Setting a new standard for mobile banking security across APAC
Industry
Banking / Financial services
Size
10K+
Challenge
A Tier 1 commercial bank had customers relying on SMS-based OTPs and passwords, leaving them exposed to phishing, SIM swapping, and credential theft, with measurable costs in fraud losses and support overhead.
Solution
1Kosmos deployed FIDO2 passkeys across the bank’s mobile banking platform, replacing SMS OTPs with biometric authentication. Passkeys are stored locally on users' devices and never transmitted across networks, eliminating the vulnerabilities of legacy authentication.
First in the Philippines
The client became the first financial institution in the Philippines to offer next-generation MFA, and the first bank to meet the identity-related guidelines of the Anti-Financial Account Scamming Act (AFASA), setting a new benchmark for mobile banking security.
SMS OTPs were previously relied on for transaction approvals, which created three growing problems: high telecom delivery costs, user friction from SMS network delays, and increasing exposure to SIM-swapping attacks. Transitioning to 1Kosmos positioned the client to meet stringent digital identity regulations while fully modernizing its mobile banking experience.
Authentication that can't be phished
To address these challenges, 1Kosmos FIDO2 mobile SDK was embedded into the client's existing banking application, transforming each user's smartphone into a secure biometric authenticator.
Passkeys change the underlying security architecture in three ways:
No shared secrets
Cryptographic credentials are generated and stored locally in the device's secure enclave, never transmitted across networks or held on centralized servers.
No attack surface
With no password to steal and no SMS code to intercept, the architecture neutralizes credential stuffing, phishing, and SIM-swapping attacks entirely.
Device-native biometrics
Authentication relies on local device biometrics such as Apple FaceID or Android fingerprint scanning; biometric data never leaves the user's phone.
11 million transactions, zero passwords
For high-volume consumer banking, implementation strategy is as critical as the technology itself. Rather than forcing an abrupt transition, the bank executed a phased rollout.
The 1Kosmos mobile SDK bound each user's device to their banking profile on first login, from which point users were onboarded to passwordless transaction approvals. Adoption held through the shift to mandatory passkey authentication: 275,757 additional users onboarded after passkeys became required, bringing the total to 438,608 customers on the platform (October 2026).
Tangible ROI
The results were immediate across both security and operations. Customers now approve transactions in seconds using familiar biometrics, eliminating the friction and delays of waiting for SMS codes.
The bank confirmed the deployment generates at least $1 million (USD) in annual SMS-cost savings, with the platform now processing roughly 75,000 transactions a day and more than half a million each week. Total transaction volume has passed 11 million since go-live.
A blueprint for APAC banking
This deployment demonstrates the scalability of the FIDO2 mobile SDK in high-volume, highly regulated environments. As financial institutions across APAC face growing regulatory pressure to move beyond OTPs, including AFASA requirements in the Philippines, these results offer a replicable, high-ROI model for the region.
See what this looks like for your institution
This deployment is replicable. If you're evaluating FIDO2 passkeys for high-volume consumer banking, we can walk you through the architecture, the rollout approach, and the numbers.
