They say Maya cybersecurity is the product, but BSP Circular 1213 has made much of that the minimum while scammers move to e-wallets.
The Bottom Line
- Maya documents its card controls on its own pages, but BSP Circular 1213 now requires in-scope platforms to offer a kill switch, a money lock and customizable limits.
- A rotating CVV and card freezes protect card details. They do not stop a customer who is talked into approving a transfer.
- In 2026, 73 percent of scam victims who lost money said scammers were paid through e-wallets, up from 34 percent in 2025.
- Just over a tenth of victims recovered their losses, and HemosPH found no published Maya recovery rate.
Maya cybersecurity is now central to how the company pitches itself. At the BusinessWorld Cybersecurity Summit, Maya corporate affairs head Kristoffer Rada said security is “part of the product,” according to Milyonaryo’s coverage. Information security director Jan Martin Encina argued it is a business responsibility, not only an IT one.
The pitch arrives as scammers follow Filipinos into the apps they use to save, borrow and transfer money. The Global Anti-Scam Alliance’s State of Scams Philippines 2026 report, produced with Mastercard and Gogolook, estimates Filipinos lost P121.8 billion to scams in a year. It extrapolates from a survey of 1,160 adults, so treat the figure as an estimate. The direction is clear enough. Some 84 percent of adults met at least one scam attempt, up from 77 percent in 2025, and nearly a third reported losing trust in digital platforms.
That is the market Maya is selling digital finance security into. The open question is whether its controls are an edge or an entry fee.
Maya Cybersecurity Features and What They Cover
Maya’s own pages lay out the controls. Credit card holders can freeze or block a card in the app, set spending limits, and switch online, foreign and chip payments on or off. The Maya Black and Landers Cashback Everywhere credit cards carry a dynamic CVV, a rotating code viewed inside the app. Maya’s pages describe how long that code lasts in different ways, from 24 hours to a fresh code with each use, so the exact mechanism needs the company’s confirmation. Maya also cites biometric login and AI-driven fraud monitoring.
All of this is Maya’s own description. HemosPH found no independent test of these Maya cybersecurity controls, and the dynamic CVV is documented for credit cards only.
BSP Circular 1213 Sets the Baseline
The regulator moved first. BSP Circular 1213, issued on May 30, 2025 to implement the Anti-Financial Account Scamming Act, amended the IT risk rules for banks, non-bank institutions and payment systems. Institutions had one year from the circular’s effectivity to comply, which put the deadline in June 2026.
The circular requires digital platforms handling retail interbank transfers and other high-risk transactions to offer four customer tools. These are a self-service kill switch that suspends an account, a way to revoke access for trusted devices and third-party apps, a money lock that makes part of a balance unavailable for digital transfers, and customizable transaction limits. It also calls for a 24-hour pause on transactions after a change to a mobile number, email address or registered device, real-time descriptive notifications, and a way for customers to verify a recipient before sending. Operators averaging P75 million or more in monthly network transactions must run a full fraud management system built on five mandatory rules. Institutions that fail these duties may be liable for fraud losses.
Controls of this kind are no longer a differentiator. Providers in scope owe them to every customer, so a Maya cybersecurity pitch built on kill switches and limits is a pitch built on compliance. The circular’s text does not mention dynamic CVV, and that is where Maya’s card design goes beyond the minimum.
E-Wallet Scams Test the Pitch
A rotating CVV protects copied card details. It does nothing for a customer who personally approves a transfer to a scammer, because that customer passes every check. The GASA report found that 73 percent of respondents who lost money said fraudsters were paid through e-wallets, up from 34 percent a year earlier.
The circular’s tools aimed at this problem are recipient verification, transaction pauses and behavioral fraud detection. HemosPH found no public detail on how Maya implements them and did not verify compliance with each requirement. GASA also reported that banks and telcos were slow to alert victims.
Maya’s executives asked at the summit for rules flexible enough to keep pace with technology and for closer coordination among institutions, regulators and law enforcement. The ask concedes that no single provider’s controls can close the problem alone.
Maya has a defensible claim to designing security into its products, mostly at the card level. The account protections that matter most against e-wallet scams are now a regulatory floor for everyone in scope, which turns the contest into execution: how fast alerts fire, how quickly suspicious funds are held and how much victims get back. Just over a tenth of victims recovered their losses, and Maya has not published a recovery rate HemosPH could find. That number, more than any feature list, will show whether the trust behind Maya cybersecurity messaging is earned.
Monitor the systems, tools, and digital infrastructure decisions redefining competitive advantage in the Tech section of Hemos PH.
