Home

About

GCash’s Face Scan Proves Who You Are. It Can’t Prove You Weren’t Tricked.

GCash has spent three years pushing selfie checks deeper into its app. The move answers the regulator and the IPO more directly than it answers the scams where users are talked into sending money themselves.

GCash’s deeper face checks are best read as a liability shield built for AFASA and a listing year, and they stop account takeovers far better than they stop scams in which users are persuaded to send money.

1. The pressure is legal and financial, not competitive. AFASA lets a scam victim recover funds without a criminal conviction if the provider lacked adequate controls, and Mynt is marketing an IPO of up to ₱92.3 billion, which at full size would be the largest in Philippine history.
2. The face scan answers one threat well. DoubleSafe blocks a stranger on a new phone even when the owner has leaked both MPIN and OTP, which is exactly the phishing pattern behind GCash’s May 2023 incident.
3. Persuasion scams slip past it. When a scammer talks the real owner into sending money, the owner passes the face scan herself, and GCash now sells separate Scam Protection cover, at ₱30 for 30 days, for that gap.

To see where the line falls, follow one store owner through two versions of the same phishing call.

Lorna runs a sari-sari store in a barangay outside Iloilo City. She keeps her float in GCash: supplier payments, a load business on the side, and the cash her daughter sends from Manila. One afternoon in early 2023, a man calls. He says he is from GCash, that her account has been flagged, and that he needs the code GCash just texted her to “secure” it. She reads him the six digits. Earlier that week she had typed her four-digit MPIN into a link that looked like a GCash promo page.

Under the old setup, that was enough. The caller installs GCash on his own phone, enters her number, types her MPIN, and keys in the SMS code she read aloud. The app has no way to tell him from her. He moves her balance out in a few transfers before she finishes closing the store.

Now run the same call after DoubleSafe. The caller has her MPIN and her OTP. He enters both on his phone. GCash sees a login from a device it has never bound to Lorna’s account and asks for a selfie scan with a liveness check. His face does not match the one GCash captured when Lorna verified her account. After five failed scans, GCash locks the account for 24 hours. By mid-2026 the code he wanted would not even arrive by text. GCash began moving its one-time PINs into push notifications inside the app in January 2026 and finished the switch on June 22. If Lorna suspected something, she could ask GCash’s in-app assistant, Gigi, to lock the account, which logs out every session and blocks outgoing transfers.

That is the part of the story GCash tells, and it is true. Here is the part it tells less often. Suppose the caller skips her login entirely. He says a relative is in hospital, or that she has won a supplier rebate and must pay a processing fee first. Lorna opens GCash on her own phone, looks into her own camera, taps approve in her own app, and sends the money herself. Every layer passes. The face was hers. So was the decision.

What the selfie is really for

GCash introduced DoubleSafe in March 2023. It added a third check on top of the MPIN and the OTP, and it applied the first time an account logged in on a new device. At the time, GCash said 76 million users would need to activate it. By May 10, 2023, the face check covered all fully verified users. The check used liveness detection so a photo could not fool it. Pebbles Sy, then GCash’s chief technology and operations officer, said the face check was built into the app and did not need a high-end phone. Users who had not completed full verification got an extra OTP instead of a selfie.

The official reason was fraud. GCash said it had blocked 3.1 million fraudulent accounts and taken down 722 phishing sites between January 2022 and April 2023. Weeks later, users reported unauthorized deductions. The National Privacy Commission closed its probe on May 24, 2023, finding that phishing, not a breach of GCash’s systems, was the cause. The attackers had baited users through online gambling sites.

Since then, the face check has crept deeper. GCash’s help pages now describe Device Security, which flags apps that can alter a face on screen, naming SwapFace, DeepFaceLive and FaceSwap, along with tools like Frida that let someone tamper with an app. A Security Center, rolled out in mid-2026, uses DoubleSafe to reactivate a locked account. In August 2026, GCash’s lending arm, Fuse Financing, added a selfie scan to GLoan applications during higher-risk moments, and paired it with free Loan Scam Insurance of up to ₱10,000 for select users.

