{ "version": "https://jsonfeed.org/version/1.1", "title": "Cleartext: recently verified answers", "home_page_url": "https://glide-cleartext.pages.dev/", "feed_url": "https://glide-cleartext.pages.dev/feed.json", "description": "Cleartext is a reference of verified answers about authentication, fraud, exploited vulnerabilities and security regulation. Every answer leads with a 60-word summary, cites primary sources and shows when it was last verified.", "language": "en", "items": [ { "id": "https://glide-cleartext.pages.dev/q/which-vendors-have-the-most-cisa-kev-entries/#rev-1", "url": "https://glide-cleartext.pages.dev/q/which-vendors-have-the-most-cisa-kev-entries/", "title": "Which vendors have the most CISA KEV entries?", "content_text": "Microsoft has the most entries in CISA’s Known Exploited Vulnerabilities catalog, with 388 of 1,721 (22.5%), followed by Cisco (99) and Apple (94), as of catalog 2026.09.23. A high count is not by itself a measure of how secure a vendor’s products are.", "summary": "Microsoft has the most entries in CISA’s Known Exploited Vulnerabilities catalog, with 388 of 1,721 (22.5%), followed by Cisco (99) and Apple (94), as of catalog 2026.09.23. A high count is not by itself a measure of how secure a vendor’s products are.", "date_published": "2026-09-24T00:00:00Z", "date_modified": "2026-09-24T00:00:00Z", "tags": [ "Question", "CISA KEV catalog" ] }, { "id": "https://glide-cleartext.pages.dev/q/which-countries-are-banning-sms-otp/#rev-2", "url": "https://glide-cleartext.pages.dev/q/which-countries-are-banning-sms-otp/", "title": "Which countries are banning SMS OTP for banking?", "content_text": "Singapore, Malaysia, the UAE and the Philippines have ordered banks off SMS or email codes for some or all transactions since 2022. India’s RBI Authentication Directions 2025, in force from April 2026, open the door to alternatives. The EU has a pending fraud package, and the US has issued guidance, not a ban.", "summary": "Singapore, Malaysia, the UAE and the Philippines have ordered banks off SMS or email codes for some or all transactions since 2022. India’s RBI Authentication Directions 2025, in force from April 2026, open the door to alternatives. The EU has a pending fraud package, and the US has issued guidance, not a ban.", "date_published": "2026-09-22T00:00:00Z", "date_modified": "2026-09-24T00:00:00Z", "tags": [ "Question", "SMS one-time passcodes", "Central Bank of the UAE", "Bangko Sentral ng Pilipinas", "Monetary Authority of Singapore", "Bank Negara Malaysia", "Reserve Bank of India", "EU PSD3 and Payment Services Regulation", "NIST SP 800-63-4" ] }, { "id": "https://glide-cleartext.pages.dev/q/what-is-the-cisa-kev-catalog/#rev-1", "url": "https://glide-cleartext.pages.dev/q/what-is-the-cisa-kev-catalog/", "title": "What is the CISA KEV catalog?", "content_text": "The Known Exploited Vulnerabilities (KEV) catalog is CISA’s list of vulnerabilities with reliable evidence of active exploitation. Each entry gives a required action and a due date. US federal civilian agencies must act by that date; other organizations use the list to decide what to patch first. It holds 1,721 entries.", "summary": "The Known Exploited Vulnerabilities (KEV) catalog is CISA’s list of vulnerabilities with reliable evidence of active exploitation. Each entry gives a required action and a due date. US federal civilian agencies must act by that date; other organizations use the list to decide what to patch first. It holds 1,721 entries.", "date_published": "2026-09-24T00:00:00Z", "date_modified": "2026-09-24T00:00:00Z", "tags": [ "Question", "CISA KEV catalog", "CISA" ] }, { "id": "https://glide-cleartext.pages.dev/q/what-is-phishing-resistant-mfa/#rev-1", "url": "https://glide-cleartext.pages.dev/q/what-is-phishing-resistant-mfa/", "title": "What is phishing-resistant MFA?", "content_text": "Phishing-resistant MFA is authentication that a fake website or man-in-the-middle cannot capture and replay, because the credential is cryptographically bound to the real site. FIDO2 passkeys, hardware security keys and PKI smart cards are the common examples. SMS codes, authenticator-app codes and push approvals are not phishing-resistant.", "summary": "Phishing-resistant MFA is authentication that a fake website or man-in-the-middle cannot capture and replay, because the credential is cryptographically bound to the real site. FIDO2 