and — in the most sophisticated versions — their one-time password, handing full account access to the scammer. CICC, Smart, Maya, and GCash have all issued public warnings: no legitimate platform sends links via SMS or email asking users to update security settings.

Scam 2: Fake Remittance Confirmation Notifications

Because OFWs send money regularly, scammers send fake “You have received a remittance of ₱XX,XXX from [OFW name]” messages. The message includes a link to “claim your funds” or “verify the transaction.” Clicking the link triggers credential theft or installs malware. The emotional manipulation is precise: family members expect remittances, and the fake confirmation arrives at a plausible time. Real GCash and Maya remittance notifications do not require clicking links. Funds appear directly in the wallet.

Scam 3: Fake GCash/Maya Support Calls

Scammers call victims posing as GCash or Maya customer support, claiming that suspicious activity was detected on the account and that the user’s credentials must be “verified” to prevent account suspension. They ask for the user’s mobile number, MPIN, and the OTP that was just sent — which, in the pre-June 25 system, was an SMS code. After June 25, scammers adapted: they now ask victims to read the push notification code or install a “remote support app” that grants screen access. No legitimate GCash or Maya support agent will ever call and ask for a PIN, password, or OTP. Period.

Scam 4: Quishing — Fake QR Codes

“Quishing” — QR code phishing — has become one of the fastest-growing e-wallet fraud vectors in the Philippines. Scammers print fake GCash or Maya QR codes on stickers, flyers, or counterfeit merchant displays. When a customer scans the code to pay, the money goes to the scammer’s account instead of the merchant’s. GCash blocked over 4,900 fraudulent merchants associated with quishing schemes in 2026 alone. For OFW families, the risk is highest at small neighborhood stores, sari-sari shops, and informal vendors where QR codes are printed on paper and easily replaced.

Scam 5: Fake “Reward” and “Cashback” Links

In July 2026, Maya users reported receiving text messages promising a ₱3,000 “gift reward” for clicking a link (maya.ph/reward). The message appeared to come from Maya’s official sender ID. Maya publicly confirmed this was a phishing campaign and reminded users that legitimate rewards are credited automatically — never via external links. GCash users have reported similar fake “cashback” and “promo” links. The pattern is consistent: if a reward requires clicking a link, it is a scam.

Scam 6: SIM-Swap and Number Porting Fraud

Although the June 25 transition to in-app OTPs reduces SIM-swap vulnerability, scammers continue to exploit the transition period. Attackers convince telecom customer service representatives to port a victim’s mobile number to a new SIM controlled by the fraudster. During the window between the port request and the victim noticing their phone has lost service, the scammer intercepts any remaining SMS-based OTPs, resets passwords, and drains the e-wallet. The best defense is enabling GCash and Maya’s in-app authentication before the scammer can exploit any residual SMS-based verification.

The GCash Kill Switch: What It Is and How to Use It

In 2026, GCash launched a “Kill Switch” feature that allows users to instantly lock their account if they detect suspicious activity. The feature is aligned with the Anti-Financial Account Scamming Act and represents a significant upgrade in consumer protection. If a family member receives a suspicious call, sees an unauthorized transaction notification, or suspects their phone has been compromised, they can trigger the Kill Switch through the GCash app or by contacting GCash support directly.

Once activated, the Kill Switch prevents all transactions — incoming and outgoing — until the user completes a full identity verification and security review. This stops scammers from draining accounts even if they have obtained partial credentials. For OFWs abroad, the practical implication is that family members must know how to use the Kill Switch before a crisis occurs. Walking through the steps during a calm video call is infinitely more effective than trying to explain it during a panic attack after ₱50,000 disappears.

To use the Kill Switch: open the GCash app, navigate to Profile > Settings > Security > Kill Switch. Tap “Lock Account” and confirm. The account will be frozen immediately. To unlock, contact GCash support through the in-app Help Center or call the official hotline. Never use phone numbers provided by unsolicited callers claiming to be GCash support.

Step-by-Step: How OFWs Can Secure Family E-Wallets From Abroad

OFWs cannot physically sit with family members to configure security settings. But they can prepare step-by-step guides, verify settings during video calls, and establish security protocols that work across time zones. Here is a practical checklist for remote financial security management.

