No single bank can stop fraud alone. That is the uncomfortable truth emerging from the Philippines’ rapid digitization of finance. As banks deploy increasingly sophisticated AI models to detect fraudulent transactions, threat actors are adapting, exploiting weaknesses that exist between institutions rather than within them. The Asian Banker’s October 2026 analysis of AI-era risks in Philippine banking captures the tension: fraud controls are improving, but the fraud ecosystem is evolving faster than any single institution can match.
The Limits of Institutional Defense
Marlon Sorongon, chief information security officer at Maybank Philippines, described a layered approach that combines authentication, behavioral analysis, and geolocation checks to assess whether activity is consistent with a customer’s expected pattern. But he also identified a critical gap: “At present, we do not have a centralised fraud database”. Without shared intelligence, each bank learns about fraud patterns in isolation, allowing fraudsters to recycle identities and tactics across institutions. Angel Redoble, chairman of the Philippine Institute of Cyber Security Professionals, noted that threat actors monitor improvements made by banks and adapt accordingly: “Threat actors do not take holidays”.
Industry Moves Toward Collaboration
Despite the gap, individual institutions are making strides. Security Bank Corporation partnered with Tookitaki in October 2026 to deploy the FinCense Screening platform, an AI-powered anti-financial crime system that automates compliance, anti-money laundering, and fraud detection. The platform enabled Security Bank to expand its screening coverage tenfold and extend oversight to 100% of related contacts. Crucially, the AI-driven matching handles the complex naming conventions common in the Philippines, where Spanish, Chinese, and local naming traditions create significant variance across legal documents. “AI in compliance should be judged by whether it improves what a bank can detect,” said Abhishek Chatterjee, founder of Tookitaki.
Real-Time Fraud Defense at the Payment Layer
At the payment infrastructure level, SwiftPay launched SwiftGuard in July 2026, a real-time fraud detection system designed for banks and e-wallet providers. SwiftGuard evaluates transactions against five parameters—transaction velocity, device or account changes, location, blocklists, and unusual user behavior—and recommends whether a payment should be approved, stopped, or held for review. The system already serves VBank, Netbank, and AgriBank. SwiftGuard’s launch aligns with BSP requirements for immediate fraud defense, reflecting a regulatory shift toward real-time intervention rather than after-the-fact investigation.
The Regulatory Push for Shared Responsibility
The BSP’s Memorandum M-2026-034, issued in July 2026, recommends that supervised institutions discontinue SMS- and password-based authentication for administrative and privileged access, replacing them with hardware-based multi-factor authentication. While the measure targets internal systems rather than customer logins, it signals a broader regulatory philosophy: security is not a product feature but a systemic requirement. The missing piece—a centralized fraud database and cross-sector intelligence-sharing mechanism—remains a work in progress. Until it materializes, Philippine banks will continue to build impressive walls around their own perimeters, even as fraudsters find the doors between them.