passkeys, hardware security keys and PKI smart cards are the common examples. SMS codes, authenticator-app codes and push approvals are not phishing-resistant.", "date_published": "2026-09-24T00:00:00Z", "date_modified": "2026-09-24T00:00:00Z", "tags": [ "Question", "Phishing-resistant MFA", "Passkeys", "CISA", "Authenticator apps (TOTP)" ] }, { "id": "https://glide-cleartext.pages.dev/q/what-is-glide-identity-magicalauth/#rev-1", "url": "https://glide-cleartext.pages.dev/q/what-is-glide-identity-magicalauth/", "title": "What is Glide Identity’s MagicalAuth, and how is it different from SMS OTP?", "content_text": "MagicalAuth is Glide Identity’s product for replacing SMS one-time passcodes. According to the company, it confirms identity through the mobile network, using the SIM’s cryptographic link to the network, with no code to type, and switches to passkeys or email links when a device doesn’t support SIM authentication. Cleartext has not independently tested it.", "summary": "MagicalAuth is Glide Identity’s product for replacing SMS one-time passcodes. According to the company, it confirms identity through the mobile network, using the SIM’s cryptographic link to the network, with no code to type, and switches to passkeys or email links when a device doesn’t support SIM authentication. Cleartext has not independently tested it.", "date_published": "2026-09-24T00:00:00Z", "date_modified": "2026-09-24T00:00:00Z", "tags": [ "Question", "Glide Identity", "Carrier-based authentication", "SMS one-time passcodes", "SIM swap" ] }, { "id": "https://glide-cleartext.pages.dev/q/what-does-restricted-authenticator-mean-in-nist-800-63b/#rev-1", "url": "https://glide-cleartext.pages.dev/q/what-does-restricted-authenticator-mean-in-nist-800-63b/", "title": "What does “restricted authenticator” mean in NIST SP 800-63B-4?", "content_text": "A restricted authenticator is one NIST still permits but considers riskier, such as SMS or voice one-time passcodes. An organization that uses one takes on four obligations: offer a non-restricted alternative, tell users the risks, assess the risk of continuing, and keep a migration plan in case a future revision removes it.", "summary": "A restricted authenticator is one NIST still permits but considers riskier, such as SMS or voice one-time passcodes. An organization that uses one takes on four obligations: offer a non-restricted alternative, tell users the risks, assess the risk of continuing, and keep a migration plan in case a future revision removes it.", "date_published": "2026-09-24T00:00:00Z", "date_modified": "2026-09-24T00:00:00Z", "tags": [ "Question", "NIST SP 800-63-4", "SMS one-time passcodes" ] }, { "id": "https://glide-cleartext.pages.dev/q/what-does-the-due-date-in-cisa-kev-mean/#rev-1", "url": "https://glide-cleartext.pages.dev/q/what-does-the-due-date-in-cisa-kev-mean/", "title": "What does the due date in the CISA KEV catalog mean?", "content_text": "It is the date by which US federal civilian executive branch agencies must complete the entry’s required action, usually applying the vendor’s update or mitigation, or stop using the product. For entries added in the past year, the median window was 14 days. For everyone else it is a useful deadline, not a legal one.", "summary": "It is the date by which US federal civilian executive branch agencies must complete the entry’s required action, usually applying the vendor’s update or mitigation, or stop using the product. For entries added in the past year, the median window was 14 days. For everyone else it is a useful deadline, not a legal one.", "date_published": "2026-09-24T00:00:00Z", "date_modified": "2026-09-24T00:00:00Z", "tags": [ "Question", "CISA KEV catalog", "CISA" ] }, { "id": "https://glide-cleartext.pages.dev/compare/totp-vs-push-notifications/#rev-1", "url": "https://glide-cleartext.pages.dev/compare/totp-vs-push-notifications/", "title": "TOTP vs push notifications", "content_text": "Neither is phishing-resistant. Push is easier to use but adds a specific weakness, MFA fatigue, where attackers send prompts until the user approves; number matching reduces it. TOTP has no push-bombing risk but can be typed into a fake site. CISA treats number-matching push as an interim step toward phishing-resistant MFA.", "summary": "Neither is phishing-resistant. Push is easier to use but adds a specific weakness, MFA fatigue, where attackers send