1. Verify the GCash and Maya apps are updated to the latest version. During a video call, ask the family member to open the app store, search for GCash or Maya, and confirm “Update” is not visible. If an update is available, install it immediately. The June 2026 security features require the latest app version.
2. Enable push notifications. On Android: Settings > Apps > GCash/Maya > Notifications > Allow. On iPhone: Settings > Notifications > GCash/Maya > Allow. Test by sending a small amount (₱1) to the account. The recipient should see a push notification, not an SMS.
3. Enable biometric authentication. In GCash: Profile > Settings > Biometric Login. In Maya: Settings > Security > Biometric Lock. If the phone does not support biometrics, ensure a strong MPIN (not birthdays, not sequential numbers) is set.
4. Set up the Kill Switch and walk through activation. Do this together on video call. Make sure the family member can find the Security settings menu without assistance.
5. Establish a family verification code. Agree on a private phrase or number that only family members know. If someone calls claiming to be from GCash or Maya, the family member should ask for the verification code. A real agent will not have it. A scammer will hang up.
6. Never share MPINs, OTPs, or account details over any channel. Reinforce this rule weekly. Scammers are persistent and will call multiple times. Family members must understand that “even if they sound official” is not a valid reason to share credentials.
7. Report suspicious activity immediately. Save these contacts in the family phone: GCash Help Center (in-app), Maya Support (in-app), CICC hotline, NBI Cybercrime Division (02) 8523-8231 local 3455, PNP Anti-Cybercrime Group 0998-598-8116.

The Bigger Picture: Why the Philippines Exceeds Global Fraud Rates

The TransUnion data points to a structural problem that goes beyond individual vigilance. Philippine digital fraud is “more driven by scale than severity” because the country’s digital financial ecosystem grew rapidly without matching investments in consumer protection infrastructure. GCash reached 94 million users — nearly the entire adult population — before comprehensive fraud prevention systems were in place. The BSP’s Circular No. 1213 is a corrective measure, but it arrives after years of vulnerability.

The Philippines also faces a unique demographic challenge: high digital adoption combined with low digital literacy. A 2025 Philippine Institute for Development Studies survey found that while most establishments have internet access, only 3% have adopted AI tools — suggesting that while Filipinos are online, they are not necessarily equipped to evaluate sophisticated fraud attempts. Elderly family members, household staff, and rural residents who use GCash for the first time to receive OFW remittances are prime targets because they lack the contextual knowledge to distinguish legitimate notifications from phishing attempts.

GCash has responded by partnering with the Cybercrime Investigation and Coordinating Center (CICC) and the Philippine Payments Management Inc. (PPMI) to detect and address fraud patterns in real time. The platform has also strengthened in-app security features and added live agent support for complex issues. But platform-level improvements cannot substitute for user awareness. The most effective anti-fraud measure remains an informed family member who knows what to click, what to ignore, and who to call when something feels wrong.

Related Resources and Official Links

• Smishing Text Scam Philippines: OFW Protection Guide Against 423% Surge in SMS Phishing — complementary guide on SMS-based fraud.
• Online Scams Philippines 2026: Top 7 Scams Filipinos Must Avoid — OFW Warning Guide — broader scam awareness coverage.
• Bangko Sentral ng Pilipinas: Directory of BSP-Supervised Financial Institutions
• GCash Help Center: How to Report a Scam
• Maya: Not Sure That Message Is Really from Your Bank? Here’s What to Do

FAQ: GCash and Maya Security for OFW Families

What exactly changed on June 25, 2026?

BSP Circular No. 1213 required all major banks and e-wallets to replace SMS- and email-based one-time passwords with stronger authentication methods — push notifications, biometrics, or passwordless solutions — for high-risk transactions. GCash began its transition on June 22, 2026. Lower-risk transactions may still use SMS OTPs, but high-value transfers, new recipient payments, and account changes now require in-app verification.

My family member did not receive the push notification. What should they do?

