For more than a decade, the most common EMV 3-D Secure (EMV 3DS) challenge has been a one-time passcode (OTP) sent by SMS. Several regulators have now acted against it. Coverage tends to describe this as a single global ban, but the rules differ a great deal from market to market, and an issuer that treats them as the same may over-engineer in one market and fall short in another.
Three regulators, three different positions
|
Market |
Instrument |
Position on SMS OTP |
Timing |
|
United Arab Emirates |
Central Bank of the UAE Notice CBUAE/FCMCP/2025/3057, issued 23 May 2025 |
As publicly reported, SMS and email OTP, and static passwords, may no longer be used as the sole authentication method, and institutions are liable for fraud on 3DS transactions authenticated by SMS OTP. |
Full compliance by 31 March 2026 |
|
Philippines |
BSP Circular No. 1213, implementing Section 6 of the Anti-Financial Account Scamming Act (AFASA) |
Institutions must limit authentication mechanisms that can be shared with or intercepted by third parties, giving SMS and email OTPs as examples. Larger institutions must adopt strong methods: biometrics, behavioural biometrics, passwordless authentication such as FIDO, or adaptive authentication. |
Within one year of the circular taking effect (it was published on 10 June 2025 and took effect 15 days after publication) |
|
India |
RBI Authentication Mechanisms for Digital Payment Transactions Directions, 2025 |
For domestic payments, two-factor authentication remains mandatory and SMS OTP remains a permitted factor. The RBI encourages additional factors such as biometrics and software tokens. Cross-border CNP payments follow a separate provision. |
Domestic from 1 April 2026; cross-border CNP provision from 1 October 2026 |
The UAE notice is not published in full on a public page we could locate, so the UAE row reflects consistent public reporting of its requirements. The Indian cross-border provision is covered in what India’s cross-border rule means for issuers and ACS providers.
Only one of the three removes SMS OTP outright as a standalone method. The Philippines requires it to be limited and sets out stronger alternatives for larger institutions. India keeps it and adds options. An issuer with cardholders in all three markets needs three different answers.
The Philippine circular contains a detail with direct consequences for merchants. It defines “unsecure merchants” to include merchants that do not implement secure industry-standard transaction authentication protocols, and requires larger institutions’ fraud management systems to screen transactions against unsecure merchants and block them where necessary.
Why SMS OTP is under pressure
An SMS OTP proves that someone could read a message sent to a phone number. The code is not tied to the website where it is entered, so it can be relayed from a phishing page, and the phone number itself can be moved to another SIM. The BSP circular describes the concern as authentication that can be “shared to, or intercepted by, third parties unrelated to the transaction”.
Where the change lands in EMV 3DS
In EMV 3DS, the issuer’s Access Control Server (ACS) decides how to challenge a cardholder, as explained in how an ACS picks a challenge method. Moving away from SMS OTP means changing that decision. The main alternatives behave differently:
|
Challenge method |
How it runs in EMV 3DS |
Exposure to interception or relay |
Main dependency |
|
SMS or email OTP |
Code delivered outside the session and typed into the challenge screen |
High. The code can be relayed or the number redirected. |
Mobile network delivery |
|
Out-of-band approval in the banking app |
Cardholder approves in the issuer’s app, then returns to checkout |
No code to relay, but a cardholder can still be talked into approving a payment |
App installed and reachable; app-switching works (what happens when the app cannot open) |
|
Passkey through Secure Payment Confirmation (SPC) |
Browser confirms the payment with a passkey bound to the issuer |
Low. The passkey is bound to its origin and is not released to another site. |
Browser support, enrolment, and recent EMV 3DS versions (SPC and WebAuthn) |
|
Risk-based frictionless authentication |
No challenge; the ACS decides from transaction and device data |
Not a challenge, so not a substitute where two factors are required |
Data quality from the merchant side |
App approval removes the code, which removes code relay. It does not remove social engineering. An approval screen that shows the merchant name and amount gives the cardholder a better chance of spotting a payment they did not start, and the BSP circular asks for OTP messages to carry enough transaction detail for the same reason.
What issuers should plan for
- Map current challenge volumes by method and channel, market by market, against what each regulator actually requires.
- Plan a fallback for cardholders without the banking app or with an unsupported device, so removing SMS does not lock them out of online payments.
- Show merchant name and amount on every approval screen, whatever the method.
- Test app-based challenges on mobile browsers, where app-switching most often fails (why browser-based out-of-band fails on mobile).
- Measure challenge completion by method before and after each change, using the approach in what issuers should measure.
What merchants will notice
Cardholders from the UAE and, increasingly, the Philippines will see fewer SMS codes and more app approvals. App approvals take longer than typing a code, so checkouts that time out a challenge early will lose more genuine customers. Merchants selling into the Philippines should also note the unsecure merchant definition: a merchant that does not use secure authentication protocols such as EMV 3DS may find its transactions screened or blocked by Philippine issuers’ fraud systems.
Frequently asked questions
Is SMS OTP banned for card payments everywhere?
No. Among the three markets covered here, only the UAE prohibits SMS OTP as a standalone method. The Philippines requires it to be limited, and India keeps it as a permitted factor. Other markets have their own rules.
Is in-app approval phishing-resistant?
Partly. It removes the code that phishing pages ask for, but a cardholder can still be persuaded to approve a payment. Passkeys bound to the issuer’s origin, used through SPC, give stronger protection against relay.
Do these rules apply to foreign cards used in these countries?
No. Each rule binds the institutions its regulator licenses. A foreign card used at a UAE or Philippine merchant is authenticated by its own issuer under that issuer’s rules.
What should issuers offer cardholders without a smartphone?
A method the local rules still permit, such as a hardware token or another strong factor. In the Philippines, SMS OTP must be limited rather than removed, which leaves more room than in the UAE.
Does moving away from SMS OTP change liability shift for merchants?
Liability shift between merchant and issuer under scheme rules follows the authentication outcome, not the method. Reported UAE rules on refunding consumers for OTP-authenticated fraud sit between the issuer and its customer.
Reviewing your challenge methods
GPayments’ ActiveAccess is an Access Control Server for issuers and issuer processors. To review how your challenge methods line up with the rules in your markets, speak with a GPayments 3DS specialist.