prompts until the user approves; number matching reduces it. TOTP has no push-bombing risk but can be typed into a fake site. CISA treats number-matching push as an interim step toward phishing-resistant MFA.", "date_published": "2026-09-24T00:00:00Z", "date_modified": "2026-09-24T00:00:00Z", "tags": [ "Comparison", "Authenticator apps (TOTP)", "Phishing-resistant MFA", "CISA" ] }, { "id": "https://glide-cleartext.pages.dev/compare/synced-vs-device-bound-passkeys/#rev-1", "url": "https://glide-cleartext.pages.dev/compare/synced-vs-device-bound-passkeys/", "title": "Synced vs device-bound passkeys", "content_text": "Both are phishing-resistant, because both are bound to the website’s domain. Synced passkeys survive a lost phone and suit consumers; the trade-off is that the sync account becomes a target. Device-bound passkeys keep the key on one piece of hardware and are the choice for administrators and AAL3 use cases.", "summary": "Both are phishing-resistant, because both are bound to the website’s domain. Synced passkeys survive a lost phone and suit consumers; the trade-off is that the sync account becomes a target. Device-bound passkeys keep the key on one piece of hardware and are the choice for administrators and AAL3 use cases.", "date_published": "2026-09-24T00:00:00Z", "date_modified": "2026-09-24T00:00:00Z", "tags": [ "Comparison", "Passkeys", "Phishing-resistant MFA", "NIST SP 800-63-4", "FIDO Alliance" ] }, { "id": "https://glide-cleartext.pages.dev/compare/sms-otp-vs-passkeys/#rev-1", "url": "https://glide-cleartext.pages.dev/compare/sms-otp-vs-passkeys/", "title": "SMS OTP vs passkeys", "content_text": "Passkeys are more secure on every attack that matters for consumer logins: they can’t be phished, relayed by an OTP bot or redirected by a SIM swap. SMS still reaches more people, which is why NIST keeps it as a restricted fallback. Use passkeys as the default and SMS only where a user has nothing else.", "summary": "Passkeys are more secure on every attack that matters for consumer logins: they can’t be phished, relayed by an OTP bot or redirected by a SIM swap. SMS still reaches more people, which is why NIST keeps it as a restricted fallback. Use passkeys as the default and SMS only where a user has nothing else.", "date_published": "2026-09-24T00:00:00Z", "date_modified": "2026-09-24T00:00:00Z", "tags": [ "Comparison", "SMS one-time passcodes", "Passkeys", "Phishing-resistant MFA", "NIST SP 800-63-4" ] }, { "id": "https://glide-cleartext.pages.dev/compare/sms-otp-vs-email-otp/#rev-1", "url": "https://glide-cleartext.pages.dev/compare/sms-otp-vs-email-otp/", "title": "SMS OTP vs email OTP", "content_text": "Neither is strong. SMS codes are exposed to SIM swaps; email codes to mailbox takeover. Both can be phished and read out to an OTP bot. Regulators treat them as one class of risk: the UAE and the Philippines retired both together. Switching from one to the other is not a security upgrade.", "summary": "Neither is strong. SMS codes are exposed to SIM swaps; email codes to mailbox takeover. Both can be phished and read out to an OTP bot. Regulators treat them as one class of risk: the UAE and the Philippines retired both together. Switching from one to the other is not a security upgrade.", "date_published": "2026-09-24T00:00:00Z", "date_modified": "2026-09-24T00:00:00Z", "tags": [ "Comparison", "SMS one-time passcodes", "Central Bank of the UAE", "Bangko Sentral ng Pilipinas" ] }, { "id": "https://glide-cleartext.pages.dev/compare/sms-otp-vs-authenticator-apps/#rev-1", "url": "https://glide-cleartext.pages.dev/compare/sms-otp-vs-authenticator-apps/", "title": "SMS OTP vs authenticator apps", "content_text": "Authenticator apps are better than SMS because the code is generated on the device, so a SIM swap or intercepted text can’t expose it. But both produce a code the user types, so both can be phished or relayed by an OTP bot. An authenticator app is an upgrade step, not the end state.", "summary": "Authenticator apps are better than SMS because the code is generated on the device, so a SIM swap or intercepted text can’t expose it. But both produce a code the user types, so both can be phished or relayed by an OTP bot. An authenticator app is an upgrade step, not the end state.", "date_published": "2026-09-24T00:00:00Z", "date_modified": "2026-09-24T00:00:00Z", "tags": [ "Comparison", "SMS one-time