https://glide-cleartext.pages.dev/Cleartext is a reference of verified answers about authentication, fraud, exploited vulnerabilities and security regulation. Every answer leads with a 60-word summary, cites primary sources and shows when it was last verified.enhttps://glide-cleartext.pages.dev/q/which-vendors-have-the-most-cisa-kev-entries/https://glide-cleartext.pages.dev/q/which-vendors-have-the-most-cisa-kev-entries/#rev-1Thu, 24 Sep 2026 00:00:00 +0000QuestionMicrosoft has the most entries in CISA’s Known Exploited Vulnerabilities catalog, with 388 of 1,721 (22.5%), followed by Cisco (99) and Apple (94), as of catalog 2026.09.23. A high count is not by itself a measure of how secure a vendor’s products are.https://glide-cleartext.pages.dev/q/which-countries-are-banning-sms-otp/https://glide-cleartext.pages.dev/q/which-countries-are-banning-sms-otp/#rev-2Thu, 24 Sep 2026 00:00:00 +0000QuestionSingapore, Malaysia, the UAE and the Philippines have ordered banks off SMS or email codes for some or all transactions since 2022. India’s RBI Authentication Directions 2025, in force from April 2026, open the door to alternatives. The EU has a pending fraud package, and the US has issued guidance, not a ban.https://glide-cleartext.pages.dev/q/what-is-the-cisa-kev-catalog/https://glide-cleartext.pages.dev/q/what-is-the-cisa-kev-catalog/#rev-1Thu, 24 Sep 2026 00:00:00 +0000QuestionThe Known Exploited Vulnerabilities (KEV) catalog is CISA’s list of vulnerabilities with reliable evidence of active exploitation. Each entry gives a required action and a due date. US federal civilian agencies must act by that date; other organizations use the list to decide what to patch first. It holds 1,721 entries.https://glide-cleartext.pages.dev/q/what-is-phishing-resistant-mfa/https://glide-cleartext.pages.dev/q/what-is-phishing-resistant-mfa/#rev-1Thu, 24 Sep 2026 00:00:00 +0000QuestionPhishing-resistant MFA is authentication that a fake website or man-in-the-middle cannot capture and replay, because the credential is cryptographically bound to the real site. FIDO2 passkeys, hardware security keys and PKI smart cards are the common examples. SMS codes, authenticator-app codes and push approvals are not phishing-resistant.https://glide-cleartext.pages.dev/q/what-is-glide-identity-magicalauth/https://glide-cleartext.pages.dev/q/what-is-glide-identity-magicalauth/#rev-1Thu, 24 Sep 2026 00:00:00 +0000QuestionMagicalAuth is Glide Identity’s product for replacing SMS one-time passcodes. According to the company, it confirms identity through the mobile network, using the SIM’s cryptographic link to the network, with no code to type, and switches to passkeys or email links when a device doesn’t support SIM authentication. Cleartext has not independently tested it.https://glide-cleartext.pages.dev/q/what-does-restricted-authenticator-mean-in-nist-800-63b/https://glide-cleartext.pages.dev/q/what-does-restricted-authenticator-mean-in-nist-800-63b/#rev-1Thu, 24 Sep 2026 00:00:00 +0000QuestionA restricted authenticator is one NIST still permits but considers riskier, such as SMS or voice one-time passcodes. An organization that uses one takes on four obligations: offer a non-restricted alternative, tell users the risks, assess the risk of continuing, and keep a migration plan in case a future revision removes it.https://glide-cleartext.pages.dev/q/what-does-the-due-date-in-cisa-kev-mean/https://glide-cleartext.pages.dev/q/what-does-the-due-date-in-cisa-kev-mean/#rev-1Thu, 24 Sep 2026 00:00:00 +0000QuestionIt is the date by which US federal civilian executive branch agencies must complete the entry’s required action, usually applying the vendor’s update or mitigation, or stop using the product. For entries added in the past year, the median window was 14 days. For everyone else it is a useful deadline, not a legal one.https://glide-cleartext.pages.dev/compare/totp-vs-push-notifications/https://glide-cleartext.pages.dev/compare/totp-vs-push-notifications/#rev-1Thu, 24 Sep 2026 00:00:00 +0000ComparisonNeither is phishing-resistant. Push is easier to use but adds a specific weakness, MFA fatigue, where attackers send prompts until the user approves; number