Read the press releases and the problem is user safety. Read the law and the listing documents, and the problem looks different.

On July 20, 2024, Republic Act 12010, the Anti-Financial Account Scamming Act, or AFASA, became law. Section 6 tells financial institutions to protect accounts with adequate controls, naming multi-factor authentication and fraud management systems. An institution that has those controls is protected from liability for scam losses. One that does not must make restitution, and conviction of the scammer is not a prerequisite. The BSP’s Circular 1213, dated May 30, 2025, then told supervised institutions to limit one-time PINs sent by SMS or email, because those codes can be intercepted, and to adopt stronger methods such as biometrics, behavioral biometrics and passwordless keys. It gave them one year from taking effect to comply, and GCash tied its own switch to a BSP deadline of June 30, 2026. When the circular came out, BSP Deputy Governor Elmore Capule put it plainly: if an institution fails to comply and a customer is defrauded, it may be held liable.

The same year, GCash became a listing candidate. Mynt, the company behind GCash, filed at the end of June 2026 for an IPO of up to ₱92.3 billion. That would nearly double Monde Nissin’s ₱48.6 billion record from 2021.

Put those together and DoubleSafe’s real job comes into focus. Every face check is a record that GCash applied an adequate control at a risky moment. Under AFASA, that record decides who pays when money disappears.

Innovation Pressure Map: why GCash kept pushing the face check deeper

Figure 1. Innovation Pressure Map for GCash’s face-check expansion. Ratings are editorial judgments on a five-point scale; each marker sits on one of five discrete positions. Sources for each row are listed in References.

The two highest rows are the regulator’s rules and the shareholders’ listing. The press releases point at users. That gap is where the analysis starts.

Some of these ratings could move. Stakeholders would rise to High if the BSP finalizes its draft memorandum on server-side biometrics, published in March 2026, since it would turn liveness and deepfake detection from good practice into a written test. Customers could rise if the BSP publishes a breakdown showing that e-wallet scam complaints drive the 2025 jump. Competition would climb if Maya’s faster, ID-linked verification starts pulling verified users away. For now, the evidence supports the ratings as shown.

Four readings of the same rollout

There are four plausible reasons GCash kept extending the face check. Each predicts a different row should top the map.

Reading one: users demanded it. This predicts Customers should be highest. There is some support. BSP complaints rose from 19,181 in 2021 to 70,112 in 2024 and to more than 120,000 in 2025. The BSP’s mediation success rate fell from 84.4% to 74% in the same year. But the BSP itself says the jump reflects “greater public awareness” of its channels, wider digital adoption and media attention on AFASA. The trend has not eased. By mid-September 2026, BSP officials said complaints handled this year had already reached the 2025 total, with fund-transfer problems among the growing categories. The data is not split by institution, so none of it can be pinned on GCash. And users rarely ask for more friction. GCash’s help pages spend real space on failed face scans: bad lighting, glasses, a damaged front camera, and a 24-hour lock after five misses. Customer pressure is real. It does not explain why the checks spread in 2025 and 2026 specifically.

Reading two: a response to rivals. This predicts Competition should top the map. The evidence does not support it. DoubleSafe went live in 2023. Maya’s late-August 2026 upgrade lets a user enter a National ID number, checks it against the PSA’s eVerify records, and then asks for a video selfie. Maya says this cut onboarding turnaround time by 84%. That is an onboarding improvement, not a login gate, and GCash already uses the same PSA service, according to Fintech News Philippines. GCash also has four times the monthly active users of its nearest competitor, according to figures from its prospectus. A company with that lead is not copying anyone.

