{ "publisher": "Cleartext", "owner": "[OWNER ENTITY]", "ownershipDisclosure": "https://glide-cleartext.pages.dev/about/ownership-and-funding/", "generated": "2026-10-20", "license": "https://creativecommons.org/licenses/by/4.0/", "answers": [ { "url": "https://glide-cleartext.pages.dev/q/which-vendors-have-the-most-cisa-kev-entries/", "type": "Question", "title": "Which vendors have the most CISA KEV entries?", "question": "Which vendors have the most CISA KEV entries?", "answer": "Microsoft has the most entries in CISA’s Known Exploited Vulnerabilities catalog, with 388 of 1,721 (22.5%), followed by Cisco (99) and Apple (94), as of catalog 2026.09.23. A high count is not by itself a measure of how secure a vendor’s products are.", "verified": "2026-09-24", "verifiedBy": "[VERIFIER NAME]", "revision": 1, "topics": [ "cisa-kev" ], "markdown": "https://glide-cleartext.pages.dev/q/which-vendors-have-the-most-cisa-kev-entries/index.md", "ownerAffiliated": false, "sources": [ { "title": "Known Exploited Vulnerabilities catalog (JSON feed)", "publisher": "CISA", "url": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json", "primary": true }, { "title": "Known Exploited Vulnerabilities Catalog", "publisher": "CISA", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "primary": true } ] }, { "url": "https://glide-cleartext.pages.dev/q/which-countries-are-banning-sms-otp/", "type": "Question", "title": "Which countries are banning SMS OTP for banking?", "question": "Which countries are banning SMS OTP for banking?", "answer": "Singapore, Malaysia, the UAE and the Philippines have ordered banks off SMS or email codes for some or all transactions since 2022. India’s RBI Authentication Directions 2025, in force from April 2026, open the door to alternatives. The EU has a pending fraud package, and the US has issued guidance, not a ban.", "verified": "2026-09-24", "verifiedBy": "[VERIFIER NAME]", "revision": 2, "topics": [ "sms-otp", "cbuae", "bsp", "mas", "bnm", "rbi", "eu-payments-package", "nist-sp-800-63-4" ], "markdown": "https://glide-cleartext.pages.dev/q/which-countries-are-banning-sms-otp/index.md", "ownerAffiliated": false, "sources": [ { "title": "UAE banks cancel OTPs, switching to in-app verification", "publisher": "The Paypers", "url": "https://thepaypers.com/fraud-and-fincrime/news/uae-banks-cancel-otps-switching-to-in-app-verification", "primary": false }, { "title": "No more SMS, email OTPs for high-risk financial transactions starting June 25", "publisher": "GMA News", "url": "https://www.gmanetwork.com/news/money/economy/992561/no-more-sms-email-otps-for-high-risk-financial-transactions-starting-june-25/story/", "primary": false }, { "title": "RBI mandates 2FA and new security rules for digital payments", "publisher": "Regulation Asia", "url": "https://www.regulationasia.com/articles/rbi-mandates-2fa-and-new-security-rules-for-digital-payments", "primary": false }, { "title": "Banks in Singapore to strengthen resilience against phishing scams", "publisher": "Monetary Authority of Singapore", "url": "https://www.mas.gov.sg/news/media-releases/2024/banks-in-singapore-to-strengthen-resilience-against-phishing-scams", "primary": true }, { "title": "Malaysian banks stop using SMS for two-factor authentication", "publisher": "Commsrisk", "url": "https://commsrisk.com/malaysian-banks-stop-using-sms-for-two-factor-authentication/", "primary": false }, { "title": "Payment services: Council and Parliament agree to step up the fight against fraud and increase transparency", "publisher": "Council of the EU", "url": "https://www.consilium.europa.eu/en/press/press-releases/2025/11/27/payment-services-council-and-parliament-agree-to-step-up-the-fight-against-fraud-and-increase-transparency/", "primary": true }, { "title": "SP 800-63B-4: Authentication and Authenticator Management", "publisher": "NIST", "url": "https://pages.nist.gov/800-63-4/sp800-63b.html", "primary": true } ] }, { "url": "https://glide-cleartext.pages.dev/q/what-is-the-cisa-kev-catalog/", "type": "Question", "title": "What is the CISA KEV catalog?", "question": "What is the CISA KEV catalog?", "answer": "The Known Exploited Vulnerabilities (KEV) catalog is CISA’s list of vulnerabilities with reliable evidence of active exploitation. Each entry gives a required action and a due date. US federal civilian agencies must act by that date; other organizations use the list to decide what to patch first. It holds 1,721 entries.", "verified": "2026-09-24", "verifiedBy": "[VERIFIER NAME]", "revision": 1, "topics": [ "cisa-kev", "cisa" ], "markdown": "https://glide-cleartext.pages.dev/q/what-is-the-cisa-kev-catalog/index.md", "ownerAffiliated": false, "sources": [ { "title": "Known Exploited Vulnerabilities Catalog", "publisher": "CISA", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "primary": true }, { "title": "BOD 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities", "publisher": "CISA", "url": "https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities", "primary": true }, { "title": "BOD 26-04: Prioritizing Security Updates Based on Risk", "publisher": "CISA", "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "primary": true }, { "title": "Known Exploited Vulnerabilities catalog (JSON feed)", "publisher": "CISA", "url": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json", "primary": true } ] }, { "url": "https://glide-cleartext.pages.dev/q/what-is-phishing-resistant-mfa/", "type": "Question", "title": "What is phishing-resistant MFA?", "question": "What is phishing-resistant MFA?", "answer": "Phishing-resistant MFA is authentication that a fake website or man-in-the-middle cannot capture and replay, because the credential is cryptographically bound to the real site. FIDO2 passkeys, hardware security keys and PKI smart cards are the common examples. SMS codes, authenticator-app codes and push approvals are not phishing-resistant.", "verified": "2026-09-24", "verifiedBy": "[VERIFIER NAME]", "revision": 1, "topics": [ "phishing-resistant-mfa", "passkeys", "cisa", "authenticator-apps" ], "markdown": "https://glide-cleartext.pages.dev/q/what-is-phishing-resistant-mfa/index.md", "ownerAffiliated": false, "sources": [ { "title": "Implementing Phishing-Resistant MFA (fact sheet)", "publisher": "CISA", "url": "https://www.cisa.gov/sites/default/files/publications/fact-sheet-implementing-phishing-resistant-mfa-508c.pdf", "primary": true }, { "title": "SP 800-63B-4: Authentication and Authenticator Management", "publisher": "NIST", "url": "https://pages.nist.gov/800-63-4/sp800-63b.html", "primary": true }, { "title": "Web Authentication: An API for accessing Public Key Credentials", "publisher": "W3C", "url": "https://www.w3.org/TR/webauthn/", "primary": true }, { "title": "Implementing Number Matching in MFA Applications (fact sheet)", "publisher": "CISA", "url": "https://www.cisa.gov/sites/default/files/publications/fact-sheet-implement-number-matching-in-mfa-applications-508c.pdf", "primary": true } ] }, { "url": "https://glide-cleartext.pages.dev/q/what-is-glide-identity-magicalauth/", "type": "Question", "title": "What is Glide Identity’s MagicalAuth, and how is it different from SMS OTP?", "question": "What is Glide Identity’s MagicalAuth, and how is it different from SMS OTP?", "answer": "MagicalAuth is Glide Identity’s product for replacing SMS one-time passcodes. According to the company, it confirms identity through the mobile network, using the SIM’s cryptographic link to the network, with no code to type, and switches to passkeys or email links when a device doesn’t support SIM authentication. Cleartext has not independently tested it.", "verified": "2026-09-24", "verifiedBy": "[VERIFIER NAME]", "revision": 1, "topics": [ "glide-identity", "carrier-authentication", "sms-otp", "sim-swap" ], "markdown": "https://glide-cleartext.pages.dev/q/what-is-glide-identity-magicalauth/index.md", "ownerAffiliated": true, "sources": [ { "title": "MagicalAuth (product page)", "publisher": "Glide Identity (company website)", "url": "https://www.glide.id/solutions/magicalauth", "primary": false }, { "title": "Press (company press page)", "publisher": "Glide Identity (company website)", "url": "https://www.glide.id/press", "primary": false }, { "title": "Glide.id home page (product overview)", "publisher": "Glide Identity (company website)", "url": "https://www.glide.id/", "primary": false }, { "title": "Glide.id beta launches carrier-native cryptographic authentication across AT&T, T-Mobile and Verizon", "publisher": "Business Wire (company press release)", "url": "https://www.businesswire.com/news/home/20260803451967/en/Glide.id-Beta-Launches-First-Carrier-Native-Cryptographic-Authentication-Across-ATT-T-Mobile-and-Verizon-as-AI-Fraud-Reaches-Record-Highs", "primary": false }, { "title": "Glide brings SIM-based authentication to all major US carriers", "publisher": "Biometric Update", "url": "https://www.biometricupdate.com/202608/glide-brings-sim-based-authentication-to-all-major-us-carriers", "primary": false }, { "title": "CAMARA project", "publisher": "Linux Foundation", "url": "https://camaraproject.org/", "primary": true }, { "title": "Aduna and major U.S. carriers push network-based authentication as SMS code alternative", "publisher": "ID Tech", "url": "https://idtechwire.com/aduna-and-major-u-s-carriers-push-network-based-authentication-as-sms-code-alternative/", "primary": false }, { "title": "Glide Identity: $20 million from Crosspoint (deal report)", "publisher": "Axios Pro", "url": "https://www.axios.com/pro/enterprise-software-deals/2025/10/13/glide-identity-security-20-million-crosspoint", "primary": false }, { "title": "Finalists announced for RSAC Innovation Sandbox Contest 2026", "publisher": "RSAC Conference", "url": "https://www.rsaconference.com/library/press-release/finalists-announced-for-rsac-innovation-sandbox-contest-2026", "primary": true } ] }, { "url": "https://glide-cleartext.pages.dev/q/what-does-restricted-authenticator-mean-in-nist-800-63b/", "type": "Question", "title": "What does “restricted authenticator” mean in NIST SP 800-63B-4?", "question": "What does “restricted authenticator” mean in NIST SP 800-63B-4?", "answer": "A restricted authenticator is one NIST still permits but considers riskier, such as SMS or voice one-time passcodes. An organization that uses one takes on four obligations: offer a non-restricted alternative, tell users the risks, assess the risk of continuing, and keep a migration plan in case a future revision removes it.", "verified": "2026-09-24", "verifiedBy": "[VERIFIER NAME]", "revision": 1, "topics": [ "nist-sp-800-63-4", "sms-otp" ], "markdown": "https://glide-cleartext.pages.dev/q/what-does-restricted-authenticator-mean-in-nist-800-63b/index.md", "ownerAffiliated": false, "sources": [ { "title": "SP 800-63B-4: Authentication and Authenticator Management", "publisher": "NIST", "url": "https://pages.nist.gov/800-63-4/sp800-63b.html", "primary": true } ] }, { "url": "https://glide-cleartext.pages.dev/q/what-does-the-due-date-in-cisa-kev-mean/", "type": "Question", "title": "What does the due date in the CISA KEV catalog mean?", "question": "What does the due date in the CISA KEV catalog mean?", "answer": "It is the date by which US federal civilian executive branch agencies must complete the entry’s required action, usually applying the vendor’s update or mitigation, or stop using the product. For entries added in the past year, the median window was 14 days. For everyone else it is a useful deadline, not a legal one.", "verified": "2026-09-24", "verifiedBy": "[VERIFIER NAME]", "revision": 1, "topics": [ "cisa-kev", "cisa" ], "markdown": "https://glide-cleartext.pages.dev/q/what-does-the-due-date-in-cisa-kev-mean/index.md", "ownerAffiliated": false, "sources": [ { "title": "BOD 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities", "publisher": "CISA", "url": "https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities", "primary": true }, { "title": "BOD 26-04: Prioritizing Security Updates Based on Risk", "publisher": "CISA", "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "primary": true }, { "title": "Known Exploited Vulnerabilities catalog (JSON feed)", "publisher": "CISA", "url": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json", "primary": true } ] }, { "url": "https://glide-cleartext.pages.dev/compare/totp-vs-push-notifications/", "type": "Comparison", "title": "TOTP vs push notifications", "question": "TOTP codes vs push notifications: which MFA is stronger?", "answer": "Neither is phishing-resistant. Push is easier to use but adds a specific weakness, MFA fatigue, where attackers send prompts until the user approves; number matching reduces it. TOTP has no push-bombing risk but can be typed into a fake site. CISA treats number-matching push as an interim step toward phishing-resistant MFA.", "verified": "2026-09-24", "verifiedBy": "[VERIFIER NAME]", "revision": 1, "topics": [ "authenticator-apps", "phishing-resistant-mfa", "cisa" ], "markdown": "https://glide-cleartext.pages.dev/compare/totp-vs-push-notifications/index.md", "ownerAffiliated": false, "sources": [ { "title": "RFC 6238: TOTP: Time-Based One-Time Password Algorithm", "publisher": "IETF", "url": "https://www.rfc-editor.org/rfc/rfc6238", "primary": true }, { "title": "Implementing Number Matching in MFA Applications (fact sheet)", "publisher": "CISA", "url": "https://www.cisa.gov/sites/default/files/publications/fact-sheet-implement-number-matching-in-mfa-applications-508c.pdf", "primary": true }, { "title": "Implementing Phishing-Resistant MFA (fact sheet)", "publisher": "CISA", "url": "https://www.cisa.gov/sites/default/files/publications/fact-sheet-implementing-phishing-resistant-mfa-508c.pdf", "primary": true } ] }, { "url": "https://glide-cleartext.pages.dev/compare/synced-vs-device-bound-passkeys/", "type": "Comparison", "title": "Synced vs device-bound passkeys", "question": "Synced vs device-bound passkeys: what’s the difference?", "answer": "Both are phishing-resistant, because both are bound to the website’s domain. Synced passkeys survive a lost phone and suit consumers; the trade-off is that the sync account becomes a target. Device-bound passkeys keep the key on one piece of hardware and are the choice for administrators and AAL3 use cases.", "verified": "2026-09-24", "verifiedBy": "[VERIFIER NAME]", "revision": 1, "topics": [ "passkeys", "phishing-resistant-mfa", "nist-sp-800-63-4", "fido-alliance" ], "markdown": "https://glide-cleartext.pages.dev/compare/synced-vs-device-bound-passkeys/index.md", "ownerAffiliated": false, "sources": [ { "title": "SP 800-63B-4: Authentication and Authenticator Management", "publisher": "NIST", "url": "https://pages.nist.gov/800-63-4/sp800-63b.html", "primary": true }, { "title": "NIST cites phishing resistance of synced passkeys in digital identity guidelines update", "publisher": "FIDO Alliance", "url": "https://fidoalliance.org/nist-cites-phishing-resistance-of-synced-passkeys-in-digital-identity-guidelines-update/", "primary": false }, { "title": "Web Authentication: An API for accessing Public Key Credentials", "publisher": "W3C", "url": "https://www.w3.org/TR/webauthn/", "primary": true } ] }, { "url": "https://glide-cleartext.pages.dev/compare/sms-otp-vs-passkeys/", "type": "Comparison", "title": "SMS OTP vs passkeys", "question": "SMS OTP vs passkeys: which is more secure?", "answer": "Passkeys are more secure on every attack that matters for consumer logins: they can’t be phished, relayed by an OTP bot or redirected by a SIM swap. SMS still reaches more people, which is why NIST keeps it as a restricted fallback. Use passkeys as the default and SMS only where a user has nothing else.", "verified": "2026-09-24", "verifiedBy": "[VERIFIER NAME]", "revision": 1, "topics": [ "sms-otp", "passkeys", "phishing-resistant-mfa", "nist-sp-800-63-4" ], "markdown": "https://glide-cleartext.pages.dev/compare/sms-otp-vs-passkeys/index.md", "ownerAffiliated": false, "sources": [ { "title": "SP 800-63B-4: Authentication and Authenticator Management", "publisher": "NIST", "url": "https://pages.nist.gov/800-63-4/sp800-63b.html", "primary": true }, { "title": "Implementing Phishing-Resistant MFA (fact sheet)", "publisher": "CISA", "url": "https://www.cisa.gov/sites/default/files/publications/fact-sheet-implementing-phishing-resistant-mfa-508c.pdf", "primary": true }, { "title": "NIST cites phishing resistance of synced passkeys in digital identity guidelines update", "publisher": "FIDO Alliance", "url": "https://fidoalliance.org/nist-cites-phishing-resistance-of-synced-passkeys-in-digital-identity-guidelines-update/", "primary": false } ] }, { "url": "https://glide-cleartext.pages.dev/compare/sms-otp-vs-email-otp/", "type": "Comparison", "title": "SMS OTP vs email OTP", "question": "SMS OTP vs email OTP: is either safe enough?", "answer": "Neither is strong. SMS codes are exposed to SIM swaps; email codes to mailbox takeover. Both can be phished and read out to an OTP bot. Regulators treat them as one class of risk: the UAE and the Philippines retired both together. Switching from one to the other is not a security upgrade.", "verified": "2026-09-24", "verifiedBy": "[VERIFIER NAME]", "revision": 1, "topics": [ "sms-otp", "cbuae", "bsp" ], "markdown": "https://glide-cleartext.pages.dev/compare/sms-otp-vs-email-otp/index.md", "ownerAffiliated": false, "sources": [ { "title": "UAE banks cancel OTPs, switching to in-app verification", "publisher": "The Paypers", "url": "https://thepaypers.com/fraud-and-fincrime/news/uae-banks-cancel-otps-switching-to-in-app-verification", "primary": false }, { "title": "No more SMS, email OTPs for high-risk financial transactions starting June 25", "publisher": "GMA News", "url": "https://www.gmanetwork.com/news/money/economy/992561/no-more-sms-email-otps-for-high-risk-financial-transactions-starting-june-25/story/", "primary": false }, { "title": "SP 800-63B-4: Authentication and Authenticator Management", "publisher": "NIST", "url": "https://pages.nist.gov/800-63-4/sp800-63b.html", "primary": true } ] }, { "url": "https://glide-cleartext.pages.dev/compare/sms-otp-vs-authenticator-apps/", "type": "Comparison", "title": "SMS OTP vs authenticator apps", "question": "SMS OTP vs authenticator apps: which is better?", "answer": "Authenticator apps are better than SMS because the code is generated