CIMB Mandates Biometrics for SecureTAC Approvals Starting 19 September

CIMB Bank has announced that it will officially discontinue the use of passwords for SecureTAC approvals on both the CIMB Clicks Web platform and online merchant transactions starting 19 September 2026. This transition mandates that all web-based transfers and online card payments be authenticated exclusively through the CIMB OCTO mobile app, marking a significant shift in the bank's digital security architecture.

Under the new policy, users will no longer have the option to rely on traditional account passwords when verifying transactions. Instead, identity verification must be performed using biometric methods, such as Face ID or fingerprint scanning, or through the user’s registered six-digit OCTO App passcode. According to the original publisher, this update is intended to fortify account security and provide a more robust defense against unauthorized access and potential fraudulent activity.

The mechanics of the new process remain tied to the user's registered mobile device. When a customer initiates a payment on Clicks Web or an external merchant site, the system will trigger a SecureTAC push notification directly to the primary phone associated with the account. Users will be required to either tap this notification or manually navigate to the SecureTAC menu within the OCTO app to authorize the transaction using their chosen biometric or passcode method.

This security update primarily impacts Malaysian consumers who frequently utilize web browsers for banking or e-commerce. For the average retail customer, this transition necessitates ensuring that the CIMB OCTO app is installed, updated, and correctly configured on their primary mobile device. Failure to finalize the setup of biometrics or a six-digit passcode will effectively prevent users from completing online transactions once the deadline passes.

For Malaysian SMEs and business owners, this change represents a shift in operational workflow for online payments. As more banking institutions move away from static passwords, businesses that rely on Clicks Web for vendor payments or payroll management must ensure their staff are prepared for this mandatory mobile-first authentication process. It reflects an evolving digital environment where convenience is increasingly being balanced against the risk of phishing and credential theft.

This move aligns with broader efforts within the Malaysian financial sector to tighten security protocols amid a digital-first economy. As the nation experiences a real GDP growth rate of 6.0% year-on-year, the digital banking sector is seeing increased transaction volumes, making the protection of these accounts a top priority for regulators and institutions alike. By centralizing authentication on a single mobile device, CIMB is aiming to minimize the risks associated with password-based authentication, which has historically been more susceptible to compromise.

The transition also arrives at a time of shifting economic dynamics, where consumers are navigating a headline inflation rate of 1.8% year-on-year as of July 2026. With costs rising, securing digital assets has become an essential component of financial management for the 3.0% of the population currently unemployed, who may be more vulnerable to financial fraud or account takeovers. Banks are under sustained pressure to minimize security gaps that could lead to consumer losses, and the retirement of traditional passwords is a logical step toward more secure, hardware-linked verification.

While the bank has clarified the mechanics of the transition, several details remain unconfirmed. For instance, the bank has not disclosed if there will be a grace period for users who experience technical difficulties with biometric authentication on the day of the rollout, or how account recovery will be handled for those who lose access to their primary mobile device after the password requirement is removed.