Index
All questions
Every question Cleartext answers, grouped by domain. Each answer starts with 60 words or fewer and shows when it was last verified.
Identity
8 answersAuthentication, passkeys, SIM swap and carrier-based verification: how people prove who they are, and how attackers get around it.
- Are synced passkeys phishing-resistant?
Yes.
- How can banks defend against SIM swap fraud?
Stop treating an SMS code as proof of identity for high-risk actions such as password resets, new payees and contact-detail changes.
- How do I know if I’ve been SIM swapped?
The clearest sign is that your phone suddenly loses service where coverage is normally fine, and calls and texts stop arriving.
- Is email OTP safer than SMS OTP?
Not meaningfully.
- What is a SIM swap attack?
A SIM swap is when a criminal gets a mobile carrier to move a victim’s phone number to a SIM or eSIM they control, by impersonating the customer, bribing an insider or taking over the carrier account.
- What is carrier-based authentication?
Carrier-based authentication verifies a user through their mobile operator instead of sending them a code.
- What is Glide Identity’s MagicalAuth, and how is it different from SMS OTP?
MagicalAuth is Glide Identity’s product for replacing SMS one-time passcodes.
- What is phishing-resistant MFA?
Phishing-resistant MFA is authentication that a fake website or man-in-the-middle cannot capture and replay, because the credential is cryptographically bound to the real site.
Fraud
4 answersAccount takeover, OTP bots and authorized push payment scams, and the controls that stop them.
- How do banks stop OTP bots?
Remove the code the bot asks for: passkeys, in-app approval on a registered device and network-based checks leave the customer nothing to read out.
- What is an OTP bot?
An OTP bot is an automated calling or messaging service that impersonates a bank or other service and persuades the victim to read out or type in a one-time passcode, which the criminal uses at the same moment to log in or approve a payment.
- What is APP fraud?
Authorized push payment (APP) fraud is a scam in which the victim is tricked into sending a payment themselves, for example to someone impersonating their bank, a supplier or a romantic partner.
- Who pays when a UK customer falls for an APP scam?
Since October 7, 2024, UK payment firms must reimburse most eligible victims of authorized push payment scams made over Faster Payments, up to £85,000 per claim.
Vulnerabilities
4 answersExploited vulnerabilities and patch deadlines, answered from CISA's Known Exploited Vulnerabilities catalog.
- How many vulnerabilities are in the CISA KEV catalog?
CISA’s Known Exploited Vulnerabilities catalog lists 1,721 vulnerabilities as of catalog version 2026.09.23, released September 23, 2026.
- What does the due date in the CISA KEV catalog mean?
It is the date by which US federal civilian executive branch agencies must complete the entry’s required action, usually applying the vendor’s update or mitigation, or stop using the product.
- What is the CISA KEV catalog?
The Known Exploited Vulnerabilities (KEV) catalog is CISA’s list of vulnerabilities with reliable evidence of active exploitation.
- Which vendors have the most CISA KEV entries?
Microsoft has the most entries in CISA’s Known Exploited Vulnerabilities catalog, with 388 of 1,721 (22.5%), followed by Cisco (99) and Apple (94), as of catalog 2026.09.23.
Regulation
8 answersWhat NIST, the FCC, the FFIEC and central banks require, with dates and the primary document for each.
- Did the UAE ban SMS OTP for banking?
Yes, in effect.
- Do US banks have to follow NIST SP 800-63?
Not directly.
- Has any US regulator banned SMS OTP?
No.
- Is SMS OTP still allowed under NIST SP 800-63-4?
Yes, with conditions.
- What does “restricted authenticator” mean in NIST SP 800-63B-4?
A restricted authenticator is one NIST still permits but considers riskier, such as SMS or voice one-time passcodes.
- What does the FCC SIM swap rule require?
The FCC’s 2023 order, FCC 23-95, requires US wireless carriers to authenticate customers securely before moving their number to a new SIM or carrier, to notify customers of SIM-change and port-out requests, to offer account locks, and to train staff and keep records.
- What is BSP Circular 1213?
BSP Circular No.
- Which countries are banning SMS OTP for banking?
Singapore, Malaysia, the UAE and the Philippines have ordered banks off SMS or email codes for some or all transactions since 2022.