Building Trust, Brick by Brick

When we talk about banking, we always return to one fundamental truth: banking is built on trust. As consumers continue to embrace digital channels for their day-to-day transactions, keeping that trust requires us to constantly prioritize consumer protection.

However, technology evolves on both sides of the fence. Just as we innovate to build better financial services, cybercriminals are becoming more sophisticated. They use advanced technology and social engineering techniques to target account holders.

At BPI, we respond to these threats by laying down our defenses brick by brick.

What does this mean? It means carefully laying down structural pieces: combining policy frameworks, advanced app architecture, and everyday user habits with the goal of building a stronger fortress of trust.

Laying the App-Level Bricks: Making Regulations Tangible

While financial institutions and regulatory frameworks like the Anti-Financial Account Scamming Act (AFASA) build powerful technical walls, there is one crucial layer that stands right at the entry point: the banking public. 

In cybersecurity, the consumer is not just a passive receiver of protection. Our clients are active frontliners of defense. Scammers know that our internal systems and bank vaults are difficult to breach directly, so they direct their attacks at human trust through deceptive messages, calls, and emails. Without the public’s vigilance, even the most sophisticated technological defenses can be bypassed.

As mobile banking becomes an essential part of daily life, maintaining this vigilance is an utmost priority. Banking apps have transformed how we handle our money and offer unprecedented convenience—whether we are paying for morning coffee, sending money to loved ones, settling monthly bills, or managing businesses on the go. Digital banking makes everyday transactions fast and seamless, but for that convenience to be truly valuable, it must be safe. That is why our goal is to ensure that every tap, swipe, and transfer is backed by uncompromised security, giving our clients peace of mind while they enjoy the ease of modern banking.

To empower our clients at the frontlines, BPI continuously updates the BPI App with safeguards that translate AFASA’s provisions into tangible protections:

• Mobile Key Authentication
  • AFASA Provision: Section 6 (Multi-Factor Authentication & Verification).
  • The Safeguard: We replace traditional SMS-based OTPs—which are vulnerable to SIM swapping, interception, and social engineering—with a dedicated 6-digit Mobile Key PIN and device-bound biometrics. Authentication is cryptographically anchored directly to your trusted hardware.
• Mandatory Cool-Off Periods
  • AFASA Provision: Section 6 (Protective Verification Controls) and Section 3(e) (Automated Real-Time Fraud Controls).
  • The Safeguard: High-risk activities—such as linking a new device, changing core security credentials, or updating account details—trigger an automated execution delay such as a cooling-off period of up to 24 hours. This gives account holders a critical window to detect, flag, and halt unauthorized account takeovers.
• Environment Integrity Checks (VPN & Root Restrictions)
  • AFASA Provision: Section 6 (Adequate Risk Management Systems and Technical Controls).
  • The Safeguard: The BPI App automatically inspects runtime environments, restricting operations on rooted or jailbroken devices and active, untrusted VPN connections. This prevents threat actors from using compromised operating systems or altered networks to spy on transactions or hijack app memory.

Laying the Privacy Bricks: Masked Name Transfers

Privacy plays a massive role in stopping social engineering schemes before they start. Section 4(b) of AFASA explicitly criminalizes social engineering schemes that trick individuals into revealing sensitive personal data.

To address a critical loophole, the Bank introduced Masked Names for BPI-to-BPI transfers. By masking recipient names during fund transfers, we stop scammers from using random account number queries to harvest full legal names and personal data for targeted phishing schemes. Understanding these tactics allows frontliners to reinforce their individual brick in the wall.

1. The Malicious APK Scam

Scammers trick users into downloading sideloaded Android apps (.APK files) disguised as delivery updates, government forms, or promotional offers. Once installed, these malicious apps secretly take over the device, read keystrokes, and capture credentials.

• Frontline Defense: BPI’s app detects unsafe device environments, but as a rule of thumb, never download apps outside official stores (Google Play and Apple App Store).

2. Lost Phone Risks (Physical SIM vs eSIM)

What happens if your phone falls into the wrong hands? Many assume that a locked screen equals a safe bank account, but that depends on how your SIM card is configured.

• The Risk with Physical SIMs: If a thief steals a phone with an unsecured physical SIM, they don't even need to crack your screen lock. They can simply pop out the SIM card, insert it into another device, receive your OTPs, and potentially reset your banking or e-wallet passwords.
• The Advantage of an eSIM: An eSIM is digitally embedded directly into your phone's hardware and cannot be physically removed. A scammer cannot separate your phone number from your locked phone, meaning they would still need your phone unlock passcode, banking passwords, and biometrics to gain access.

Laying Down Actionable Bricks: Concrete Steps for Consumers

Building a wall of digital trust requires every consumer to actively lay down their own personal defensive bricks. The most immediate step anyone can take is locking down their mobile device at the SIM and operating system levels. For those using physical SIM cards, navigating to device settings to enable a SIM Lock is critical; replacing the default factory PIN (such as 1234 or 0000) with a custom 6-digit PIN ensures that even if a physical card is removed and inserted into another device, it cannot be activated to intercept one-time passcodes.

Where available, upgrading from a physical SIM to an eSIM adds a permanent layer of hardware protection, as embedded digital SIMs cannot be extracted or hijacked by opportunistic thieves. Finally, reinforcing your device’s frontline defense with a strong, complex lock screen passcode, paired with biometric authentication, guarantees that a lost or stolen phone remains completely locked, preventing threat actors from bypassing screen security to access your sensitive banking credentials.

A Fortress Built Together

We can build the strongest technological fortresses, but individual consumer vigilance will always be the ultimate barrier against fraud.

This year’s Cybersecurity Awareness Month theme, “HABI: Salig sa Gawa, Tibay sa Banta,” and its message, “A People-Centered Approach to a Resilient Philippine Cyberspace,” reinforces this shared responsibility. Awareness is an important first step, but lasting resilience is built when vigilance becomes a habit and people are equipped to deal with cyberthreats when they arise.

Technology may be exploited to deceive, but when paired with proactive bank security, smart legislation like AFASA, and a vigilant public standing as frontliners, we can lay down each brick carefully to create an unbreakable system of digital trust.

Fitzgerald S. Chee is Senior Vice President and Head of Consumer Platforms at the Bank of the Philippine Islands (BPI). This article is adapted from his speech titled “The Public as First Line of Defense: Building Digital Trust to Combat Financial Scams,” which was delivered at the BPI CyberProtect Conference 2026.