Effective June 25, 2026, all transactions on My CBC will be verified using Passkey, replacing SMS One-Time Passwords (OTPs).
General Questions
What is Passkey?
Passkey is a new authentication method in My CBC mobile app that replaces SMS OTP codesfor financial transactions. Instead of waiting for SMS codes, customers use their fingerprint,face recognition, or device PIN to authenticate transactions.
Key Benefits:
- Faster: around 3 seconds vs 30-60 seconds for SMS
- More Secure: Resistant to phishing, SIM swap, interception
- Easier: No typing codes, no waiting for SMS
- Compliant: Meets BSP Circular 2025 1213 requirements
Why is Passkey safer?
SMS OTP has served us well, but scammers have gotten smarter. SMS codes can be stolen in three main ways: fake websites, SIM swap, and social engineering. Passkeys eliminate all three because they're locked to your device and only work on the real My CBC app.
Safer than SMS codes because:
- Can't be phished: Passkeys only work on the official My CBC app, never on fake apps
- Can't be stolen: Your Passkey never leaves your device
- Protected by your device: Secured by your iPhone's Secure Enclave or Android's secure hardware
- Industry standard: Uses FIDO2 technology, trusted by major tech companies worldwide
ℹ️Passkeys are cryptographic key pairs. The key pair is specific to My CBC app. One half is shared with My CBC, and the other half is private and stored on your device or in your password manager.
Passkeys are strong enough to never be guessed or reused, making them safe from hacker attempts.
Passkeys are connected to the app they were created for, so you can never be tricked into using your passkey to sign in to a fraudulent app or website.
What is a Password Manager?
A password manager is a secure digital vault built into your phone that safely stores your Passkeys. Think of it like a locked safe that only you can open with your fingerprint or face.
For iPhone users:
Your password manager is called Passwords (iCloud Keychain). It's the same place where Safari saves your website passwords. Apple built it into every iPhone - you already have it.
For Android users:
Your password manager is called Google Password Manager. It's the same place where Chrome saves your website passwords. Google built it into every Android phone - you already have it.
Other devices, i.e. Samsung may also have a default password manager, Samsung Pass. For thebest experience, we recommend using Google Password Manager as your default password manager.
Mandatory Passkey Enrollment
Passkey has been mandatory for My CBC since June 25, 2026. After logging in to My CBC,you will be prompted and required to create a passkey.
Before setting up your passkey, please ensure that:
1. Your device has a screen lock enabled (PIN, password, pattern, or biometrics).
2. For Android users:
- Install and open Passwords (Google Password Manager) if it is not already available.
- Sign in with your Google account.
- Set Google Password Manager as your default password manager.
3. For iOS users:
- Ensure the built-in Passwords app (iCloud Keychain) is enabled.
Once these prerequisites are met, you can proceed with creating your passkey.
Why is Passkey becoming mandatory?
Passkeys are becoming mandatory for two important reasons:
Regulatory Requirement: The Bangko Sentral ng Pilipinas (BSP) Circular 2025 1213 requires stronger authentication methods.
Your Protection: Passkeys protect you from SMS-based scams, which are increasing. By making Passkeys mandatory, we're ensuring all our customers have the strongest protection available.
Will I still use my password?
Yes, you'll still use your password to log in to My CBC. For now, Passkeys replace SMS OTP codes for financial transaction authentications only.
What if I don’t want to use a Passkey?
Passkey is now mandatory for all My CBC users. To continue using the app, you will need tocreate a passkey. This helps protect your account and ensures compliance with securityrequirements.
Register Passkey
How do I register/ set-up my Passkey?
Setting up a Passkey is easy and takes less than a minute:
- Open My CBC and log in using your password or biometrics
- A “Passkey Announcement” pop-up up will appear OR Go to More → Security → Passkey
- Tap "Create Passkey"
- Read about how Passkeys work (optional)
- Enter the SMS code we send to verify your phone number
- Use your fingerprint, face, or PIN when prompted
- Done! Your Passkey is now active
What devices are compatible with Passkey?
For iPhone:
iPhone running iOS 16 or later.
Your device must have Passwords (iCloud Keychain) enabled
For Android:
Android version 12 or later.
Google Mobile Services (GMS) must be installed.
Google Password Manager enabled
ℹ️ If your device doesn't support passkeys, don't worry - you will not see the “PasskeyAnnouncement” pop-up and the “Passkey” menu from Security. You can continue usingSMS OTP with your biometrics or MPIN as before.
Setting-up a screen lock?
To protect your password manager, you should always enable a screen lock (biometrics, or passcode or PIN) on your device. This prevents unauthorized access if your device is lost or unattended.