matching reduces it. TOTP has no push-bombing risk but can be typed into a fake site. CISA treats number-matching push as an interim step toward phishing-resistant MFA.https://glide-cleartext.pages.dev/compare/synced-vs-device-bound-passkeys/https://glide-cleartext.pages.dev/compare/synced-vs-device-bound-passkeys/#rev-1Thu, 24 Sep 2026 00:00:00 +0000ComparisonBoth are phishing-resistant, because both are bound to the website’s domain. Synced passkeys survive a lost phone and suit consumers; the trade-off is that the sync account becomes a target. Device-bound passkeys keep the key on one piece of hardware and are the choice for administrators and AAL3 use cases.https://glide-cleartext.pages.dev/compare/sms-otp-vs-passkeys/https://glide-cleartext.pages.dev/compare/sms-otp-vs-passkeys/#rev-1Thu, 24 Sep 2026 00:00:00 +0000ComparisonPasskeys are more secure on every attack that matters for consumer logins: they can’t be phished, relayed by an OTP bot or redirected by a SIM swap. SMS still reaches more people, which is why NIST keeps it as a restricted fallback. Use passkeys as the default and SMS only where a user has nothing else.https://glide-cleartext.pages.dev/compare/sms-otp-vs-email-otp/https://glide-cleartext.pages.dev/compare/sms-otp-vs-email-otp/#rev-1Thu, 24 Sep 2026 00:00:00 +0000ComparisonNeither is strong. SMS codes are exposed to SIM swaps; email codes to mailbox takeover. Both can be phished and read out to an OTP bot. Regulators treat them as one class of risk: the UAE and the Philippines retired both together. Switching from one to the other is not a security upgrade.https://glide-cleartext.pages.dev/compare/sms-otp-vs-authenticator-apps/https://glide-cleartext.pages.dev/compare/sms-otp-vs-authenticator-apps/#rev-1Thu, 24 Sep 2026 00:00:00 +0000ComparisonAuthenticator apps are better than SMS because the code is generated on the device, so a SIM swap or intercepted text can’t expose it. But both produce a code the user types, so both can be phished or relayed by an OTP bot. An authenticator app is an upgrade step, not the end state.https://glide-cleartext.pages.dev/compare/number-verification-vs-silent-network-authentication/https://glide-cleartext.pages.dev/compare/number-verification-vs-silent-network-authentication/#rev-2Thu, 24 Sep 2026 00:00:00 +0000ComparisonLargely the same check under two names. “Number Verification” is the standardized CAMARA API; “silent network authentication” describes the experience, and vendors use it for a range of implementations. Both prove the request came from a SIM, not who is holding the phone. Ask a vendor which API they actually call.https://glide-cleartext.pages.dev/q/is-email-otp-safer-than-sms/https://glide-cleartext.pages.dev/q/is-email-otp-safer-than-sms/#rev-1Thu, 24 Sep 2026 00:00:00 +0000QuestionNot meaningfully. Email codes avoid SIM swaps but can be phished, relayed by OTP bots and stolen through a compromised mailbox, just like SMS codes. Regulators treat them as the same class of risk: the UAE and Philippine rules retire SMS and email codes together.https://glide-cleartext.pages.dev/q/is-sms-otp-still-allowed-under-nist-800-63-4/https://glide-cleartext.pages.dev/q/is-sms-otp-still-allowed-under-nist-800-63-4/#rev-2Thu, 24 Sep 2026 00:00:00 +0000QuestionYes, with conditions. NIST SP 800-63B-4 keeps SMS and voice one-time passcodes as “restricted” authenticators. An organization that offers them must provide a non-restricted alternative, explain the risks to users, assess the risk of continuing, and keep a plan to migrate away. SMS codes are not phishing-resistant.https://glide-cleartext.pages.dev/checklists/respond-to-a-sim-swap/https://glide-cleartext.pages.dev/checklists/respond-to-a-sim-swap/#rev-1Thu, 24 Sep 2026 00:00:00 +0000ChecklistWhat to do, in order, if your phone suddenly loses service and you suspect someone has moved your number: recover the number, lock down email, then banks, then everything that used SMS.https://glide-cleartext.pages.dev/checklists/patch-a-kev-entry/https://glide-cleartext.pages.dev/checklists/patch-a-kev-entry/#rev-1Thu, 24 Sep 2026 00:00:00 +0000ChecklistA repeatable process for handling a vulnerability CISA has added