Explainer · Authentication & MFA
SMS one-time passcodes are “restricted” under NIST’s new guidelines. Here’s what that means for US banks
Revision 4 keeps SMS codes on the permitted list, with strings attached, and adds synced passkeys as a phishing-resistant alternative. The strings read like a migration plan.