Tue, Oct 20, 2026KEV catalog 2026.09.23

Security intelligence for the people who build and buy defenses. Sourced, dated, and kept current.

Get the Brief
Topic hubs
SMS OTP phase-outsPasskeysSIM swapNIST 800-63-4Account takeoverTelecom identityCISA KEV
Identity & Access / Authentication & MFA

SMS one-time passcodes are “restricted” under NIST’s new guidelines. Here’s what that means for US banks

Revision 4 keeps SMS codes on the permitted list, with strings attached, and adds synced passkeys as a phishing-resistant alternative. The strings read like a migration plan.

By [Editor Name] Updated 2 min read
The short answer

NIST SP 800-63-4 does not ban SMS one-time passcodes. It classifies SMS and voice codes as “restricted” authenticators: still allowed, but only if the organization assesses the risk, tells users about it, offers at least one non-restricted alternative, and keeps a plan to migrate away.

Straight answers

Short, sourced answers to the questions security and fraud teams are asking right now. Each links to the full piece.

Is SMS OTP still allowed under NIST SP 800-63-4?

NIST SP 800-63-4 does not ban SMS one-time passcodes. It classifies SMS and voice codes as “restricted” authenticators: still allowed, but only if the organization assesses the risk, tells users about it, offers at least one non-restricted alternative, and keeps a plan to migrate away.

Updated Sep 2026 · 7 sourcesExplainer →

Which countries are moving banks off SMS OTP?

Singapore, Malaysia, the UAE and the Philippines have ordered banks off SMS or email codes for some or all transactions since 2022. India's 2025 RBI rules, in force April 2026, open the door to alternatives.

Updated Sep 2026 · 7 sourcesTracker →

What is a SIM swap attack?

A criminal persuades, tricks or bribes a mobile carrier into moving a victim’s phone number to a SIM they control. From then on the victim’s calls and texts, including one-time passcodes, go to the attacker.

Updated Sep 2026 · 2 sourcesExplainer →

Are synced passkeys phishing-resistant?

Yes. A passkey is bound to the website it was created for, so it can’t be entered on a look-alike site. NIST’s 800-63-4 update accepts synced passkeys at AAL2. The main new risk is the account that syncs them, which needs strong protection of its own.

Updated Sep 2026 · 2 sourcesExplainer →
Tracker

SMS OTP: who is phasing it out

Last verified Sep 24, 2026Download CSVEmbedMethodology
MarketRegulatorMeasureTimingStatus
UAECentral Bank of the UAESMS and email OTP phase-outJul 2025 – Mar 2026Complete
PhilippinesBangko Sentral ng PilipinasCircular 1213: no SMS or email OTP for high-risk transactionsFrom Jun 25, 2026In force
IndiaReserve Bank of IndiaAuthentication Directions 2025From Apr 1, 2026In force
SingaporeMAS and the Association of Banks in SingaporeOTP login phase-out for customers with digital tokensFrom Jul 2024In force
MalaysiaBank Negara MalaysiaBanks directed off SMS OTP2022 – 2024In force
European UnionCouncil and ParliamentPSR / PSD3 fraud and SCA packageDeal Nov 27, 2025Pending
United StatesNISTSP 800-63B-4: SMS OTP is a "restricted" authenticatorFinal 2025Guidance
Live data

KEV watch

The newest entries in CISA’s Known Exploited Vulnerabilities catalog, pulled from the official feed.

Full KEV tracker →JSON

Identity & Access

Authentication & MFAPasskeys & FIDOSIM swapTelecom identityIAM & PAM

Fraud & Payments

Account takeoverAPP fraud & scams

Policy & Regulation

United StatesEU & UKAPAC & Gulf
Reference

The glossary

Plain-language definitions, each with related terms and the stories that use them.

Browse A–Z →

Data you can reuse

All trackers →
Reference

The glossary as data

Every definition, with related terms, as JSON for your own tools.

12 terms · JSON

The Sigil Brief

Five stories and one chart, weekdays at 7am ET. Editorial only: sponsors are labeled and kept separate.