Reading three: the IPO. This predicts Shareholders should dominate. The timing fits part of the story. The full switch to in-app OTPs, the Security Center and the GLoan face check all landed between June and August 2026, the same window in which Mynt filed, secured SEC and PSE approvals, and lined up cornerstone investors. Institutional buyers read risk factors, and unresolved fraud liability is the kind of risk that lowers a price. But DoubleSafe itself went live more than three years before Mynt filed. The IPO explains the pace. It does not explain the product.

Reading four: the law moved the cost of fraud. This predicts Environment and Stakeholders should be highest, and the evidence lines up. AFASA made “adequate controls” the test for who bears a loss. Circular 1213 put a one-year clock on curbing SMS codes, which are exactly the codes Lorna read to her caller. The BSP’s March 2026 draft on server-side biometrics then described the controls it wants to see: biometric templates matched on the institution’s servers rather than on the phone, encrypted and never stored as raw images, backed by device binding, liveness detection and deepfake detection. DoubleSafe’s selfie, matched against the face GCash captured at verification, already sits close to that model. The in-app OTP closes the SMS gap before the deadline. The GLoan check extends the same evidence to the product line growing fastest.

Reading four does not erase the others. Users do suffer from fraud. The IPO did compress the calendar. But only the liability explanation predicts both what GCash built and when.

Figure 3. GCash controls plotted against legal, regulatory and capital milestones. Sources: Manila Bulletin (2023); LawPhil, RA 12010; BSP Circular 1213; The Philippine Star (2025 and 2026); GMA News (January 12, 2026); Mynt Newsroom (June, August and September 24, 2026); GizGuide (August 2026). Positions are approximate to the month.

Where the face check works, and where it goes blind

Start with the mechanics. DoubleSafe is not the Face ID or fingerprint unlock on a phone. Those are device biometrics. The phone checks the face and tells the app “yes,” and the app never sees the face at all. When DoubleSafe launched, BitPinas reported that the selfie scan appeared only for users who logged in with their MPIN. Users with device biometrics turned on did not see it. That distinction matters now. The BSP’s draft rules favor server-side matching precisely because a device-level check travels with the device, and the device is what a fraudster controls. GCash’s KYC face checks run on biometrics from Zoloz, a unit of Ant Group’s digital technology arm. Ant is also one of Mynt’s shareholders.

Get the next SEA banking case study in your inbox

Free. Unsubscribe anytime.

Against account takeover, this design is strong. A stolen MPIN and a leaked OTP no longer open an account on a stranger’s phone. That was the exact route in the May 2023 phishing wave. Moving OTPs into the app removes the code a caller can ask for. Device Security adds a second filter by refusing to run alongside face-swap apps and tampering tools. And the Security Center gives users a kill switch they can reach through Gigi.

The scale is what makes the design matter. Mynt reported 39.1 million monthly active users at the end of 2025, and September 2026 coverage of its offer put the June 2026 figure at 41.5 million. Coverage of the same offer puts GCash’s registered base at about 94 million. It processed an average of 56.7 million transactions a day in 2025 and ₱17 trillion in gross transaction value for the year. At that volume, a control that shaves even a small share off account takeovers is worth a great deal under AFASA.

The chart below separates two numbers that often get blurred. GCash’s 2023 announcement said 76 million users needed to activate DoubleSafe. Mynt’s own numbers show that only about 41 million people use the app in a given month, well under half the registered base. The gate is wide, but the traffic through it is narrower than the headline suggests. Dormant accounts only meet the face check when someone tries to open them on a new phone, which is exactly the moment a stolen or rented account would be put to use.

Figure 2. GCash user counts by definition, in millions. Sources: Manila Bulletin, March 16, 2023 (76 million); The Philippine Star, September 11, 2026 (about 94 million); Philstar and Inquirer, June 2026, citing Mynt’s IPO filing (39.1 million MAU); The Manila Times, September 28, 2026 (41.5 million MAU as of June 2026). Definitions differ across sources, so bars are not additive.