to the Known Exploited Vulnerabilities catalog: confirm exposure, read the required action, patch or mitigate, check for compromise, and record completion before the due date.https://glide-cleartext.pages.dev/checklists/migrate-a-bank-off-sms-otp/https://glide-cleartext.pages.dev/checklists/migrate-a-bank-off-sms-otp/#rev-1Thu, 24 Sep 2026 00:00:00 +0000ChecklistA sequenced plan for retiring SMS one-time passcodes flow by flow: inventory, meet NIST’s restricted-authenticator conditions in the meantime, ship phishing-resistant replacements, harden recovery, then switch SMS off with a date.https://glide-cleartext.pages.dev/checklists/harden-account-recovery-against-sim-swap/https://glide-cleartext.pages.dev/checklists/harden-account-recovery-against-sim-swap/#rev-1Thu, 24 Sep 2026 00:00:00 +0000ChecklistAccount recovery is where SIM-swap and phishing attacks cash out. These steps stop a hijacked phone number from being enough to take over an account.https://glide-cleartext.pages.dev/q/how-many-vulnerabilities-are-in-the-cisa-kev-catalog/https://glide-cleartext.pages.dev/q/how-many-vulnerabilities-are-in-the-cisa-kev-catalog/#rev-1Thu, 24 Sep 2026 00:00:00 +0000QuestionCISA’s Known Exploited Vulnerabilities catalog lists 1,721 vulnerabilities as of catalog version 2026.09.23, released September 23, 2026. 46 were added in the 30 days before that release, and 361 entries (21.0%) are flagged as known to be used in ransomware campaigns.https://glide-cleartext.pages.dev/q/how-can-banks-defend-against-sim-swap-fraud/https://glide-cleartext.pages.dev/q/how-can-banks-defend-against-sim-swap-fraud/#rev-1Thu, 24 Sep 2026 00:00:00 +0000QuestionStop treating an SMS code as proof of identity for high-risk actions such as password resets, new payees and contact-detail changes. Check whether the customer’s SIM changed recently before trusting the number, offer phishing-resistant sign-in such as passkeys, and send alerts about sensitive changes to a channel the attacker doesn’t control.https://glide-cleartext.pages.dev/q/has-any-us-regulator-banned-sms-otp/https://glide-cleartext.pages.dev/q/has-any-us-regulator-banned-sms-otp/#rev-1Thu, 24 Sep 2026 00:00:00 +0000QuestionNo. As of this answer’s verification date, no US regulator has ordered banks or apps to stop using SMS one-time passcodes. NIST classifies them as restricted, the FCC’s 2023 rules make SIM swaps harder at carriers, and FFIEC guidance is risk-based. The bans so far are elsewhere, in markets such as the UAE and the Philippines.https://glide-cleartext.pages.dev/q/do-us-banks-have-to-follow-nist-800-63/https://glide-cleartext.pages.dev/q/do-us-banks-have-to-follow-nist-800-63/#rev-1Thu, 24 Sep 2026 00:00:00 +0000QuestionNot directly. NIST SP 800-63 is written for US federal agencies, and no banking regulator has adopted it as a rule for banks. In practice examiners, auditors and security teams use it as the benchmark for authentication strength, while the FFIEC’s 2021 guidance asks banks to match controls to risk rather than prescribing methods.https://glide-cleartext.pages.dev/q/did-the-uae-ban-sms-otp-for-banking/https://glide-cleartext.pages.dev/q/did-the-uae-ban-sms-otp-for-banking/#rev-1Wed, 23 Sep 2026 00:00:00 +0000QuestionYes, in effect. The Central Bank of the UAE directed licensed financial institutions to phase out one-time passcodes sent by SMS and email, starting in July 2025 with a deadline of March 31, 2026. Banks moved customers to verification inside their own mobile apps on devices the bank had registered.https://glide-cleartext.pages.dev/q/what-is-carrier-based-authentication/https://glide-cleartext.pages.dev/q/what-is-carrier-based-authentication/#rev-2Sun, 20 Sep 2026 00:00:00 +0000QuestionCarrier-based authentication verifies a user through their mobile operator instead of sending them a code. The simplest form checks that a request comes from the SIM tied to a phone number; stronger forms use cryptographic keys held in the SIM to sign the request. It proves something about the SIM, not about the person holding the phone.https://glide-cleartext.pages.dev/q/what-does-the-fcc-sim-swap-rule-require/https://glide-cleartext.pages.dev/q/what-does-the-fcc-sim-swap-rule-require/#rev-2Tue, 