Biometrics and the End of SMS OTPs in Malaysia’s Banks: Jumio’s Frederic Ho on What Comes Next

Banks in Malaysia are under pressure to replace SMS one-time passwords, and many are looking at biometrics as the answer. Frederic Ho, Vice President of APAC at Jumio Corporation, says the threats facing the sector keep changing, and he questions whether biometric technology on its own is ready to deliver both airtight security and the smooth experience banks want.

Phishing losses and a regulatory push

Phishing was already a serious problem for banks worldwide before the latest wave of tools arrived. Ho points out that Malaysia logged more than 25,000 online fraud cases in 2022, with losses of RM850 million. In Singapore, the widely reported phishing scams targeting OCBC Bank customers cost them S$13.7 million (RM45.6 million) in total. He expects ChatGPT to make things worse, because fraudsters can now write phishing messages that are highly convincing and free of the grammatical errors that used to give them away.

Regulators, in his reading, have concluded that SMS OTPs, which phishing can defeat, no longer suit a fast-moving digital environment and that stronger measures are needed quickly. Malaysia's central bank is an example. It is bringing in additional requirements, among them a move away from SMS OTPs towards more secure authentication and an obligation for banks to detect and block fraud attempts immediately.

Ho regards this as the right direction for the country. The risk he sees lies in how banks respond. Those that pick the wrong technologies could end up adding friction to everyday banking under the new rules, while those that put customer experience first at any cost may settle on tools that prove less secure over time.

Why a fingerprint or a face is not enough on its own

Biometric authentication has spread quickly through consumer and enterprise systems because it is secure, convenient and seamless. It confirms who someone is by checking biological or behavioural traits unique to that person, which makes it an attractive response to identity verification as cyber threats grow more frequent and more capable.

Ho accepts that biometrics are secure and easy to use, but he stresses that relying on them alone does not make a bank safe. Facial recognition is his example: unless it has advanced liveness detection, which confirms that the image comes from a live person at the moment of capture, it can be fooled by deepfakes. His recommendation is multi-factor verification that combines several technologies whenever a transaction looks high-risk, adding protection for customers without taking away convenience.

The trouble with stacking risk signals

To counter the range of threats they face, financial institutions now check much more than identity documents. Ho notes that it has become standard to pile up many risk signals, such as a user's name, IP address, phone and email.

That approach has its own weakness, he argues. When layers multiply, data is not integrated across the different solutions. Checks become less efficient, and the chance of falling foul of Know-Your-Customer (KYC) and anti-money laundering (AML) rules goes up. Working with several risk vendors, each with its own framework, makes workflows harder to manage and integration less seamless. A patchwork of products is also difficult to scale as the organisation grows, which pushes up operational resources and costs.

Orchestrating checks by risk

Ho puts the responsibility on banks to choose well. His proposal is multi-factor, risk-based authentication that calls on only the risk signals and technologies a given situation needs. A login to a bank's mobile app could begin with a device check. If that phone turns out to have been used several times to open accounts, stricter checks such as face verification would follow. Banks could also apply multimodal biometrics, for example fingerprint plus facial authentication, to high-risk profiles or to transactions above set thresholds.

Handled this way, he says, genuine customers get a frictionless experience and riskier individuals face closer scrutiny. Logins become easier, fraud is deterred more effectively and banks spend less on manual investigations, because cheaper risk signals screen out many fraudsters before the more advanced steps, such as biometric authentication, are run.

For this to work, Ho suggests banks team up with experienced integrated identity verification providers. That gives them access to a full set of online verification solutions, along with manual reviews when analysts must make the final call to confirm a user and detect remote fraud. Banks would also be able to tailor their identity verification and KYC compliance workflows to changing conditions, their risk tolerance and the regulatory standards of each market. Because none of this asks anything extra of the end user, he adds, onboarding stays smooth, which matters since consumers rank a seamless digital experience among their top priorities.

Ho describes the move away from SMS OTPs towards secure authentication as a sound step for Malaysia as it heads towards a cashless society. With online infrastructure growing more open and interconnected, he warns that an attack can spread fast and do severe, lasting harm, reaching beyond individual businesses to whole economies. That, in his view, is why organisations have to keep adopting advanced technology to prevent further banking fraud and make banking safer for everyone.