Passkeys in Southeast Asia’s Banks and Wallets: Which Services Let You Drop SMS OTP

Key Takeaway

• 🔐 A passkey replaces the shared-secret problem: login becomes a cryptographically signed challenge between your registered device and the bank, so there is no one-time password for a scammer to intercept, and phishing pages have nothing to phish.
• 🇸🇬 Singapore leads the region on regulation and government login: the Monetary Authority of Singapore and the Association of Banks announced on July 9, 2024 that major retail banks would phase out OTPs for digital-token holders, with DBS, OCBC and UOB confirming the retirement, and GovTech launched Singpass passkeys on July 1, 2026 for iPhones, then expanded to Android.
• ⚙️ The standards layer has settled: the NIST Digital Identity Guidelines (800-63B Revision 4) integrate FIDO passkeys explicitly, Microsoft Entra made passkeys the default authentication from September 1, 2026, and Mastercard ships payment passkeys that remove the OTP at card checkout.
• 📱 Tonight-action: open your banking app, enable its digital token or passkey login, then switch off the SMS-bound fallback the app offers, and keep the recovery kit safe, because recovery phishing becomes the attackers’ new door.
• ⚠️ One plain caveat: passkeys kill OTP interception, not social engineering. A person convinced into adding a fraudster’s device still hands access over; the human checkpoint section below covers the two sentences that close it.

Southeast Asia’s most-stolen credential is a number that arrives by SMS, lives for seconds, and dies in a forwarded message to a scammer. The passkey removes that number from existence: instead of a code sent over the telephone network, your device proves it is you with a cryptographic signature the bank can verify but no phished website can replay. The region’s regulators have turned that technical argument into policy, led by Singapore, and this guide explains what passkeys are, which banks and government services rolled them out, what the standards bodies now require, and how to actually drop the SMS OTP from your accounts while keeping recovery safe.

What a Passkey Actually Is, in Two Minutes

A passkey is a login credential built on FIDO standards and stored on your device or in its cloud keychain. Two kinds matter in banking:

• Device-bound passkeys live on one specific device and never sync. Lose the phone, lose the credential, recover through the bank’s process. Strongest isolation, least convenience.
• Synced passkeys ride your platform’s keychain (iCloud Keychain, Google Password Manager) and follow you to a new device. Most consumer banking apps use this style because recovery is built in.

Either way, the login flow is the same shape: the bank’s server sends a challenge, your device signs it using a private key that never leaves it, and the server checks the signature against the public key it stored when you enrolled. A phishing site that tricks you into visiting it gets a challenge it cannot answer, because it is not the bank’s domain; the browser only hands the credential to the registered domain. That property is why the industry converged here: no shared secret, no interception, no lookup page for scammers to farm.

The standards layer makes this stick. The NIST Digital Identity Guidelines, 800-63B Revision 4, integrate FIDO passkeys explicitly for the assurance levels financial services map their logins against, distinguishing the stronger device-bound variant from synced ones. Microsoft made passkeys the default authentication experience in Entra from September 1, 2026, per the official retirement notice, evidence that the enterprise layer is converting on the same schedule as the retail layer.

Singapore: the Regulatory Lead the Region Reads

Singapore moved first and moved formally. On July 9, 2024, the Monetary Authority of Singapore and the Association of Banks in Singapore announced that major retail banks would strengthen resilience against phishing scams by removing reliance on one-time passwords for customers using digital tokens, and the three big banks, DBS, OCBC and UOB, confirmed plans to retire OTPs for token-holding customers, per the ZDNET report. The rollout runs in phases through 2025 and 2026, tied to each bank’s digital-token estate: when the token is your second factor, the SMS code becomes redundant.

The government followed the same path for identity itself. GovTech launched Singpass passkeys on July 1, 2026, starting with iPhones and expanding to Android, turning the national digital-identity app into a device-as-key login, per GovTech’s announcement, with desktop support targeted by end-2026. When the state’s own login retires the SMS OTP as its headline feature, the direction for every bank’s product team stops being a question.