First, verify the phone’s notification settings: Settings > Notifications > GCash/Maya > Allow. Second, check if the phone’s Do Not Disturb mode is active. Third, ensure the app is updated to the latest version from the app store. Fourth, restart the phone. If the issue persists, contact GCash or Maya support through the in-app Help Center — never through phone numbers from unsolicited messages.

Can scammers still steal money if they do not have the OTP?

Yes. Scammers use multiple vectors. Quishing (fake QR codes) does not require OTPs — victims simply scan the wrong code and send money to the scammer’s account. Fake support calls sometimes request remote access to the phone, bypassing OTPs entirely. And malware installed through phishing links can capture screens, record keystrokes, or intercept push notifications. The in-app OTP transition closes the SMS vulnerability but does not eliminate all fraud risks.

What is the GCash Kill Switch and when should we use it?

The Kill Switch is an emergency account lock feature. Activate it immediately if: (1) an unauthorized transaction appears, (2) a suspicious caller asks for credentials, (3) the phone is lost or stolen, or (4) any family member suspects account compromise. Once activated, all transactions are frozen until GCash verifies identity and clears the security review.

How do I verify that a GCash or Maya message is legitimate?

Legitimate platforms never send links via SMS or email. Real notifications appear in the app itself. If you receive an SMS claiming to be from GCash or Maya with a link, it is a scam. The only legitimate channel for account updates is the in-app notification or the official website accessed directly through a browser — never through a link in a message.

Can OFWs abroad report scams affecting family members in the Philippines?

Yes. OFWs can report scams through the CICC online portal (cicc.gov.ph), the NBI Cybercrime Division (via email at ccd@nbi.gov.ph), and the PNP Anti-Cybercrime Group (acg@pnp.gov.ph). GCash and Maya also accept reports through their in-app Help Centers. Include screenshots, transaction details, phone numbers used by scammers, and a timeline of events. The more documentation provided, the more likely authorities can trace the fraud network.

Should I stop using GCash and Maya because of these scams?

No. E-wallets remain essential for OFW remittances, bill payments, and digital transactions in the Philippines. The scams are not a failure of the platforms but a consequence of rapid digital adoption outpacing user education. The June 2025 security upgrades, the Kill Switch, and the BSP’s stronger authentication requirements actually make GCash and Maya safer than they were six months ago. The solution is not abandonment but awareness.

What is “quishing” and how do I avoid it?

Quishing is QR code phishing. Scammers replace legitimate merchant QR codes with fake ones that route payments to the scammer’s account. Before scanning any QR code for payment, verify the merchant name displayed in the GCash or Maya app matches the actual store. At sari-sari stores and informal vendors, ask the owner to confirm the QR code is current and has not been tampered with. If the payment goes to an unrecognized account name, cancel immediately.

Are elderly family members more vulnerable to these scams?

Yes. Elderly users are disproportionately targeted because they may not recognize sophisticated phishing attempts, may trust unsolicited callers who sound official, and may struggle with app updates and notification settings. OFWs should treat elderly family members’ digital security as a shared responsibility: schedule regular video calls to check app versions, walk through security features, and review account balances together.

What should I do if money is already stolen from the family e-wallet?

Act within the first 24 hours for the highest recovery chance. Step 1: Activate the Kill Switch immediately to prevent further losses. Step 2: Report to GCash or Maya through the in-app Help Center with screenshots and transaction details. Step 3: File a police report with the NBI Cybercrime Division or PNP Anti-Cybercrime Group. Step 4: Report to the CICC online portal. Step 5: Document everything — phone numbers, messages, call times, transaction IDs. Step 6: If the scam involved a bank transfer, contact the receiving bank’s fraud department immediately. Recovery is not guaranteed, but prompt reporting increases the likelihood of freezing the scammer’s account before funds are withdrawn.

Financial Disclaimer: This article is for informational and educational purposes only. It is not financial advice, legal counsel, or a guarantee of account security. The fraud prevention measures described reflect best practices as of July 2026 but cannot guarantee complete protection against evolving scam tactics. OFWs and families should verify current platform security features directly with GCash, Maya, and the Bangko Sentral ng Pilipinas. Report scams to appropriate authorities promptly. All third-party trademarks are property of their respective owners.