Now the blind spot. A face scan answers one question: is this the owner? It cannot answer the second question that matters in many scams: did the owner mean to do this? In March 2026, GCash’s chief risk officer, Ingrid Beroña, named AI-generated phishing and smishing as the biggest problems across services, because fraudsters can now write convincing messages and even translate them. Those attacks aim at the person, not the login.

GCash’s own product shelf admits the gap. Its Scam Protection add-on costs ₱30 for 30 days or ₱20 a month on renewal. It pays up to ₱15,000 per incident, and the cover is underwritten by Chubb’s Insurance Company of North America. It covers account takeover, online shopping fraud, and social engineering, which the policy describes as being “tricked into transferring funds.” That last category is the scam a face scan cannot stop. The exclusions are telling too. Advance-fee fraud, including job, investment, loan and task scams, is not covered, and those are pure persuasion scripts that no face scan can catch. The policy also excludes losses that can be recovered from GCash. Put plainly, the insurance pays in the cases where GCash itself does not. A company confident that its face gate handled social engineering would not need to sell insurance against it.

There is a second, newer weakness. In April 2026, Biometric Update described JINKUSU CAM, a live deepfake tool sold to defeat remote identity checks, including blink, head-turn and smile prompts. The tool works by feeding a synthetic face into the camera stream before the app ever sees it. GCash’s defense against this is Device Security’s list of known face-swap apps. That is a list, and lists lag. The BSP’s draft explicitly asks for deepfake detection. Whether GCash meets that test through its vendor, or through something it has not described publicly, is not in the public record.

The capital story ties these threads together. Mynt’s adjusted revenue rose 47% in 2025, from ₱54.1 billion to ₱79.7 billion, and net income rose from ₱11.1 billion to ₱17.2 billion. Growth has since cooled. InsiderPH reported first-half 2026 revenue of ₱43.15 billion, up 10% from a year earlier, with net income of ₱10.82 billion. That makes the lending line even more important to the listing story. The loan book, ₱64.07 billion by March 2026, grew at a 71.3% compound rate over two years. We traced how Southeast Asia’s profitable fintechs lean on lending in Inside the Playbook Behind Southeast Asia’s Profitable Fintechs. GCash fits that playbook, and it explains the GLoan face check. A loan taken out in a victim’s name is a double loss: the victim is harmed and the lender holds a bad debt. Putting a selfie in front of GLoan protects the fastest-growing asset on the balance sheet before institutional investors price it.

So the design answers the strongest pressures on the map. It answers the Environment row by retiring SMS codes on time. It answers the Stakeholders row by producing evidence of adequate controls. It answers the Shareholders row by lowering one visible risk in the prospectus. What it does not fully answer is the Customers row, where many losses come from users acting under deception. That mismatch is not a design mistake. It follows from the law. AFASA shields an institution that has adequate controls. It does not require the institution to prevent every scam a user authorizes. A face check is a very good way to prove adequacy. It is a weaker way to protect Lorna from herself on a bad afternoon.

What a skeptic should still doubt

GCash has published no outcome data for DoubleSafe. There is no public figure for how many takeovers the face check blocked, how often it wrongly rejects real owners, or how those rates differ by phone model, age or skin tone. Summaries of the BSP’s draft say it asks institutions to monitor false acceptance and false rejection rates and to check for bias across user groups. Until GCash reports those numbers, the feature’s effectiveness is a claim.

The user counts do not line up. GCash cited 76 million users in 2023. Coverage of the June 2026 filing cited 90 million registered users, and September 2026 coverage cites about 94 million. None of these is monthly activity, which sits near 41 million. Any claim that DoubleSafe protects 94 million Filipinos counts accounts, not people.

The fraud baseline is thin. The BSP’s complaint totals cover every supervised institution and mix scams with ordinary service disputes. Rising complaints could mean more fraud, better reporting, or both. The fair reading is that no public dataset yet shows whether GCash-specific scam losses rose or fell after DoubleSafe.