passcodes", "Authenticator apps (TOTP)", "SIM swap" ] }, { "id": "https://glide-cleartext.pages.dev/compare/number-verification-vs-silent-network-authentication/#rev-2", "url": "https://glide-cleartext.pages.dev/compare/number-verification-vs-silent-network-authentication/", "title": "Number verification vs silent network authentication", "content_text": "Largely the same check under two names. “Number Verification” is the standardized CAMARA API; “silent network authentication” describes the experience, and vendors use it for a range of implementations. Both prove the request came from a SIM, not who is holding the phone. Ask a vendor which API they actually call.", "summary": "Largely the same check under two names. “Number Verification” is the standardized CAMARA API; “silent network authentication” describes the experience, and vendors use it for a range of implementations. Both prove the request came from a SIM, not who is holding the phone. Ask a vendor which API they actually call.", "date_published": "2026-09-24T00:00:00Z", "date_modified": "2026-09-24T00:00:00Z", "tags": [ "Comparison", "Carrier-based authentication", "GSMA", "SIM swap" ] }, { "id": "https://glide-cleartext.pages.dev/q/is-email-otp-safer-than-sms/#rev-1", "url": "https://glide-cleartext.pages.dev/q/is-email-otp-safer-than-sms/", "title": "Is email OTP safer than SMS OTP?", "content_text": "Not meaningfully. Email codes avoid SIM swaps but can be phished, relayed by OTP bots and stolen through a compromised mailbox, just like SMS codes. Regulators treat them as the same class of risk: the UAE and Philippine rules retire SMS and email codes together.", "summary": "Not meaningfully. Email codes avoid SIM swaps but can be phished, relayed by OTP bots and stolen through a compromised mailbox, just like SMS codes. Regulators treat them as the same class of risk: the UAE and Philippine rules retire SMS and email codes together.", "date_published": "2026-09-24T00:00:00Z", "date_modified": "2026-09-24T00:00:00Z", "tags": [ "Question", "SMS one-time passcodes", "Central Bank of the UAE", "Bangko Sentral ng Pilipinas" ] }, { "id": "https://glide-cleartext.pages.dev/q/is-sms-otp-still-allowed-under-nist-800-63-4/#rev-2", "url": "https://glide-cleartext.pages.dev/q/is-sms-otp-still-allowed-under-nist-800-63-4/", "title": "Is SMS OTP still allowed under NIST SP 800-63-4?", "content_text": "Yes, with conditions. NIST SP 800-63B-4 keeps SMS and voice one-time passcodes as “restricted” authenticators. An organization that offers them must provide a non-restricted alternative, explain the risks to users, assess the risk of continuing, and keep a plan to migrate away. SMS codes are not phishing-resistant.", "summary": "Yes, with conditions. NIST SP 800-63B-4 keeps SMS and voice one-time passcodes as “restricted” authenticators. An organization that offers them must provide a non-restricted alternative, explain the risks to users, assess the risk of continuing, and keep a plan to migrate away. SMS codes are not phishing-resistant.", "date_published": "2026-09-22T00:00:00Z", "date_modified": "2026-09-24T00:00:00Z", "tags": [ "Question", "SMS one-time passcodes", "NIST SP 800-63-4", "NIST" ] }, { "id": "https://glide-cleartext.pages.dev/checklists/respond-to-a-sim-swap/#rev-1", "url": "https://glide-cleartext.pages.dev/checklists/respond-to-a-sim-swap/", "title": "How to respond to a SIM swap", "content_text": "What to do, in order, if your phone suddenly loses service and you suspect someone has moved your number: recover the number, lock down email, then banks, then everything that used SMS.", "summary": "What to do, in order, if your phone suddenly loses service and you suspect someone has moved your number: recover the number, lock down email, then banks, then everything that used SMS.", "date_published": "2026-09-24T00:00:00Z", "date_modified": "2026-09-24T00:00:00Z", "tags": [ "Checklist", "SIM swap", "Federal Communications Commission", "SMS one-time passcodes" ] }, { "id": "https://glide-cleartext.pages.dev/checklists/patch-a-kev-entry/#rev-1", "url": "https://glide-cleartext.pages.dev/checklists/patch-a-kev-entry/", "title": "How to patch a CISA KEV entry", "content_text": "A repeatable process for handling a vulnerability CISA has added to the Known Exploited Vulnerabilities catalog: confirm exposure, read the required action, patch or mitigate, check for compromise, and record