15 Sep 2026 00:00:00 +0000QuestionThe FCC’s 2023 order, FCC 23-95, requires US wireless carriers to authenticate customers securely before moving their number to a new SIM or carrier, to notify customers of SIM-change and port-out requests, to offer account locks, and to train staff and keep records. It regulates carriers, not how banks or apps use SMS codes.https://glide-cleartext.pages.dev/q/who-pays-when-a-uk-customer-falls-for-an-app-scam/https://glide-cleartext.pages.dev/q/who-pays-when-a-uk-customer-falls-for-an-app-scam/#rev-1Sat, 12 Sep 2026 00:00:00 +0000QuestionSince October 7, 2024, UK payment firms must reimburse most eligible victims of authorized push payment scams made over Faster Payments, up to £85,000 per claim. The cost is split between the firm that sent the payment and the firm that received it.https://glide-cleartext.pages.dev/q/what-is-app-fraud/https://glide-cleartext.pages.dev/q/what-is-app-fraud/#rev-1Sat, 12 Sep 2026 00:00:00 +0000QuestionAuthorized push payment (APP) fraud is a scam in which the victim is tricked into sending a payment themselves, for example to someone impersonating their bank, a supplier or a romantic partner. Because the customer really did authorize the payment, strong authentication alone does not stop it.https://glide-cleartext.pages.dev/q/what-is-a-sim-swap-attack/https://glide-cleartext.pages.dev/q/what-is-a-sim-swap-attack/#rev-2Thu, 10 Sep 2026 00:00:00 +0000QuestionA SIM swap is when a criminal gets a mobile carrier to move a victim’s phone number to a SIM or eSIM they control, by impersonating the customer, bribing an insider or taking over the carrier account. The attacker then receives the victim’s calls and texts, including one-time passcodes and password-reset codes.https://glide-cleartext.pages.dev/q/how-do-i-know-if-i-have-been-sim-swapped/https://glide-cleartext.pages.dev/q/how-do-i-know-if-i-have-been-sim-swapped/#rev-1Thu, 10 Sep 2026 00:00:00 +0000QuestionThe clearest sign is that your phone suddenly loses service where coverage is normally fine, and calls and texts stop arriving. Other signs are a carrier notice about a SIM change or number transfer you didn’t request, and password-reset or new-login alerts from accounts you didn’t touch. Contact your carrier from another phone immediately.https://glide-cleartext.pages.dev/q/are-synced-passkeys-phishing-resistant/https://glide-cleartext.pages.dev/q/are-synced-passkeys-phishing-resistant/#rev-1Sat, 05 Sep 2026 00:00:00 +0000QuestionYes. A passkey is bound to the website it was created for, so the browser won’t offer it to a look-alike phishing site, and there is no code to read out. NIST SP 800-63B-4 accepts synced passkeys at AAL2. The new risk moves to the account that syncs them, which needs strong protection of its own.https://glide-cleartext.pages.dev/q/what-is-an-otp-bot/https://glide-cleartext.pages.dev/q/what-is-an-otp-bot/#rev-1Tue, 01 Sep 2026 00:00:00 +0000QuestionAn OTP bot is an automated calling or messaging service that impersonates a bank or other service and persuades the victim to read out or type in a one-time passcode, which the criminal uses at the same moment to log in or approve a payment.https://glide-cleartext.pages.dev/q/how-do-banks-stop-otp-bots/https://glide-cleartext.pages.dev/q/how-do-banks-stop-otp-bots/#rev-1Tue, 01 Sep 2026 00:00:00 +0000QuestionRemove the code the bot asks for: passkeys, in-app approval on a registered device and network-based checks leave the customer nothing to read out. Where a code remains, say in the message exactly what it approves and that the bank will never ask for it, and treat a new-device login during an inbound call as a fraud signal.https://glide-cleartext.pages.dev/q/what-is-bsp-circular-1213/https://glide-cleartext.pages.dev/q/what-is-bsp-circular-1213/#rev-1Fri, 26 Jun 2026 00:00:00 +0000QuestionBSP Circular No. 1213 is a Bangko Sentral ng Pilipinas rule that bars banks and other supervised financial institutions in the Philippines from using SMS or email one-time passcodes to authenticate high-risk transactions, effective June 25, 2026. It applies to transactions classed as high-risk, not to every login.