Friction has a cost that nobody has priced. A 24-hour lock after five failed scans is a safety feature for the victim and a lost day for a store owner with a cracked front camera. We saw how authentication friction erodes trust in a bank app in PBCOM Fixed Its Core Banking System. Its App Still Gets 3.3 Stars., where missing OTPs and dropped sessions dominated user reviews. GCash’s case is different in scale, not in kind: the same trade-off applies across roughly 41 million monthly users.

Some dates and figures are soft. Reports put the GLoan face check anywhere from August 19 to August 28, 2026. Mynt’s 2023 net income appears as ₱6.4 billion in one prospectus summary and ₱6.7 billion in another, which is why this piece leaves 2023 out. The IPO price is set on October 1 and announced on October 2, so any valuation quoted before then is a ceiling, not a fact.

Three answers for three readers

For the GCash user (the Customers row). DoubleSafe is worth having, and it works against the scam it was built for. If someone steals your MPIN and your OTP, your account is still far safer than it was in 2023. Keep the app updated, keep face-swap and cloning apps off the phone you bank on, and learn where the Security Center’s lock is before you need it. But the face scan will not save you from a caller who persuades you to send money. Treat any request to move funds, pay a fee to claim a prize, or pay to secure a job as the real risk. Whether the ₱30 Scam Protection cover is worth it depends on your balance. It pays up to ₱15,000 per incident and excludes advance-fee scams such as fake jobs, investments, loans and tasks.

For GCash’s strategy (the Shareholders row). Extending the face check was the right move and the timing is defensible. It puts GCash on the right side of AFASA’s liability test, it met the SMS phase-out date, and it guards the lending book at the center of Mynt’s growth story. The risk is that the company mistakes compliance evidence for fraud prevention. The next step that would change the story is publishing outcomes: takeovers blocked, false rejections, and scam losses by type. A listed company with more than 40 million monthly users will be asked for those numbers. Better to set the metric than have it set by a complaint wave.

For regulators and analysts (the Stakeholders row). GCash is a useful test of whether AFASA’s “adequate controls” standard produces the right incentives. It clearly rewards controls that verify identity. It is weaker on controls that interrupt a deceived user, such as cooling-off periods for first-time payees or friction scaled to a scam script. The BSP’s server-side biometrics draft is a strong step on identity and deepfakes. Analysts pricing the IPO should ask a narrower question than “is GCash safe?” Ask what share of reported losses are authorized scams, and how much of that share GCash is carrying today. The same question will matter for every bank we covered in Philippine Banks Aren’t Inventing New Products. They’re Reconnecting Old Ones., where biometrics are already becoming a building block across the sector.

Workshop: does your control answer the pressure that’s actually on you?

Security features are a clean example of a wider habit. A company launches a control, describes it in terms of the customer, and builds it around the pressure that can cost it the most. That is not a flaw on its own. It becomes one when nobody checks whether the customer’s biggest risk and the company’s biggest risk are the same.

Run your own control, product or initiative through these questions.

#	Question	Your answer
1	Who pays when your control fails: the customer, your company, or a partner? If a law or contract changed that answer recently, is that change the real reason you are building?
2	Your control checks one thing. Name it in a single sentence. Now name the loss it cannot see. Who is carrying that loss today, and do they know it?
3	What outcome number would prove the control works, not just that it exists? Would you be comfortable publishing it?

Then fill in your own pressure map. Rate each row honestly. If every row reads High, you have not found the real problem yet.

Where is the pressure coming from?	Intensity (Low to High)	Why?
Demanding Shareholders
Growth-driven Leadership
Changing Environment
Competition
Demanding Customers
Demanding Stakeholders

Tags: GCash, DoubleSafe, Mynt, AFASA, Biometric Authentication, Fraud Prevention, Philippines Fintech, Fintech, Banking, AI & Data in Financial Services

IdeyaHub newsletter

Enjoyed this case study?

Get the next deep dive on Southeast Asian banks, fintechs and insurers in your inbox. One email a week.

Free. Unsubscribe anytime.