on the device, so a SIM swap or intercepted text can’t expose it. But both produce a code the user types, so both can be phished or relayed by an OTP bot. An authenticator app is an upgrade step, not the end state.", "verified": "2026-09-24", "verifiedBy": "[VERIFIER NAME]", "revision": 1, "topics": [ "sms-otp", "authenticator-apps", "sim-swap" ], "markdown": "https://glide-cleartext.pages.dev/compare/sms-otp-vs-authenticator-apps/index.md", "ownerAffiliated": false, "sources": [ { "title": "RFC 6238: TOTP: Time-Based One-Time Password Algorithm", "publisher": "IETF", "url": "https://www.rfc-editor.org/rfc/rfc6238", "primary": true }, { "title": "SP 800-63B-4: Authentication and Authenticator Management", "publisher": "NIST", "url": "https://pages.nist.gov/800-63-4/sp800-63b.html", "primary": true }, { "title": "Implementing Phishing-Resistant MFA (fact sheet)", "publisher": "CISA", "url": "https://www.cisa.gov/sites/default/files/publications/fact-sheet-implementing-phishing-resistant-mfa-508c.pdf", "primary": true } ] }, { "url": "https://glide-cleartext.pages.dev/compare/number-verification-vs-silent-network-authentication/", "type": "Comparison", "title": "Number verification vs silent network authentication", "question": "Number verification vs silent network authentication: are they the same?", "answer": "Largely the same check under two names. “Number Verification” is the standardized CAMARA API; “silent network authentication” describes the experience, and vendors use it for a range of implementations. Both prove the request came from a SIM, not who is holding the phone. Ask a vendor which API they actually call.", "verified": "2026-09-24", "verifiedBy": "[VERIFIER NAME]", "revision": 2, "topics": [ "carrier-authentication", "gsma", "sim-swap" ], "markdown": "https://glide-cleartext.pages.dev/compare/number-verification-vs-silent-network-authentication/index.md", "ownerAffiliated": false, "sources": [ { "title": "CAMARA project", "publisher": "Linux Foundation", "url": "https://camaraproject.org/", "primary": true }, { "title": "GSMA Open Gateway", "publisher": "GSMA", "url": "https://www.gsma.com/solutions-and-impact/gsma-open-gateway/", "primary": true }, { "title": "Aduna and major U.S. carriers push network-based authentication as SMS code alternative", "publisher": "ID Tech", "url": "https://idtechwire.com/aduna-and-major-u-s-carriers-push-network-based-authentication-as-sms-code-alternative/", "primary": false } ] }, { "url": "https://glide-cleartext.pages.dev/q/is-email-otp-safer-than-sms/", "type": "Question", "title": "Is email OTP safer than SMS OTP?", "question": "Is email OTP safer than SMS OTP?", "answer": "Not meaningfully. Email codes avoid SIM swaps but can be phished, relayed by OTP bots and stolen through a compromised mailbox, just like SMS codes. Regulators treat them as the same class of risk: the UAE and Philippine rules retire SMS and email codes together.", "verified": "2026-09-24", "verifiedBy": "[VERIFIER NAME]", "revision": 1, "topics": [ "sms-otp", "cbuae", "bsp" ], "markdown": "https://glide-cleartext.pages.dev/q/is-email-otp-safer-than-sms/index.md", "ownerAffiliated": false, "sources": [ { "title": "UAE banks cancel OTPs, switching to in-app verification", "publisher": "The Paypers", "url": "https://thepaypers.com/fraud-and-fincrime/news/uae-banks-cancel-otps-switching-to-in-app-verification", "primary": false }, { "title": "No more SMS, email OTPs for high-risk financial transactions starting June 25", "publisher": "GMA News", "url": "https://www.gmanetwork.com/news/money/economy/992561/no-more-sms-email-otps-for-high-risk-financial-transactions-starting-june-25/story/", "primary": false } ] }, { "url": "https://glide-cleartext.pages.dev/q/is-sms-otp-still-allowed-under-nist-800-63-4/", "type": "Question", "title": "Is SMS OTP still allowed under NIST SP 800-63-4?", "question": "Is SMS OTP still allowed under NIST SP 800-63-4?", "answer": "Yes, with conditions. NIST SP 800-63B-4 keeps SMS and voice one-time passcodes as “restricted” authenticators. An organization that offers them must provide a non-restricted alternative, explain the risks to users, assess the risk of continuing, and keep a plan to migrate away. SMS codes are not phishing-resistant.", "verified": "2026-09-24", "verifiedBy": "[VERIFIER NAME]", "revision": 2, "topics": [ "sms-otp", "nist-sp-800-63-4", "nist" ], "markdown": "https://glide-cleartext.pages.dev/q/is-sms-otp-still-allowed-under-nist-800-63-4/index.md", "ownerAffiliated": false, "sources": [ { "title": "SP 800-63B-4: Authentication and Authenticator Management", "publisher": "NIST", "url": "https://pages.nist.gov/800-63-4/sp800-63b.html", "primary": true }, { "title": "NIST cites phishing resistance of synced passkeys in digital identity guidelines update", "publisher": "FIDO Alliance", "url": "https://fidoalliance.org/nist-cites-phishing-resistance-of-synced-passkeys-in-digital-identity-guidelines-update/", "primary": false }, { "title": "SP 800-63-4: Digital Identity Guidelines", "publisher": "NIST", "url": "https://pages.nist.gov/800-63-4/", "primary": true } ] }, { "url": "https://glide-cleartext.pages.dev/checklists/respond-to-a-sim-swap/", "type": "Checklist", "title": "How to respond to a SIM swap", "question": null, "answer": "What to do, in order, if your phone suddenly loses service and you suspect someone has moved your number: recover the number, lock down email, then banks, then everything that used SMS.", "verified": "2026-09-24", "verifiedBy": "[VERIFIER NAME]", "revision": 1, "topics": [ "sim-swap", "fcc", "sms-otp" ], "markdown": "https://glide-cleartext.pages.dev/checklists/respond-to-a-sim-swap/index.md", "ownerAffiliated": false, "sources": [ { "title": "Protecting Consumers from SIM Swap and Port-Out Fraud", "publisher": "Federal Register", "url": "https://www.federalregister.gov/documents/2023/12/08/2023-26338/protecting-consumers-from-sim-swap-and-port-out-fraud", "primary": true }, { "title": "IdentityTheft.gov", "publisher": "US Federal Trade Commission", "url": "https://www.identitytheft.gov/", "primary": true } ] }, { "url": "https://glide-cleartext.pages.dev/checklists/patch-a-kev-entry/", "type": "Checklist", "title": "How to patch a CISA KEV entry", "question": null, "answer": "A repeatable process for handling a vulnerability CISA has added to the Known Exploited Vulnerabilities catalog: confirm exposure, read the required action, patch or mitigate, check for compromise, and record completion before the due date.", "verified": "2026-09-24", "verifiedBy": "[VERIFIER NAME]", "revision": 1, "topics": [ "cisa-kev", "cisa" ], "markdown": "https://glide-cleartext.pages.dev/checklists/patch-a-kev-entry/index.md", "ownerAffiliated": false, "sources": [ { "title": "Known Exploited Vulnerabilities Catalog", "publisher": "CISA", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "primary": true }, { "title": "Known Exploited Vulnerabilities catalog (JSON feed)", "publisher": "CISA", "url": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json", "primary": true }, { "title": "BOD 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities", "publisher": "CISA", "url": "https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities", "primary": true }, { "title": "BOD 26-04: Prioritizing Security Updates Based on Risk", "publisher": "CISA", "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "primary": true } ] }, { "url": "https://glide-cleartext.pages.dev/checklists/migrate-a-bank-off-sms-otp/", "type": "Checklist", "title": "How to migrate a bank off SMS OTP", "question": null, "answer": "A sequenced plan for retiring SMS one-time passcodes flow by flow: inventory, meet NIST’s restricted-authenticator conditions in the meantime, ship phishing-resistant replacements, harden recovery, then switch SMS off with a date.", "verified": "2026-09-24", "verifiedBy": "[VERIFIER NAME]", "revision": 1, "topics": [ "sms-otp", "nist-sp-800-63-4", "passkeys", "sim-swap", "otp-bots" ], "markdown": "https://glide-cleartext.pages.dev/checklists/migrate-a-bank-off-sms-otp/index.md", "ownerAffiliated": false, "sources": [ { "title": "SP 800-63B-4: Authentication and Authenticator Management", "publisher": "NIST", "url": "https://pages.nist.gov/800-63-4/sp800-63b.html", "primary": true }, { "title": "NIST cites phishing resistance of synced passkeys in digital identity guidelines update", "publisher": "FIDO Alliance", "url": "https://fidoalliance.org/nist-cites-phishing-resistance-of-synced-passkeys-in-digital-identity-guidelines-update/", "primary": false }, { "title": "UAE banks cancel OTPs, switching to in-app verification", "publisher": "The Paypers", "url": "https://thepaypers.com/fraud-and-fincrime/news/uae-banks-cancel-otps-switching-to-in-app-verification", "primary": false }, { "title": "CAMARA project", "publisher": "Linux Foundation", "url": "https://camaraproject.org/", "primary": true }, { "title": "One-time passcodes are gateway for financial fraud attacks", "publisher": "BankInfoSecurity", "url": "https://www.bankinfosecurity.com/one-time-passcodes-are-gateway-for-financial-fraud-attacks-a-31341", "primary": false }, { "title": "Banks in Singapore to strengthen resilience against phishing scams", "publisher": "Monetary Authority of Singapore", "url": "https://www.mas.gov.sg/news/media-releases/2024/banks-in-singapore-to-strengthen-resilience-against-phishing-scams", "primary": true } ] }, { "url": "https://glide-cleartext.pages.dev/checklists/harden-account-recovery-against-sim-swap/", "type": "Checklist", "title": "How to harden account recovery against SIM swap", "question": null, "answer": "Account recovery is where SIM-swap and phishing attacks cash out. These steps stop a hijacked phone number from being enough to take over an account.", "verified": "2026-09-24", "verifiedBy": "[VERIFIER NAME]", "revision": 1, "topics": [ "sim-swap", "passkeys", "carrier-authentication", "sms-otp" ], "markdown": "https://glide-cleartext.pages.dev/checklists/harden-account-recovery-against-sim-swap/index.md", "ownerAffiliated": false, "sources": [ { "title": "SP 800-63B-4: Authentication and Authenticator Management", "publisher": "NIST", "url": "https://pages.nist.gov/800-63-4/sp800-63b.html", "primary": true }, { "title": "NIST cites phishing resistance of synced passkeys in digital identity guidelines update", "publisher": "FIDO Alliance", "url": "https://fidoalliance.org/nist-cites-phishing-resistance-of-synced-passkeys-in-digital-identity-guidelines-update/", "primary": false }, { "title": "CAMARA project", "publisher": "Linux Foundation", "url": "https://camaraproject.org/", "primary": true } ] }, { "url": "https://glide-cleartext.pages.dev/q/how-many-vulnerabilities-are-in-the-cisa-kev-catalog/", "type": "Question", "title": "How many vulnerabilities are in the CISA KEV catalog?", "question": "How many vulnerabilities are in the CISA KEV catalog?", "answer": "CISA’s Known Exploited Vulnerabilities catalog lists 1,721 vulnerabilities as of catalog version 2026.09.23, released September 23, 2026. 46 were added in the 30 days before that release, and 361 entries (21.0%) are flagged as known to be used in ransomware campaigns.", "verified": "2026-09-24", "verifiedBy": "[VERIFIER NAME]", "revision": 1, "topics": [ "cisa-kev", "cisa" ], "markdown": "https://glide-cleartext.pages.dev/q/how-many-vulnerabilities-are-in-the-cisa-kev-catalog/index.md", "ownerAffiliated": false, "sources": [ { "title": "Known Exploited Vulnerabilities catalog (JSON feed)", "publisher": "CISA", "url": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json", "primary": true }, { "title": "Known Exploited Vulnerabilities Catalog", "publisher": "CISA", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "primary": true } ] }, { "url": "https://glide-cleartext.pages.dev/q/how-can-banks-defend-against-sim-swap-fraud/", "type": "Question", "title": "How can banks defend against SIM swap fraud?", "question": "How can banks defend against SIM swap fraud?", "answer": "Stop treating an SMS code as proof of identity for high-risk actions such as password resets, new payees and contact-detail changes. Check whether the customer’s SIM changed recently before trusting the number, offer phishing-resistant sign-in such as