Quick answer
You can protect either wallet with the same set of habits, and most of them cost nothing. Keep your MPIN private and different from your other PINs, never share a one-time password, install apps only from official stores, lock your phone, protect your SIM, and review your activity regularly. The same list works for GCash and for Maya because account takeovers usually start with a stolen code or a stolen phone, not with a flaw in one brand. Use this checklist, last reviewed November 9, 2026, and look in each app's own settings for extra options such as biometric login if your phone supports them.
Start with the phone, not the app
An e-wallet is only as safe as the device it runs on. If someone can unlock your phone, read your messages and open your apps, a strong MPIN is the only barrier left. So begin with the phone.
- Set a screen lock that is hard to guess and not the same as your MPIN.
- Keep the operating system and the apps updated.
- Download wallet apps only from the official app store for your phone.
- Do not install apps from links sent in messages, and do not use modified versions of apps.
- Turn off previews of message contents on the lock screen if your phone allows it, because login codes can arrive by text.
Protect your number and SIM
Many login and verification steps send a code to your mobile number. That makes your SIM part of your security. Keep your SIM from being swapped by being careful about who has your personal details, and report a lost phone or lost SIM to your network provider right away. Smart and Maya warned customers in October 2024 about text-hijacking scams, which show why messages in your inbox are not proof of who sent them.
MPIN and password habits
- Choose an MPIN that is not a birthday, a repeated digit or a simple sequence.
- Do not reuse the MPIN as a bank PIN or a phone unlock code.
- Never write the MPIN in your notes app, in a photo or in a message.
- Change it if you ever suspect someone saw it.
- Do not let anyone enter it for you, including a friend helping at a store.
One-time passwords
A one-time password exists to confirm that it is you. GCash has publicly stated that nobody from the service will ask for your OTP, MPIN or password. Treat that as a rule for every app. If a caller, a chat contact or a message asks you to read out a code, stop. The scam safety guide explains the common stories scammers use to make this feel normal.
Use the extra protections your app offers
Both apps add security features over time, and the names and options change. Look inside each app's security or settings section and turn on what is available and sensible for you, for example biometric login or device-based verification, if your phone supports it. Do not rely on a blog to tell you which features exist today. The app's own help pages are the source.
Keep your sessions clean
- Log out on any device you do not own.
- Avoid public Wi-Fi for financial tasks when you can use mobile data.
- Do not save logins on shared computers.
- Close the app when you hand your phone to someone else.
- Remove old devices you no longer use from your account if the app lists them.
A monthly review routine
Set a reminder and spend five minutes on this routine each month.
- Open recent activity in each app and look for anything you do not recognize.
- Check linked cards, bank accounts and other connected services.
- Confirm your mobile number, email and recovery options are current.
- Update the app and your phone.
- Clean up screenshots that contain account numbers or codes.
- Review how much money sits in the wallet and move extra to a place you prefer.
What to do if something looks wrong
Open the official app yourself and look at your activity. If you see a transaction you did not make, change your MPIN or password and use the in-app Help Center to report it, with screenshots. Do not call numbers or follow links from messages. If you shared a code, follow the steps in the scam safety guide.
Does one app need a different checklist?
The basics are the same, and the details differ only in menu names and in the optional features each app offers at a given time. If you use both apps, apply the same habits to both and keep the balance in each at a level you can afford to lose while you are protecting it. The use-both guide explains how to keep that simple.
What this guide does not do
It does not promise that following the checklist prevents every loss, and it is not legal or financial advice. Security features and provider policies change, so rely on the official in-app help for the current options.
Questions readers often ask
How often should I review these settings? A quick review every few months, and after you change phones or numbers, keeps the checklist useful.
What if I lose my phone? Use the official support channel from another device, request that the account be secured, and contact your mobile network about the SIM. Keep your account details somewhere safe for exactly this case.
Is a longer MPIN safer? Choose one that is hard to guess and not reused anywhere else. Avoid birthdays and simple sequences.