Reference
Glossary
Definitions of the terms used in Cleartext answers, each linked to the answer that explains it.
A
- Account takeover (ATO)
When a criminal gains control of a real customer's account, usually with stolen credentials, a phished one-time passcode or a hijacked phone number, and then uses it to move money, change contact details or open new products.
What is an OTP bot? Topic: OTP bots
- APP fraud
Authorized push payment fraud: a scam in which the victim is tricked into sending a payment themselves, for example to someone impersonating their bank, a supplier or a romantic partner. Because the customer authorized it, strong authentication alone does not stop it.
What is APP fraud? Topic: APP fraud
- Authentication assurance level (AAL)
NIST SP 800-63B's three-step scale for how strongly a login proves the user controls their authenticators. AAL1 is the lowest, AAL2 is the level most consumer and banking logins target, and AAL3, the highest, calls for a phishing-resistant authenticator with a non-exportable key, such as a hardware security key.
Is SMS OTP still allowed under NIST SP 800-63-4? Topic: NIST SP 800-63-4
C
- CAMARA
An open-source project hosted by the Linux Foundation that defines common network APIs, such as Number Verification and SIM Swap, so developers can call the same interface across different mobile operators. GSMA Open Gateway builds on it.
What is carrier-based authentication? Topic: Carrier-based authentication
- CVE
Common Vulnerabilities and Exposures: the public naming scheme that gives each disclosed vulnerability an identifier such as CVE-2026-12345. CISA only adds vulnerabilities with a CVE ID to its KEV catalog.
F
- FIDO2
The FIDO Alliance's set of specifications, made up of the W3C's WebAuthn API and FIDO's CTAP protocol, that lets people sign in with public-key cryptography instead of passwords. Passkeys and hardware security keys are both FIDO2 credentials.
K
- Known Exploited Vulnerabilities (KEV)
CISA's catalog of vulnerabilities that have reliable evidence of active exploitation. Each entry names a required action and a due date by which US federal civilian agencies must act.
M
- MFA fatigue (push bombing)
An attack on push-notification MFA in which the attacker, already holding the password, triggers repeated approval prompts until the user accepts one. Number matching, where the user types a number shown on the login screen, reduces it.
N
- Number verification
A mobile network API that confirms whether the device making a request is using the SIM registered to a given phone number, without sending the user a code.
What is carrier-based authentication? Topic: Carrier-based authentication
O
- One-time passcode (OTP)
A short code that is valid for one login or transaction, delivered by SMS, voice call or email, or generated by an authenticator app. Whoever holds the code within its validity window can use it.
Is SMS OTP still allowed under NIST SP 800-63-4? Topic: SMS one-time passcodes
- OTP bot
An automated calling or messaging service that impersonates a bank or service and persuades the victim to read out or type in a one-time passcode, which the criminal then uses in real time.
What is an OTP bot? Topic: OTP bots
P
- Passkey
A FIDO2 credential: a key pair where the private key stays on the user's device or in their password manager, and the public key is stored by the website. Because it is bound to the site's domain, it cannot be used on a look-alike phishing site.
- Phishing-resistant MFA
Authentication that a fake website or man-in-the-middle cannot capture and replay, because the credential is cryptographically bound to the real site. FIDO2 passkeys and security keys are the common examples. SMS codes and authenticator-app codes are not phishing-resistant.
What is phishing-resistant MFA? Topic: Phishing-resistant MFA
- Port-out fraud
A variant of SIM swap in which the criminal transfers the victim's phone number to a different carrier, rather than to a new SIM at the same carrier. The FCC's 2023 rules cover both.
R
- Restricted authenticator
NIST SP 800-63B's label for an authenticator that is still permitted but carries extra risk, such as SMS or voice one-time passcodes. Using one obliges the organization to offer an alternative, warn users, assess the risk and plan a migration.
What does “restricted authenticator” mean in NIST SP 800-63B-4? Topic: NIST SP 800-63-4
S
- Silent network authentication
Verifying a user by checking, with their mobile operator, that the request comes from the SIM tied to their phone number. The check runs over the cellular data connection, so the user never sees or types a code.
What is carrier-based authentication? Topic: Carrier-based authentication
- SIM swap
When a criminal gets a mobile carrier to move a victim's phone number to a SIM or eSIM they control, by social engineering, bribery or stolen credentials. The criminal then receives the victim's calls and texts, including one-time passcodes.
- Strong customer authentication (SCA)
The requirement in EU payments law that customers authenticate with at least two independent factors from knowledge, possession and inherence for most electronic payments and account access.
Which countries are banning SMS OTP for banking? Topic: EU PSD3 and Payment Services Regulation
T
- TOTP
Time-based one-time password: a code computed by an authenticator app from a secret shared at enrollment and the current time, defined in IETF RFC 6238. It is never sent over a network, but it can still be phished.
Z
- Zero trust
A security model in which no user, device or request is trusted because of its network location. Every access decision is made from identity, device health and context, and re-checked continuously.
What is phishing-resistant MFA? Topic: Phishing-resistant MFA