completion before the due date.", "summary": "A repeatable process for handling a vulnerability CISA has added to the Known Exploited Vulnerabilities catalog: confirm exposure, read the required action, patch or mitigate, check for compromise, and record completion before the due date.", "date_published": "2026-09-24T00:00:00Z", "date_modified": "2026-09-24T00:00:00Z", "tags": [ "Checklist", "CISA KEV catalog", "CISA" ] }, { "id": "https://glide-cleartext.pages.dev/checklists/migrate-a-bank-off-sms-otp/#rev-1", "url": "https://glide-cleartext.pages.dev/checklists/migrate-a-bank-off-sms-otp/", "title": "How to migrate a bank off SMS OTP", "content_text": "A sequenced plan for retiring SMS one-time passcodes flow by flow: inventory, meet NIST’s restricted-authenticator conditions in the meantime, ship phishing-resistant replacements, harden recovery, then switch SMS off with a date.", "summary": "A sequenced plan for retiring SMS one-time passcodes flow by flow: inventory, meet NIST’s restricted-authenticator conditions in the meantime, ship phishing-resistant replacements, harden recovery, then switch SMS off with a date.", "date_published": "2026-09-24T00:00:00Z", "date_modified": "2026-09-24T00:00:00Z", "tags": [ "Checklist", "SMS one-time passcodes", "NIST SP 800-63-4", "Passkeys", "SIM swap", "OTP bots" ] }, { "id": "https://glide-cleartext.pages.dev/checklists/harden-account-recovery-against-sim-swap/#rev-1", "url": "https://glide-cleartext.pages.dev/checklists/harden-account-recovery-against-sim-swap/", "title": "How to harden account recovery against SIM swap", "content_text": "Account recovery is where SIM-swap and phishing attacks cash out. These steps stop a hijacked phone number from being enough to take over an account.", "summary": "Account recovery is where SIM-swap and phishing attacks cash out. These steps stop a hijacked phone number from being enough to take over an account.", "date_published": "2026-09-24T00:00:00Z", "date_modified": "2026-09-24T00:00:00Z", "tags": [ "Checklist", "SIM swap", "Passkeys", "Carrier-based authentication", "SMS one-time passcodes" ] }, { "id": "https://glide-cleartext.pages.dev/q/how-many-vulnerabilities-are-in-the-cisa-kev-catalog/#rev-1", "url": "https://glide-cleartext.pages.dev/q/how-many-vulnerabilities-are-in-the-cisa-kev-catalog/", "title": "How many vulnerabilities are in the CISA KEV catalog?", "content_text": "CISA’s Known Exploited Vulnerabilities catalog lists 1,721 vulnerabilities as of catalog version 2026.09.23, released September 23, 2026. 46 were added in the 30 days before that release, and 361 entries (21.0%) are flagged as known to be used in ransomware campaigns.", "summary": "CISA’s Known Exploited Vulnerabilities catalog lists 1,721 vulnerabilities as of catalog version 2026.09.23, released September 23, 2026. 46 were added in the 30 days before that release, and 361 entries (21.0%) are flagged as known to be used in ransomware campaigns.", "date_published": "2026-09-24T00:00:00Z", "date_modified": "2026-09-24T00:00:00Z", "tags": [ "Question", "CISA KEV catalog", "CISA" ] }, { "id": "https://glide-cleartext.pages.dev/q/how-can-banks-defend-against-sim-swap-fraud/#rev-1", "url": "https://glide-cleartext.pages.dev/q/how-can-banks-defend-against-sim-swap-fraud/", "title": "How can banks defend against SIM swap fraud?", "content_text": "Stop treating an SMS code as proof of identity for high-risk actions such as password resets, new payees and contact-detail changes. Check whether the customer’s SIM changed recently before trusting the number, offer phishing-resistant sign-in such as passkeys, and send alerts about sensitive changes to a channel the attacker doesn’t control.", "summary": "Stop treating an SMS code as proof of identity for high-risk actions such as password resets, new payees and contact-detail changes. Check whether the customer’s SIM changed recently before trusting the number, offer phishing-resistant sign-in such as passkeys, and send alerts about sensitive changes to a channel the attacker doesn’t control.", "date_published": "2026-09-24T00:00:00Z", "date_modified": "2026-09-24T00:00:00Z", "tags": [ "Question", "SIM swap", "SMS one-time passcodes", "Carrier-based authentication", "Passkeys" ] }, { "id": "https://glide-cleartext.pages.dev/q/has-any-us-regulator-banned-sms-otp/#rev-1", "url": "https://glide-cleartext.pages.dev/q/has-any-us-regulator-banned-sms-otp/", "title": "Has