The payment rails add the third leg. Mastercard ships payment passkeys that replace the card-checkout OTP with a biometric on your registered device, part of the payment networks’ regional OTP-free rollout, and the effect reaches Southeast Asian wallets the same banks serve.

Worth costing before the wallet section: the switch is free where the passkey infrastructure exists, and the expensive part is the change of habit it asks of the household. Enrollment takes three minutes per app; the recovery-kit step takes ten and only happens once; the family walkthrough takes an evening and pays for itself the first time a relative gets the “your account will be closed” call with no OTP left to hand over. Against that stands the cost of the status quo, which is invisible until it is not: one intercepted code, one emptied wallet, and a remittance month rewritten around a police report. Priced that way, the passkey switch is the rare security purchase whose fee is paid in minutes rather than money, and the banks that remove the fallback first are effectively subsidizing their customers’ safety for free.

Wallets and the Philippines: What the E-Wallet Layer Has Today

The Philippines’ wallet layer processes the region’s remittances, and its apps have spent years hardening exactly the OTP problem: GCash moved verification in-app, Maya operates as a BSP-licensed digital bank with its own security stack, and both prompt device-binding on logins. The plain status for this guide: full FIDO passkey support on the major wallets is the next lane, not the current one, and no wallet in the region has put out the press release yet. A market the size of Philippine remittances is the obvious destination for passkey vendors after the bank tier. The practical move for wallet users today is the same discipline the SIM-swap guides teach: bind the device the app offers, kill SMS recovery where the settings allow it, and treat the app’s own prompts as the second factor, following the steps in our GCash OTP security explainer.

How to Drop the SMS OTP Without Locking Yourself Out

The switch is five steps, and the order matters:

• Step 1: enroll the digital token or passkey first. Every bank app has the enrollment screen (DBS/OCBC/UOB call it the digital token; other banks call it device binding). Enroll on your primary phone, complete a test login, and confirm the app no longer asks for SMS on the flows you use.
• Step 2: remove the SMS fallback, deliberately. After the token works, go to security settings and switch off SMS as a fallback factor. Leaving it on is how the phone-number swap reaches you anyway.
• Step 3: secure the recovery kit. Synced passkeys ride your Apple or Google account, so the account’s own recovery (email, secondary device, recovery codes) becomes the real second factor; one strong password, one set of codes stored offline.
• Step 4: register a second device or physical key where offered. Banks that support hardware keys or a paired device let you keep a spare; the smart-device security label guide covers the hardware angle for shoppers buying the key.
• Step 5: tell the family what changed. The scripts in our SIM-swap defense guide lose their hook when no OTP exists, but relatives on SMS-only logins need the five steps applied to their phones too, especially remittance senders.

The regional reality check: banks outside Singapore are at different stages, and this guide’s country table will need the same refresh discipline as the regulation trackers. The trigger events are each market’s central bank advisory plus each bank’s app-release notes. Demand-side signals keep pointing the same way: the GSMA’s consumer research across Southeast Asian markets flagged SIM-swap fraud as a significant worry in several of them, which is the demand that regulators are answering.

One regional note before the FAQ: the wallets and banks of Malaysia, Indonesia, Thailand, and Vietnam sit at different points on the same curve, and their central banks have each run anti-fraud programs on the SMS layer. None has issued a Singapore-style OTP-retirement mandate yet, so the practical read for a customer in those markets: adopt every passkey feature your bank has shipped so far, keep the SIM-swap defenses active, and treat the Singapore rollout as the template your bank will sell to its board. The worry documented in the regional consumer research is the demand curve the passkey vendors are riding into the region.

What Passkeys Do Not Fix: the Human Checkpoint

Two residual attacks survive the passkey era, and both are worth naming because they define the new scam surface:

• Recovery phishing. If a scammer can convince you to hand over your platform-account recovery (codes, email access, a one-time approval), your synced passkeys walk with it. The defense: recovery codes printed and stored offline, and the same reflex as before, nothing approval-shaped gets read to a caller.
• Enrollment fraud. A scammer on a video call instructing you to “add a device” or “scan this to verify” is enrolling their device, not yours. The digital-arrest defense guide gives the full anatomy; the two-line version: stop the call, dial the bank yourself.

