OVER the past few years, reliance on cashless payments has rapidly become the norm in the Philippines. They’re fast and convenient, but come with one major downside: digital fraud.
This very problem prompted the enactment of Republic Act No. 12010, or the “Anti-Financial Account Scamming Act (AFASA).” The goal is pretty simple: deter fraudsters, protect consumers.
Perhaps the most salient feature of the law is the unmistakable responsibility it imposes upon banks and other financial institutions to ensure the protection of their clientele’s financial accounts by adopting “adequate risk management systems and controls” that are proportionate to the nature, size, and complexity of their operations.
By “adequate,” the law means upgraded, robust, and sophisticated, or ones that do not solely rely on OTPs (one-time passwords), especially for high-value transactions. This was made particularly clear by Bangko Sentral ng Pilipinas (BSP) General Counsel Roberto L. Figueroa in his public statements following the enactment of AFASA. The same is fleshed out in the three circulars issued by the BSP (BSP Circular Nos. 1213, 1214, and 1215, Series of 2025) for the implementation of the law.
Under the AFASA, these risk management systems and controls include multi-factor authentication (MFA), or the use of two or more verification factors before account access or approval is granted, and fraud management systems (FMS), which refer to a comprehensive set of automated and real-time monitoring and detection systems to identify and block disputed, suspicious, or other online transactions.
In implementing these controls, covered banks and other financial institutions must follow the standards set under BSP Circular No. 1213, which include biometric authentication, behavioral biometrics, passwordless authentication, adaptive authentication, transaction velocity checks or thresholds, mobile device and account information changes, geolocation monitoring, blacklist screening, and behavioral anomalies. These risk management controls must also be calibrated regularly to adapt to evolving fraud tactics.
Covered banks and other financial institutions were given until June 25, 2026 to upgrade their systems in compliance with the AFASA and its implementing rules and regulations. As it now stands, banks and other covered financial institutions cannot deny liability by simply raising the defense that it was the account owner who gave or even entered the OTP, especially for high-value transactions. There must be other security measures in place to prevent the scams, not mere reliance on OTPs.
Under Section 6 of the AFASA, failure to employ adequate risk management systems and controls shall make banks and other financial institutions liable for restitution of funds to the account owners, and the scammer’s conviction is not a prerequisite. In other words, victims of financial account scamming now have an easier and potentially faster way of getting back 100% percent of their lost funds.
This is great news, especially considering the volume of reported digital scams in the country. A year after the AFASA took effect, more than 500 cases against scammers have been filed by the Philippine National Police (PNP), according to the BSP. This number only pertains to filed cases, and does not include unrecorded ones.
The number of unreported cases is presumably high, as only 16% of scam victims in the Philippines go to the police to report their cases, as shown by The GSMA ASEAN Consumer Scam Report 2026, a study conducted to observe the behavior of scam victims across six Southeast Asian countries.
“The Philippines is the market where victims take their cases to platforms rather than the police. xxx Reporting has moved decisively to platforms: 49%
of Filipino victims reported to digital platforms, the highest in the region, while only 16% went to police, against a regional 36%,” the report stated.
In Banco De Oro Universal Bank, Inc. et al v. Seastres et al [G.R. No. 257151 (Formerly UDK 16942). February 13, 2023], the Supreme Court held time and again that “the banking business is so impressed with public interest where the trust and confidence of the public in general is of paramount importance such that the appropriate standard of diligence must be very high, if not the highest, degree of diligence.”
This high standard expected of banks and other financial institutions is embodied in the AFASA, a tangible measure which has become imperative in light of the rapid digital development and real-life experiences of victims in the country.
***
Author’s Disclaimer: This article was independently researched, written, and reviewed by the author. It was not generated, drafted, or materially assisted by artificial intelligence (AI) or any AI-powered writing tool. The analysis, views, and conclusions expressed herein are solely those of the author.
Atty. Jonel P. Amio is an Ilonggo lawyer based in Makati City. He is a Junior Partner at BLBA Law Firm. You may reach him at jamio.blbalaw@gmail.com/PN