Most password managers will prompt you to set up a screen lock if one is not already enabled.
Where is my Passkey stored?
Your Passkey is securely stored in your device's password manager
iPhone: iCloud Keychain (the same place your passwords are stored)
Android: Google Password Manager
ℹ️ These are protected by your device's secure hardware and your biometric authentication.Even we at Chinabank cannot access your passkey - it stays private on your device.
⚠️ Do not delete your passkey from your password manager. (unless its needed)
Using Your Passkey
When will l use my Passkey?
You’ll use Passkey to authenticate financial transactions:
- Transfer to CBC
- Transfer to CBS
- Instapay
- PesoNet
- Bills Pay
- Remittance
- QR P2P
- Qr P2M
How do I use my Passkey for financial transactions?
- Initiate your transaction as usual (e.g., Instapay, Bills Pay)
- Review transaction details
- When prompted, use your fingerprint, face, or PIN to authenticate
- Done! Your transaction is confirmed
What If my Passkey authentication failed?
If authentication doesn't work: Try again
If it still fails, call our Customer Contact Center
Common reasons for failure:
- You cancelled the authentication prompt
- You may have deleted your Passkey from your password manager
- Your biometric reading didn't work
- Your device ran into a temporary issue
Managing Your Passkey
How do I check if I have a Passkey registered?
- Open My CBC app
- Login using your biometrics or password
- Go to More → Security → Passkey
- If you see "Your Passkey is already registered" with a creation date, you have one set up
- If you see "Create Passkey", you haven't set one up yet
Can I delete my Passkey?
While you can delete your Passkey from your Password Manager, we do not recommend you do it.
What If I deleted my Passkey accidentally?
If you accidentally delete your Passkey, please contact our Customer Contact Center. They will reset your Passkey in our system and guide you through creating a new one.
I got a new phone, can I transfer my Passkey to my new device?
Your My CBC Passkey cannot be transferred to another device. Please contact our Customer Contact Center, where a device and Passkey reset will be performed, and you will be guided through.
Troubleshooting
Why can’t I create Passkey?
Common reasons:
- Your device must support Passkeys:
Your iPhone needs iOS 16 or later, or
Your Android needs version 12 or later
Solution: Update your device to the latest supported version.
- Google Mobile Services (GMS) is required (Android only):
Passkeys on Android require Google Mobile Services (GMS).
Solution: Use a device with GMS installed
How to enable Google Mobile Services (GMS)
If your phone is supposed to have GMS but the apps have been accidentally disabled:
1. Open Settings.
2. Tap Apps or Apps & notifications.
3. Tap See all apps and search for Google Play Services.
4. If the app is disabled, tap Enable.
- A temporary technical issue occurred
A temporary system or network issue may be preventing passkey creation.
Solution: Try again later or contact our helpdesk
- You are using a different password manager
Passkey creation is only supported with the recommended password managers:
Android: Google Password Manager (Passwords)
iPhone: Built-in Passwords app
Solution: Switch to the recommended password manager and try again.
- Google Password Manager is not set as the default (Android only)
If another password manager is set as the default, passkey creation may fail.
Solution: Set Google Password Manager as your default password manager.
How to set Google Password Manager as the default:
1. Open Settings.
2. Search for and tap Passwords, Passkeys & Accounts or Autofill service.
3. Under Preferred service, tap Change or your current autofill provider.
4. Select Google from the list.
5. Tap OK to confirm.
- The iOS Passwords app is not enabled or available (iPhone only)
The built-in Passwords app must be enabled and active to create and save passkeys.
How to check the Passwords app:
1. Look for the Passwords app (identified by a key icon) on your Home Screen or in the App Library.
2. The app lets you view, edit, and manage passwords, passkeys, and verification codes.
3. If you cannot find the app, download it from the Apple App Store, then ensure it is enabled before creating your passkey.
Why is my Passkey authentication not working?
Check these options:
- Make sure your biometrics are set up on your device
- Check your fingerprint/face is clean and clearly visible
- Restart the My CBC app and try again
- Your password manager is disabled, check your device settings
- You may have accidentally deleted your Passkey, please call our Customer Contact Center
Security & Privacy
What if my phone was stolen?
Your Passkey is protected even if your phone is stolen:
- Biometric lock: Thieves can't use your fingerprint or face
- Device PIN: Even if they know your PIN, they need your My CBC password or your biometrics
- Report it immediately: Call us immediately at Customer Contact Center Hotline to lock your account
For extra protection:
- Enable remote wipe on your device
- Use a strong device lock (fingerprint/face/PIN)
- Never share your My CBC password