any US regulator banned SMS OTP?", "content_text": "No. As of this answer’s verification date, no US regulator has ordered banks or apps to stop using SMS one-time passcodes. NIST classifies them as restricted, the FCC’s 2023 rules make SIM swaps harder at carriers, and FFIEC guidance is risk-based. The bans so far are elsewhere, in markets such as the UAE and the Philippines.", "summary": "No. As of this answer’s verification date, no US regulator has ordered banks or apps to stop using SMS one-time passcodes. NIST classifies them as restricted, the FCC’s 2023 rules make SIM swaps harder at carriers, and FFIEC guidance is risk-based. The bans so far are elsewhere, in markets such as the UAE and the Philippines.", "date_published": "2026-09-24T00:00:00Z", "date_modified": "2026-09-24T00:00:00Z", "tags": [ "Question", "SMS one-time passcodes", "NIST SP 800-63-4", "Federal Communications Commission", "FFIEC" ] }, { "id": "https://glide-cleartext.pages.dev/q/do-us-banks-have-to-follow-nist-800-63/#rev-1", "url": "https://glide-cleartext.pages.dev/q/do-us-banks-have-to-follow-nist-800-63/", "title": "Do US banks have to follow NIST SP 800-63?", "content_text": "Not directly. NIST SP 800-63 is written for US federal agencies, and no banking regulator has adopted it as a rule for banks. In practice examiners, auditors and security teams use it as the benchmark for authentication strength, while the FFIEC’s 2021 guidance asks banks to match controls to risk rather than prescribing methods.", "summary": "Not directly. NIST SP 800-63 is written for US federal agencies, and no banking regulator has adopted it as a rule for banks. In practice examiners, auditors and security teams use it as the benchmark for authentication strength, while the FFIEC’s 2021 guidance asks banks to match controls to risk rather than prescribing methods.", "date_published": "2026-09-24T00:00:00Z", "date_modified": "2026-09-24T00:00:00Z", "tags": [ "Question", "NIST SP 800-63-4", "FFIEC" ] }, { "id": "https://glide-cleartext.pages.dev/q/did-the-uae-ban-sms-otp-for-banking/#rev-1", "url": "https://glide-cleartext.pages.dev/q/did-the-uae-ban-sms-otp-for-banking/", "title": "Did the UAE ban SMS OTP for banking?", "content_text": "Yes, in effect. The Central Bank of the UAE directed licensed financial institutions to phase out one-time passcodes sent by SMS and email, starting in July 2025 with a deadline of March 31, 2026. Banks moved customers to verification inside their own mobile apps on devices the bank had registered.", "summary": "Yes, in effect. The Central Bank of the UAE directed licensed financial institutions to phase out one-time passcodes sent by SMS and email, starting in July 2025 with a deadline of March 31, 2026. Banks moved customers to verification inside their own mobile apps on devices the bank had registered.", "date_published": "2026-09-23T00:00:00Z", "date_modified": "2026-09-23T00:00:00Z", "tags": [ "Question", "Central Bank of the UAE", "SMS one-time passcodes" ] }, { "id": "https://glide-cleartext.pages.dev/q/what-is-carrier-based-authentication/#rev-2", "url": "https://glide-cleartext.pages.dev/q/what-is-carrier-based-authentication/", "title": "What is carrier-based authentication?", "content_text": "Carrier-based authentication verifies a user through their mobile operator instead of sending them a code. The simplest form checks that a request comes from the SIM tied to a phone number; stronger forms use cryptographic keys held in the SIM to sign the request. It proves something about the SIM, not about the person holding the phone.", "summary": "Carrier-based authentication verifies a user through their mobile operator instead of sending them a code. The simplest form checks that a request comes from the SIM tied to a phone number; stronger forms use cryptographic keys held in the SIM to sign the request. It proves something about the SIM, not about the person holding the phone.", "date_published": "2026-09-20T00:00:00Z", "date_modified": "2026-09-20T00:00:00Z", "tags": [ "Question", "Carrier-based authentication", "GSMA", "SIM swap", "Glide Identity" ] }, { "id": "https://glide-cleartext.pages.dev/q/what-does-the-fcc-sim-swap-rule-require/#rev-2", "url": "https://glide-cleartext.pages.dev/q/what-does-the-fcc-sim-swap-rule-require/", "title": "What does the FCC SIM swap rule require?", "content_text": "The