As Filipinos increasingly rely on apps to move, save, borrow and manage money, cybersecurity is becoming more visible in the financial experience itself—from the controls customers can use directly, to the systems and policies designed to keep services running when threats emerge.
At the recent BusinessWorld Cybersecurity Summit, Maya executives said this shift is changing not only how financial institutions approach security, but also what customers should expect and how regulation needs to evolve.
Maya has increasingly put security controls directly in customers’ hands. Through its in-app security features, users can immediately freeze or unfreeze cards and manage how they are used, while biometric authentication, fraud monitoring and other safeguards operate in the background. Maya credit cards also use dynamic CVVs, adding another layer of protection for online transactions.
Maya also works closely with regulators and law-enforcement agencies, including the Bangko Sentral ng Pilipinas (BSP), the Department of Information and Communications Technology (DICT)’s Cybercrime Investigation and Coordinating Center (CICC), the Department of Justice (DOJ) and the Philippine National Police (PNP).
For Kristoffer Rada, Head of Corporate Affairs at Maya, these developments reflect a broader change in the relationship between cybersecurity and consumer trust.
“For us in Maya, cybersecurity is not some back-office product, it’s really part of the product,” Rada said. “As more people depend on digital financial services every day, maintaining trust becomes a responsibility shared by financial institutions, regulators, government and the broader ecosystem.”
Rada said effective cybersecurity policy increasingly has to balance strong safeguards and institutional accountability with the ability to respond to technologies and risks that are changing rapidly.
The focus, he said, should extend beyond compliance with individual rules toward outcomes such as protecting customers, maintaining continuity of service, strengthening accountability, and ensuring institutions are prepared to respond and recover when incidents occur.
“Technology evolves so fast. The rules that apply this year may no longer be applicable and could become archaic in five years,” Rada said. “Whatever technology evolves, you have to evaluate using the same standard because the risks are the same.”
Technology-neutral and risk-based standards can help regulation remain relevant, he said, but they need to be accompanied by closer coordination across government and industry.
Cyber risks increasingly cut across banking supervision, data privacy, telecommunications, consumer protection and law enforcement. Rada said this makes timely information sharing, coordinated scam prevention and clear regulatory expectations increasingly important.
“Cyber threats do not stop at the boundaries of one company, one regulator or one country,” he said. “The stronger the coordination across the ecosystem, the better we can protect customers and maintain confidence in digital services.”
Building resilience inside the enterprise
Jan Martin Encina, Director of Information Security at Maya, meanwhile, said organizations need to treat cybersecurity as an enterprise-wide responsibility rather than something owned solely by IT teams.
“Cybersecurity is no longer just an IT issue; it is a business imperative, a national security priority and a fundamental component of public trust,” Encina said.
He said strong cyber resilience requires organizations to move from reactive defenses toward continuous monitoring, stronger identity and access management, resilient infrastructure, regular security testing, and well-established incident-response capabilities.
People are another critical part of that defense. Sustained employee awareness and customer education remain important as cybercriminals increasingly combine technology with social engineering and other tactics that exploit human behavior.
Encina also stressed the value of public-private partnerships, cross-border cooperation and threat-information sharing as attacks become more sophisticated and interconnected.
“Ensuring that personal data is collected, stored and processed responsibly is not only a regulatory requirement, but also a moral obligation to the citizens and customers we serve,” he said.
For Maya, cybersecurity increasingly operates on several fronts at once: giving customers more control, strengthening defenses behind the scenes, preparing institutions to remain resilient, and building a regulatory environment that can respond as technologies and threats evolve.
