34 verified answers · 51 sources · rebuilt
Ask a security question.
Short answers first, in 60 words or fewer. Primary sources, a named verifier and a date on every one.
Try: sim swap passkeys FCC KEV due date
Popular questions #
- Is SMS OTP still allowed under NIST SP 800-63-4?Yes, with conditions.
- What is a SIM swap attack?A SIM swap is when a criminal gets a mobile carrier to move a victim’s phone number to a SIM or eSIM they control, by impersonating the customer, bribing an insider or taking over the carrier account.
- Are synced passkeys phishing-resistant?Yes.
- Which countries are banning SMS OTP for banking?Singapore, Malaysia, the UAE and the Philippines have ordered banks off SMS or email codes for some or all transactions since 2022.
- What does the FCC SIM swap rule require?The FCC’s 2023 order, FCC 23-95, requires US wireless carriers to authenticate customers securely before moving their number to a new SIM or carrier, to notify customers of SIM-change and port-out requests, to offer account locks, and to train staff and keep records.
- What is an OTP bot?An OTP bot is an automated calling or messaging service that impersonates a bank or other service and persuades the victim to read out or type in a one-time passcode, which the criminal uses at the same moment to log in or approve a payment.
Browse by domain #
Authentication, passkeys, SIM swap and carrier-based verification: how people prove who they are, and how attackers get around it.
Account takeover, OTP bots and authorized push payment scams, and the controls that stop them.
Exploited vulnerabilities and patch deadlines, answered from CISA's Known Exploited Vulnerabilities catalog.
What NIST, the FCC, the FFIEC and central banks require, with dates and the primary document for each.
Compare #
Recently verified #
| Verified | Page | Type | Revision |
|---|---|---|---|
| Which vendors have the most CISA KEV entries? | Question | Rev. 1 | |
| Which countries are banning SMS OTP for banking? | Question | Rev. 2 | |
| What is the CISA KEV catalog? | Question | Rev. 1 | |
| What is phishing-resistant MFA? | Question | Rev. 1 | |
| What does “restricted authenticator” mean in NIST SP 800-63B-4? | Question | Rev. 1 | |
| What does the due date in the CISA KEV catalog mean? | Question | Rev. 1 | |
| TOTP vs push notifications | Comparison | Rev. 1 | |
| Synced vs device-bound passkeys | Comparison | Rev. 1 |
How an answer is built #
Answer first
The first 60 words answer the question on their own, so they can be quoted.
Evidence, numbered
Every claim links to a numbered source, and primary documents are marked.
Verified and dated
A named verifier re-checks the sources on a fixed schedule; every change is logged.