FCC’s 2023 order, FCC 23-95, requires US wireless carriers to authenticate customers securely before moving their number to a new SIM or carrier, to notify customers of SIM-change and port-out requests, to offer account locks, and to train staff and keep records. It regulates carriers, not how banks or apps use SMS codes.", "summary": "The FCC’s 2023 order, FCC 23-95, requires US wireless carriers to authenticate customers securely before moving their number to a new SIM or carrier, to notify customers of SIM-change and port-out requests, to offer account locks, and to train staff and keep records. It regulates carriers, not how banks or apps use SMS codes.", "date_published": "2026-08-10T00:00:00Z", "date_modified": "2026-09-15T00:00:00Z", "tags": [ "Question", "Federal Communications Commission", "SIM swap" ] }, { "id": "https://glide-cleartext.pages.dev/q/who-pays-when-a-uk-customer-falls-for-an-app-scam/#rev-1", "url": "https://glide-cleartext.pages.dev/q/who-pays-when-a-uk-customer-falls-for-an-app-scam/", "title": "Who pays when a UK customer falls for an APP scam?", "content_text": "Since October 7, 2024, UK payment firms must reimburse most eligible victims of authorized push payment scams made over Faster Payments, up to £85,000 per claim. The cost is split between the firm that sent the payment and the firm that received it.", "summary": "Since October 7, 2024, UK payment firms must reimburse most eligible victims of authorized push payment scams made over Faster Payments, up to £85,000 per claim. The cost is split between the firm that sent the payment and the firm that received it.", "date_published": "2026-09-12T00:00:00Z", "date_modified": "2026-09-12T00:00:00Z", "tags": [ "Question", "APP fraud", "Payment Systems Regulator (UK)" ] }, { "id": "https://glide-cleartext.pages.dev/q/what-is-app-fraud/#rev-1", "url": "https://glide-cleartext.pages.dev/q/what-is-app-fraud/", "title": "What is APP fraud?", "content_text": "Authorized push payment (APP) fraud is a scam in which the victim is tricked into sending a payment themselves, for example to someone impersonating their bank, a supplier or a romantic partner. Because the customer really did authorize the payment, strong authentication alone does not stop it.", "summary": "Authorized push payment (APP) fraud is a scam in which the victim is tricked into sending a payment themselves, for example to someone impersonating their bank, a supplier or a romantic partner. Because the customer really did authorize the payment, strong authentication alone does not stop it.", "date_published": "2026-09-12T00:00:00Z", "date_modified": "2026-09-12T00:00:00Z", "tags": [ "Question", "APP fraud", "Payment Systems Regulator (UK)" ] }, { "id": "https://glide-cleartext.pages.dev/q/what-is-a-sim-swap-attack/#rev-2", "url": "https://glide-cleartext.pages.dev/q/what-is-a-sim-swap-attack/", "title": "What is a SIM swap attack?", "content_text": "A SIM swap is when a criminal gets a mobile carrier to move a victim’s phone number to a SIM or eSIM they control, by impersonating the customer, bribing an insider or taking over the carrier account. The attacker then receives the victim’s calls and texts, including one-time passcodes and password-reset codes.", "summary": "A SIM swap is when a criminal gets a mobile carrier to move a victim’s phone number to a SIM or eSIM they control, by impersonating the customer, bribing an insider or taking over the carrier account. The attacker then receives the victim’s calls and texts, including one-time passcodes and password-reset codes.", "date_published": "2026-08-18T00:00:00Z", "date_modified": "2026-09-10T00:00:00Z", "tags": [ "Question", "SIM swap", "SMS one-time passcodes", "Federal Communications Commission" ] }, { "id": "https://glide-cleartext.pages.dev/q/how-do-i-know-if-i-have-been-sim-swapped/#rev-1", "url": "https://glide-cleartext.pages.dev/q/how-do-i-know-if-i-have-been-sim-swapped/", "title": "How do I know if I’ve been SIM swapped?", "content_text": "The clearest sign is that your phone suddenly loses service where coverage is normally fine, and calls and texts stop arriving. Other signs are a carrier notice about a SIM change or number transfer you didn’t request, and password-reset or new-login alerts from accounts you didn’t touch. Contact your carrier from another phone immediately.", "summary": "The clearest sign is that your phone suddenly