CIMB will require customers to use biometric authentication or their device passcode when approving SecureTAC requests for transactions made through CIMB Clicks Web and merchant websites from 19 September 2026. The change means passwords will no longer be supported as an authentication method for these approvals.
Customers can authenticate SecureTAC requests using Face ID, fingerprint or their device passcode through the CIMB OCTO app. When a transaction is initiated on CIMB Clicks Web or a merchant website, a SecureTAC notification will be sent to the primary device linked to the app, where users can review the transaction details before choosing to approve or reject it.
If the transaction is approved, users will then need to verify their identity using one of the supported biometric methods or their device passcode. CIMB said customers who have not enabled any of these authentication methods will receive an error message and will need to set one up before retrying the transaction.
This latest change follows CIMB’s introduction of mandatory SecureTAC approvals for selected transactions made through CIMB Clicks Web and merchant websites in January 2026. At the time, customers could authenticate these requests using biometrics, their device passcode or their CIMB OCTO app password.
The bank has now removed the password option, leaving biometric authentication and device passcodes as the only methods supported from 19 September onwards. CIMB’s current notice also states that the requirement will apply to all transactions made through CIMB Clicks Web and merchant websites, rather than referring to them as only selected transactions as in its earlier announcement.
CIMB recommends that customers ensure Face ID, fingerprint or a device passcode is enabled on their primary device and available for use with the CIMB OCTO app before the new requirement takes effect. The bank also states that a failed SecureTAC approval will not suspend a customer’s Clicks ID, and no funds will be deducted when an approval fails.
(Source: CIMB [official notice])