The plain summary: passkeys close the interception lane, the one that has driven the region’s most mechanical fraud, and open a smaller lane that only social engineering can reach. That trade is why regulators moved.

A note on what happens behind the scenes at a bank that removes the text code: the risk engine does not disappear, it moves. Fraud teams keep the device-binding records, the new-device alerts, and the behavioral checks, and they route customers who lose a device through verified channels instead of codes. For the customer that means the security conversation shifts from “did you receive the code” to “is this device yours”, a question scammers find much harder to answer convincingly. The banks that have published timelines also publish enrollment guides, and reading your own bank’s guide before enabling anything remains the shortest path to a working passkey.

FAQ

What is a passkey, in one sentence?

A FIDO login credential stored on your device (or its keychain) that signs a bank-issued challenge with a private key that never leaves the device, replacing the SMS one-time password with a phish-proof cryptographic check.

Which Southeast Asian banks have removed SMS OTPs?

Singapore’s three major retail banks, DBS, OCBC and UOB, announced the retirement of OTPs for digital-token customers following the MAS and ABS announcement of July 9, 2024, with phase-outs rolling through 2025-2026, and payment passkeys from Mastercard are reaching regional card checkout. Other markets’ banks sit at earlier stages, and each central bank advisory is the signal to watch.

Are passkeys safer than SMS OTP?

Substantially. An OTP is a shared secret sent over the telephone network that a SIM swap, a phishing page, or an interception can replay; a passkey never leaves the device and cannot be presented to a fake bank domain, so the interception lane closes. The remaining risk is human, not technical.

Can I still get scammed if my bank uses passkeys?

Yes, through social engineering: recovery phishing (tricking you into surrendering your platform account’s recovery) and enrollment fraud (talked into adding an attacker’s device). Both fall to the same two habits, offline recovery storage and verify-first calls, that the scam-defense guides cover.

What about e-wallets like GCash and Maya?

The Philippine wallets have hardened logins with in-app verification and device binding, and full FIDO passkey support is the announced next lane for vendors chasing the region’s remittance volume. Until a wallet ships passkeys, bind every device the app offers and switch off SMS recovery in settings.

What happens if I lose my phone after switching to passkeys?

Your platform’s recovery carries you: synced passkeys restore onto a replacement device through your Apple or Google account, and device-bound setups recover through the bank’s branch or support process with identity checks. This is why the recovery kit, a strong password and offline codes, is step three of the switch, not an afterthought.

One planning paragraph for the family conversation: the people most exposed to the remaining scams are the ones still on SMS everywhere, and they are usually the hardest to walk through settings screens. A ten-minute sit-down does it once: enable the token or passkey in each banking app for them, switch off the SMS fallback, print the recovery codes, and file one page of who-is-on-what. In households that send remittances, the payoff doubles, because the mule-account scripts that worked on OTP panic now meet a phone with no OTP to give away, and the SIM-swap defense guide remains the reference for anyone still on SMS until their bank ships the passkey prompt.

@online{agron2026passkeyssoutheast,
  author       = {Agron, Edmon},
  title        = {{Passkeys in Southeast Asia’s Banks and Wallets: Which Services Let You Drop SMS OTP}},
  year         = {2026},
  date         = {2026-11-12},
  organization = {WorldNgayon},
  url          = {https://worldngayon.com/passkeys-southeast-asia/},
  urldate      = {}
}

TY  - ELEC
AU  - Agron, Edmon
TI  - Passkeys in Southeast Asia’s Banks and Wallets: Which Services Let You Drop SMS OTP
T2  - WorldNgayon
PY  - 2026
DA  - 2026/11/12/
UR  - https://worldngayon.com/passkeys-southeast-asia/
Y2  - 
ER  -