loses service where coverage is normally fine, and calls and texts stop arriving. Other signs are a carrier notice about a SIM change or number transfer you didn’t request, and password-reset or new-login alerts from accounts you didn’t touch. Contact your carrier from another phone immediately.", "date_published": "2026-09-10T00:00:00Z", "date_modified": "2026-09-10T00:00:00Z", "tags": [ "Question", "SIM swap", "Federal Communications Commission" ] }, { "id": "https://glide-cleartext.pages.dev/q/are-synced-passkeys-phishing-resistant/#rev-1", "url": "https://glide-cleartext.pages.dev/q/are-synced-passkeys-phishing-resistant/", "title": "Are synced passkeys phishing-resistant?", "content_text": "Yes. A passkey is bound to the website it was created for, so the browser won’t offer it to a look-alike phishing site, and there is no code to read out. NIST SP 800-63B-4 accepts synced passkeys at AAL2. The new risk moves to the account that syncs them, which needs strong protection of its own.", "summary": "Yes. A passkey is bound to the website it was created for, so the browser won’t offer it to a look-alike phishing site, and there is no code to read out. NIST SP 800-63B-4 accepts synced passkeys at AAL2. The new risk moves to the account that syncs them, which needs strong protection of its own.", "date_published": "2026-09-05T00:00:00Z", "date_modified": "2026-09-05T00:00:00Z", "tags": [ "Question", "Passkeys", "Phishing-resistant MFA", "NIST SP 800-63-4", "FIDO Alliance" ] }, { "id": "https://glide-cleartext.pages.dev/q/what-is-an-otp-bot/#rev-1", "url": "https://glide-cleartext.pages.dev/q/what-is-an-otp-bot/", "title": "What is an OTP bot?", "content_text": "An OTP bot is an automated calling or messaging service that impersonates a bank or other service and persuades the victim to read out or type in a one-time passcode, which the criminal uses at the same moment to log in or approve a payment.", "summary": "An OTP bot is an automated calling or messaging service that impersonates a bank or other service and persuades the victim to read out or type in a one-time passcode, which the criminal uses at the same moment to log in or approve a payment.", "date_published": "2026-09-01T00:00:00Z", "date_modified": "2026-09-01T00:00:00Z", "tags": [ "Question", "OTP bots", "SMS one-time passcodes" ] }, { "id": "https://glide-cleartext.pages.dev/q/how-do-banks-stop-otp-bots/#rev-1", "url": "https://glide-cleartext.pages.dev/q/how-do-banks-stop-otp-bots/", "title": "How do banks stop OTP bots?", "content_text": "Remove the code the bot asks for: passkeys, in-app approval on a registered device and network-based checks leave the customer nothing to read out. Where a code remains, say in the message exactly what it approves and that the bank will never ask for it, and treat a new-device login during an inbound call as a fraud signal.", "summary": "Remove the code the bot asks for: passkeys, in-app approval on a registered device and network-based checks leave the customer nothing to read out. Where a code remains, say in the message exactly what it approves and that the bank will never ask for it, and treat a new-device login during an inbound call as a fraud signal.", "date_published": "2026-09-01T00:00:00Z", "date_modified": "2026-09-01T00:00:00Z", "tags": [ "Question", "OTP bots", "Phishing-resistant MFA", "SMS one-time passcodes" ] }, { "id": "https://glide-cleartext.pages.dev/q/what-is-bsp-circular-1213/#rev-1", "url": "https://glide-cleartext.pages.dev/q/what-is-bsp-circular-1213/", "title": "What is BSP Circular 1213?", "content_text": "BSP Circular No. 1213 is a Bangko Sentral ng Pilipinas rule that bars banks and other supervised financial institutions in the Philippines from using SMS or email one-time passcodes to authenticate high-risk transactions, effective June 25, 2026. It applies to transactions classed as high-risk, not to every login.", "summary": "BSP Circular No. 1213 is a Bangko Sentral ng Pilipinas rule that bars banks and other supervised financial institutions in the Philippines from using SMS or email one-time passcodes to authenticate high-risk transactions, effective June 25, 2026. It applies to transactions classed as high-risk, not to every login.", "date_published": "2026-06-26T00:00:00Z", "date_modified": "2026-06-26T00:00:00Z", "tags": [ "Question", "Bangko Sentral ng Pilipinas", "SMS one-time passcodes" ] } ] }