GCash has introduced a Security Center within its app, giving users a centralized hub to manage security settings and safeguard their funds against cyberattackers.

The new feature aligns with the Anti-Financial Account Scamming Act and is designed to keep users protected from growing cyberthreats by helping customers respond faster to risks, strengthen account protection, and easily access key security tools. The launch also follows the e-wallet's shift to in-app one-time passwords under the same law. That law, Republic Act No. 12010, was signed in December 2024 and penalizes money-mule activity as well as social engineering schemes such as phishing, with the Bangko Sentral ng Pilipinas serving as its lead implementing regulator.

The stakes are considerable: GCash, operated by Globe Telecom-backed Mynt, is the Philippines' dominant e-wallet with more than 90 million registered users, meaning consumer-side safeguards of this kind reach a broad share of the country's digital-finance users.

"The Security Center is part of our broader commitment to protect our users by giving them clearer visibility and control over their accounts. By making these tools simple and easy to use, we empower customers to take action and better protect their accounts and funds," GCash Chief Information Officer Miguel Geronilla said in a statement.

At the core of the hub is a Lock My Account feature, enabled through the app's AI-powered digital assistant Gigi, which allows users to immediately freeze their account, block all outgoing transactions, and unlock the account afterward. In cases of unusual activity or a possible scam, users can deploy it to prevent unauthorized transfers or changes to account information.

The feature can be activated from inside the GCash app through the Security Center and even from outside the app, ensuring account suspension in case the device is stolen or compromised.

"Once activated, the Kill Switch logs the user out of all active sessions, blocks all outgoing transactions, and restricts any changes to account information, all at the account level, not just at the device level," the company said.

The central bank has repeatedly flagged phishing and other social engineering schemes as among the most common tactics behind unauthorized transactions, which is the type of scenario the account-level freeze is built to interrupt.

To reactivate, users must file a request through Gigi and complete an authentication process that includes Double Safe multi-factor authentication and additional verification steps. Double Safe is a face-verification layer GCash introduced in 2023 amid a wave of account-takeover complaints linked to phishing. "This ensures that the account cannot be unlocked by anyone using stolen credentials alone," it said.

A Subscription Center page, meanwhile, lets users see where their GCash account is linked and revoke permissions as needed, helping them manage recurring payments. Users can unlink a merchant if they notice an unexpected charge. However, requests to reverse or refund charges that have already been processed must be made directly with the merchant, and GCash can provide transaction records and other documentation to help substantiate the refund request.

Another new feature in the hub is Money Lock, which allows users to secure a portion of their wallet funds through GSave. These funds are kept within the GSave environment for safekeeping and are not available for everyday GCash transactions until they are unlocked. GSave is the e-wallet's savings feature, offered in partnership with partner banks.

The Security Center also consolidates existing tools such as device management, authentication settings, and in-app security education resources. As the Bangko Sentral ng Pilipinas continues to implement the Anti-Financial Account Scamming Act, how widely users adopt these controls — and whether other wallets and banks roll out comparable hubs — will be among the markers to watch in the next phase of the law's rollout.

— A.M.C. Sy