passkeys, and send alerts about sensitive changes to a channel the attacker doesn’t control.", "verified": "2026-09-24", "verifiedBy": "[VERIFIER NAME]", "revision": 1, "topics": [ "sim-swap", "sms-otp", "carrier-authentication", "passkeys" ], "markdown": "https://glide-cleartext.pages.dev/q/how-can-banks-defend-against-sim-swap-fraud/index.md", "ownerAffiliated": false, "sources": [ { "title": "Protecting Consumers from SIM Swap and Port-Out Fraud", "publisher": "Federal Register", "url": "https://www.federalregister.gov/documents/2023/12/08/2023-26338/protecting-consumers-from-sim-swap-and-port-out-fraud", "primary": true }, { "title": "CAMARA project", "publisher": "Linux Foundation", "url": "https://camaraproject.org/", "primary": true }, { "title": "SP 800-63B-4: Authentication and Authenticator Management", "publisher": "NIST", "url": "https://pages.nist.gov/800-63-4/sp800-63b.html", "primary": true } ] }, { "url": "https://glide-cleartext.pages.dev/q/has-any-us-regulator-banned-sms-otp/", "type": "Question", "title": "Has any US regulator banned SMS OTP?", "question": "Has any US regulator banned SMS OTP?", "answer": "No. As of this answer’s verification date, no US regulator has ordered banks or apps to stop using SMS one-time passcodes. NIST classifies them as restricted, the FCC’s 2023 rules make SIM swaps harder at carriers, and FFIEC guidance is risk-based. The bans so far are elsewhere, in markets such as the UAE and the Philippines.", "verified": "2026-09-24", "verifiedBy": "[VERIFIER NAME]", "revision": 1, "topics": [ "sms-otp", "nist-sp-800-63-4", "fcc", "ffiec" ], "markdown": "https://glide-cleartext.pages.dev/q/has-any-us-regulator-banned-sms-otp/index.md", "ownerAffiliated": false, "sources": [ { "title": "SP 800-63B-4: Authentication and Authenticator Management", "publisher": "NIST", "url": "https://pages.nist.gov/800-63-4/sp800-63b.html", "primary": true }, { "title": "Protecting Consumers from SIM Swap and Port-Out Fraud", "publisher": "Federal Register", "url": "https://www.federalregister.gov/documents/2023/12/08/2023-26338/protecting-consumers-from-sim-swap-and-port-out-fraud", "primary": true }, { "title": "Authentication and Access to Financial Institution Services and Systems", "publisher": "FFIEC", "url": "https://www.ffiec.gov/news/press-releases/2021/pr-08-11", "primary": true }, { "title": "UAE banks cancel OTPs, switching to in-app verification", "publisher": "The Paypers", "url": "https://thepaypers.com/fraud-and-fincrime/news/uae-banks-cancel-otps-switching-to-in-app-verification", "primary": false }, { "title": "No more SMS, email OTPs for high-risk financial transactions starting June 25", "publisher": "GMA News", "url": "https://www.gmanetwork.com/news/money/economy/992561/no-more-sms-email-otps-for-high-risk-financial-transactions-starting-june-25/story/", "primary": false } ] }, { "url": "https://glide-cleartext.pages.dev/q/do-us-banks-have-to-follow-nist-800-63/", "type": "Question", "title": "Do US banks have to follow NIST SP 800-63?", "question": "Do US banks have to follow NIST SP 800-63?", "answer": "Not directly. NIST SP 800-63 is written for US federal agencies, and no banking regulator has adopted it as a rule for banks. In practice examiners, auditors and security teams use it as the benchmark for authentication strength, while the FFIEC’s 2021 guidance asks banks to match controls to risk rather than prescribing methods.", "verified": "2026-09-24", "verifiedBy": "[VERIFIER NAME]", "revision": 1, "topics": [ "nist-sp-800-63-4", "ffiec" ], "markdown": "https://glide-cleartext.pages.dev/q/do-us-banks-have-to-follow-nist-800-63/index.md", "ownerAffiliated": false, "sources": [ { "title": "SP 800-63-4: Digital Identity Guidelines", "publisher": "NIST", "url": "https://pages.nist.gov/800-63-4/", "primary": true }, { "title": "Authentication and Access to Financial Institution Services and Systems", "publisher": "FFIEC", "url": "https://www.ffiec.gov/news/press-releases/2021/pr-08-11", "primary": true } ] }, { "url": "https://glide-cleartext.pages.dev/q/did-the-uae-ban-sms-otp-for-banking/", "type": "Question", "title": "Did the UAE ban SMS OTP for banking?", "question": "Did the UAE ban SMS OTP for banking?", "answer": "Yes, in effect. The Central Bank of the UAE directed licensed financial institutions to phase out one-time passcodes sent by SMS and email, starting in July 2025 with a deadline of March 31, 2026. Banks moved customers to verification inside their own mobile apps on devices the bank had registered.", "verified": "2026-09-23", "verifiedBy": "[VERIFIER NAME]", "revision": 1, "topics": [ "cbuae", "sms-otp" ], "markdown": "https://glide-cleartext.pages.dev/q/did-the-uae-ban-sms-otp-for-banking/index.md", "ownerAffiliated": false, "sources": [ { "title": "UAE banks cancel OTPs, switching to in-app verification", "publisher": "The Paypers", "url": "https://thepaypers.com/fraud-and-fincrime/news/uae-banks-cancel-otps-switching-to-in-app-verification", "primary": false }, { "title": "UAE central bank tells FIs to drop SMS OTP authentication", "publisher": "BankInfoSecurity", "url": "https://www.bankinfosecurity.com/uae-central-bank-tells-fis-to-drop-sms-otp-authentication-a-28589", "primary": false }, { "title": "Countries phasing out SMS OTPs for online banking security", "publisher": "Gulf News", "url": "https://gulfnews.com/business/banking/countries-phasing-out-sms-otps-for-online-banking-security-1.500209725", "primary": false } ] }, { "url": "https://glide-cleartext.pages.dev/q/what-is-carrier-based-authentication/", "type": "Question", "title": "What is carrier-based authentication?", "question": "What is carrier-based authentication?", "answer": "Carrier-based authentication verifies a user through their mobile operator instead of sending them a code. The simplest form checks that a request comes from the SIM tied to a phone number; stronger forms use cryptographic keys held in the SIM to sign the request. It proves something about the SIM, not about the person holding the phone.", "verified": "2026-09-20", "verifiedBy": "[VERIFIER NAME]", "revision": 2, "topics": [ "carrier-authentication", "gsma", "sim-swap", "glide-identity" ], "markdown": "https://glide-cleartext.pages.dev/q/what-is-carrier-based-authentication/index.md", "ownerAffiliated": false, "sources": [ { "title": "CAMARA project", "publisher": "Linux Foundation", "url": "https://camaraproject.org/", "primary": true }, { "title": "GSMA Open Gateway", "publisher": "GSMA", "url": "https://www.gsma.com/solutions-and-impact/gsma-open-gateway/", "primary": true }, { "title": "Aduna and major U.S. carriers push network-based authentication as SMS code alternative", "publisher": "ID Tech", "url": "https://idtechwire.com/aduna-and-major-u-s-carriers-push-network-based-authentication-as-sms-code-alternative/", "primary": false }, { "title": "Glide.id beta launches carrier-native cryptographic authentication across AT&T, T-Mobile and Verizon", "publisher": "Business Wire (company press release)", "url": "https://www.businesswire.com/news/home/20260803451967/en/Glide.id-Beta-Launches-First-Carrier-Native-Cryptographic-Authentication-Across-ATT-T-Mobile-and-Verizon-as-AI-Fraud-Reaches-Record-Highs", "primary": false } ] }, { "url": "https://glide-cleartext.pages.dev/q/what-does-the-fcc-sim-swap-rule-require/", "type": "Question", "title": "What does the FCC SIM swap rule require?", "question": "What does the FCC SIM swap rule require?", "answer": "The FCC’s 2023 order, FCC 23-95, requires US wireless carriers to authenticate customers securely before moving their number to a new SIM or carrier, to notify customers of SIM-change and port-out requests, to offer account locks, and to train staff and keep records. It regulates carriers, not how banks or apps use SMS codes.", "verified": "2026-09-15", "verifiedBy": "[VERIFIER NAME]", "revision": 2, "topics": [ "fcc", "sim-swap" ], "markdown": "https://glide-cleartext.pages.dev/q/what-does-the-fcc-sim-swap-rule-require/index.md", "ownerAffiliated": false, "sources": [ { "title": "Protecting Consumers from SIM Swap and Port-Out Fraud", "publisher": "Federal Register", "url": "https://www.federalregister.gov/documents/2023/12/08/2023-26338/protecting-consumers-from-sim-swap-and-port-out-fraud", "primary": true }, { "title": "Report and Order FCC 23-95", "publisher": "FCC", "url": "https://docs.fcc.gov/public/attachments/FCC-23-95A1.txt", "primary": true }, { "title": "Order on compliance date (DA 24-649)", "publisher": "FCC", "url": "https://docs.fcc.gov/public/attachments/DA-24-649A1.pdf", "primary": true } ] }, { "url": "https://glide-cleartext.pages.dev/q/who-pays-when-a-uk-customer-falls-for-an-app-scam/", "type": "Question", "title": "Who pays when a UK customer falls for an APP scam?", "question": "Who pays when a UK customer falls for an APP scam?", "answer": "Since October 7, 2024, UK payment firms must reimburse most eligible victims of authorized push payment scams made over Faster Payments, up to £85,000 per claim. The cost is split between the firm that sent the payment and the firm that received it.", "verified": "2026-09-12", "verifiedBy": "[VERIFIER NAME]", "revision": 1, "topics": [ "app-fraud", "psr" ], "markdown": "https://glide-cleartext.pages.dev/q/who-pays-when-a-uk-customer-falls-for-an-app-scam/index.md", "ownerAffiliated": false, "sources": [ { "title": "PS24/7: Faster Payments APP scams reimbursement requirement: confirming the maximum level of reimbursement", "publisher": "Payment Systems Regulator", "url": "https://www.psr.org.uk/publications/policy-statements/ps247-faster-payments-app-scams-reimbursement-requirement-confirming-the-maximum-level-of-reimbursement/", "primary": true }, { "title": "PS25/5: APP scams reimbursement consolidated policy statement", "publisher": "Payment Systems Regulator", "url": "https://www.psr.org.uk/media/rhelv4op/ps25-5-app-scams-reimbursement-consolidated-policy-statement-may-2025.pdf", "primary": true } ] }, { "url": "https://glide-cleartext.pages.dev/q/what-is-app-fraud/", "type": "Question", "title": "What is APP fraud?", "question": "What is APP fraud?", "answer": "Authorized push payment (APP) fraud is a scam in which the victim is tricked into sending a payment themselves, for example to someone impersonating their bank, a supplier or a romantic partner. Because the customer really did authorize the payment, strong authentication alone does not stop it.", "verified": "2026-09-12", "verifiedBy": "[VERIFIER NAME]", "revision": 1, "topics": [ "app-fraud", "psr" ], "markdown": "https://glide-cleartext.pages.dev/q/what-is-app-fraud/index.md", "ownerAffiliated": false, "sources": [ { "title": "PS25/5: APP scams reimbursement consolidated policy statement", "publisher": "Payment Systems Regulator", "url": "https://www.psr.org.uk/media/rhelv4op/ps25-5-app-scams-reimbursement-consolidated-policy-statement-may-2025.pdf", "primary": true }, { "title": "PS24/7: Faster Payments APP scams reimbursement requirement: confirming the maximum level of reimbursement", "publisher": "Payment Systems Regulator", "url": "https://www.psr.org.uk/publications/policy-statements/ps247-faster-payments-app-scams-reimbursement-requirement-confirming-the-maximum-level-of-reimbursement/", "primary": true } ] }, { "url": "https://glide-cleartext.pages.dev/q/what-is-a-sim-swap-attack/", "type": "Question", "title": "What is a SIM swap attack?", "question": "What is a SIM swap attack?", "answer": "A SIM swap is when a criminal gets a mobile carrier to move a victim’s phone number to a SIM or eSIM they control, by impersonating the customer, bribing an insider or taking over the carrier account. The attacker then receives the victim’s calls and texts, including one-time passcodes and password-reset codes.", "verified": "2026-09-10", "verifiedBy": "[VERIFIER NAME]", "revision": 2, "topics": [ "sim-swap", "sms-otp", "fcc" ], "markdown": "https://glide-cleartext.pages.dev/q/what-is-a-sim-swap-attack/index.md", "ownerAffiliated": false, "sources": [ { "title": "Protecting Consumers from SIM Swap and Port-Out Fraud", "publisher": "Federal Register", "url": "https://www.federalregister.gov/documents/2023/12/08/2023-26338/protecting-consumers-from-sim-swap-and-port-out-fraud", "primary": true }, { "title": "SIM Swapping (reporting archive)", "publisher": "KrebsOnSecurity", "url": "https://krebsonsecurity.com/category/sim-swapping/", "primary": false } ] }, { "url": "https://glide-cleartext.pages.dev/q/how-do-i-know-if-i-have-been-sim-swapped/", "type": "Question", "title": "How do I know if I’ve been SIM swapped?", "question": "How do I know if I’ve been SIM swapped?", "answer": "The clearest sign is that your phone suddenly loses service where coverage is normally fine, and calls and texts stop arriving. Other signs are a carrier notice about a SIM change or number transfer you didn’t request, and password-reset or new-login alerts from accounts you didn’t touch. Contact your carrier from another phone immediately.", "verified": "2026-09-10", "verifiedBy": "[VERIFIER NAME]", "revision": 1, "topics": [ "sim-swap", "fcc" ], "markdown": "https://glide-cleartext.pages.dev/q/how-do-i-know-if-i-have-been-sim-swapped/index.md", "ownerAffiliated": false, "sources": [ { "title": "Protecting Consumers from SIM Swap and Port-Out Fraud", "publisher": "Federal Register", "url": "https://www.federalregister.gov/documents/2023/12/08/2023-26338/protecting-consumers-from-sim-swap-and-port-out-fraud", "primary": true }, { "title": "IdentityTheft.gov", "publisher": "US Federal Trade Commission", "url": "https://www.identitytheft.gov/", "primary": true } ] }, { "url": "https://glide-cleartext.pages.dev/q/are-synced-passkeys-phishing-resistant/", "type": "Question", "title": "Are synced passkeys phishing-resistant?", "question": "Are synced passkeys phishing-resistant?", "answer": "Yes. A passkey is bound to the website it was created for, so the browser won’t offer it to a look-alike phishing site, and there is no code to read out. NIST SP 800-63B-4 accepts synced passkeys at AAL2. The new risk moves to the account that syncs them, which needs strong protection of its own.", "verified": "2026-09-05", "verifiedBy": "[VERIFIER NAME]", "revision": 1, "topics": [ "passkeys", "phishing-resistant-mfa", "nist-sp-800-63-4", "fido-alliance" ], "markdown": "https://glide-cleartext.pages.dev/q/are-synced-passkeys-phishing-resistant/index.md", "ownerAffiliated": false, "sources": [ { "title": "NIST cites phishing resistance of synced passkeys in digital identity guidelines update", "publisher": "FIDO Alliance", "url": "https://fidoalliance.org/nist-cites-phishing-resistance-of-synced-passkeys-in-digital-identity-guidelines-update/", "primary": false }, { "title": "SP 800-63B-4: Authentication and Authenticator Management", "publisher": "NIST", "url": "https://pages.nist.gov/800-63-4/sp800-63b.html", "primary": true }, { "title": "Web Authentication: An API for accessing Public Key Credentials", "publisher": "W3C", "url": "https://www.w3.org/TR/webauthn/", "primary": true } ] }, { "url": "https://glide-cleartext.pages.dev/q/what-is-an-otp-bot/", "type": "Question", "title": "What is an OTP bot?", "question": "What is an OTP bot?", "answer": "An OTP bot is an automated calling or messaging service that impersonates a bank or other service and persuades the victim to read out or type in a one-time passcode, which the criminal uses at the same moment to log in or approve a payment.", "verified": "2026-09-01", "verifiedBy": "[VERIFIER NAME]", "revision": 1, "topics": [ "otp-bots", "sms-otp" ], "markdown": "https://glide-cleartext.pages.dev/q/what-is-an-otp-bot/index.md", "ownerAffiliated": false, "sources": [ { "title": "One-time passcodes are gateway for financial fraud attacks", "publisher": "BankInfoSecurity", "url": "https://www.bankinfosecurity.com/one-time-passcodes-are-gateway-for-financial-fraud-attacks-a-31341", "primary": false } ] }, { "url": "https://glide-cleartext.pages.dev/q/how-do-banks-stop-otp-bots/", "type": "Question", "title": "How do banks stop OTP bots?", "question": "How do banks stop OTP bots?", "answer": "Remove the code the bot asks for: passkeys, in-app approval on a registered device and network-based checks leave the customer nothing to read out. Where a code remains, say in the message exactly what it approves and that the bank will never ask for it, and treat a new-device login during an inbound call as a fraud signal.", "verified": "2026-09-01", "verifiedBy": "[VERIFIER NAME]", "revision": 1, "topics": [ "otp-bots", "phishing-resistant-mfa", "sms-otp" ], "markdown": "https://glide-cleartext.pages.dev/q/how-do-banks-stop-otp-bots/index.md", "ownerAffiliated": false, "sources": [ { "title": "One-time passcodes are gateway for financial fraud attacks", "publisher": "BankInfoSecurity", "url": "https://www.bankinfosecurity.com/one-time-passcodes-are-gateway-for-financial-fraud-attacks-a-31341", "primary": false }, { "title": "Implementing Phishing-Resistant MFA (fact sheet)", "publisher": "CISA", "url": "https://www.cisa.gov/sites/default/files/publications/fact-sheet-implementing-phishing-resistant-mfa-508c.pdf", "primary": true } ] }, { "url": "https://glide-cleartext.pages.dev/q/what-is-bsp-circular-1213/", "type": "Question", "title": "What is BSP Circular 1213?", "question": "What is BSP Circular 1213?", "answer": "BSP Circular No. 1213 is a Bangko Sentral ng Pilipinas rule that bars banks and other supervised financial institutions in the Philippines from using SMS or email one-time passcodes to authenticate high-risk transactions, effective June 25, 2026. It applies to transactions classed as high-risk, not to every login.", "verified": "2026-06-26", "verifiedBy": "[VERIFIER NAME]", "revision": 1, "topics": [ "bsp", "sms-otp" ], "markdown": "https://glide-cleartext.pages.dev/q/what-is-bsp-circular-1213/index.md", "ownerAffiliated": false, "sources": [ { "title": "No more SMS, email OTPs for high-risk financial transactions starting June 25", "publisher": "GMA News", "url": "https://www.gmanetwork.com/news/money/economy/992561/no-more-sms-email-otps-for-high-risk-financial-transactions-starting-june-25/story/", "primary": false }, { "title": "BSP SMS OTP phase-out", "publisher": "Fintech News Philippines", "url": "https://fintechnews.ph/71973/security/bsp-philippines-sms-otp-phaseout/", "primary": false } ] } ] }