{ "version": "https://jsonfeed.org/version/1.1", "title": "Sigil", "home_page_url": "https://glide-sigil.pages.dev/", "feed_url": "https://glide-sigil.pages.dev/feed.json", "description": "Sigil covers identity, fraud, vulnerabilities and security regulation with sourced explainers, live trackers and original data.", "items": [ { "id": "https://glide-sigil.pages.dev/identity/telecom-identity/glide-identity-three-carrier-beta/", "url": "https://glide-sigil.pages.dev/identity/telecom-identity/glide-identity-three-carrier-beta/", "title": "Glide Identity’s three-carrier beta: what it does, and what it still has to prove", "summary": "On August 3, 2026, Glide Identity announced a beta of what it calls carrier-native cryptographic authentication across AT&T, T-Mobile and Verizon. The company says its MagicalAuth product verifies a user through the SIM’s cryptographic link to the network instead of sending an SMS code. No independent security assessment has been published.", "content_text": "Glide Identity’s three-carrier beta: what it does, and what it still has to prove The startup says its SIM-based login now works across AT&T, T-Mobile and Verizon. Here is what the company claims, what independent reporting confirms, and the questions a bank should ask before a pilot. On August 3, 2026, Glide Identity announced a beta of what it calls carrier-native cryptographic authentication across AT&T, T-Mobile and Verizon. The company says its MagicalAuth product verifies a user through the SIM’s cryptographic link to the network instead of sending an SMS code. No independent security assessment has been published. What Glide announced On August 3, 2026, Glide Identity announced a beta of what it calls “carrier-native cryptographic authentication” across AT&T, T-Mobile and Verizon. The release includes a quote from a Verizon Business executive. Biometric Update reported the launch four days later. How the company says it works According to Glide, its MagicalAuth product “confirms identity using the SIM’s cryptographic link to the network”. When an app asks a user to log in, check out or recover an account, the check runs through the carrier in the background and, the company says, completes in under a second with no code to type. Glide says it switches to passkeys or email links when a device or operating system doesn’t support SIM authentication, and it offers SDKs for iOS, Android and the web plus a REST API. The company also sells SuperPasskey, which it describes as passkeys combined with SIM verification. How it differs from number verification A month before Glide’s beta, Aduna, a network-API joint venture, announced number verification with the same three carriers. Number verification answers a narrow question: does this request come from the SIM registered to this phone number? Glide describes its approach as cryptographic authentication anchored in the SIM, a stronger claim. Sigil has not tested either, and buyers should ask vendors to show exactly what is signed, by what key, and what the relying party can verify. The company in context - Funding: a Series A of more than $20 million in October 2025, led by Crosspoint Capital Partners. - Recognition: one of 10 finalists in the RSAC 2026 Innovation Sandbox contest. Geordie AI won. - Standards: a Sponsor-level member of the FIDO Alliance and a listed GSMA Open Gateway partner. What it still has to prove - Classification: how SIM-based cryptographic authentication fits NIST SP 800-63B-4, which restricts SMS codes. Our sources don’t address it. - Coverage: which devices, operating systems and plans work in the beta, and how often the fallback triggers. - Independent testing: we found no published third-party security assessment. - Commercials: pricing isn’t public, and the product depends on carrier agreements. - SIM swaps and eSIM transfers: the company positions the product against SIM-swap fraud. How it behaves when a number moves to a new SIM hasn’t been independently documented. What a bank should ask before a pilot 1. What exactly is verified, and can we validate the result cryptographically on our side? 2. What share of our mobile customers would be covered today, by carrier and operating system? 3. What happens on a recent SIM change or eSIM transfer? 4. How is the method documented against NIST 800-63B-4 for our auditors? 5. What data does the carrier and the vendor see, and where is it processed?", "date_published": "2026-09-24T12:00:00Z", "date_modified": "2026-09-24T12:00:00Z", "authors": [ { "name": "[Editor Name]" } ], "tags": [ "Identity & Access" ] }, { "id": "https://glide-sigil.pages.dev/policy/apac-gulf/uae-sms-otp-phase-out/", "url": "https://glide-sigil.pages.dev/policy/apac-gulf/uae-sms-otp-phase-out/", "title": "The UAE’s SMS OTP phase-out is done. What US banks can take from it", "summary": "The Central Bank of the UAE directed banks to phase out SMS and email one-time passcodes, starting in July 2025 and finishing by March 31, 2026. Banks moved customers to in-app verification in their own mobile apps.", "content_text": "The UAE’s SMS OTP phase-out is done. What US banks can take from it The Central Bank of the UAE gave banks nine months to stop sending one-time passcodes by text and email. The deadline has passed; the playbook is worth studying. The Central Bank of the UAE directed banks to phase out SMS and email one-time passcodes, starting in July 2025 and finishing by March 31, 2026. Banks moved customers to in-app verification in their own mobile apps. What did the UAE require? The Central Bank of the UAE told licensed financial institutions to stop relying on one-time passcodes sent by SMS or email to authenticate customers. The phase-out began in July 2025, with a deadline of March 31, 2026. What replaced the codes? Banks moved customers to verification inside their own mobile apps: the customer confirms a login or payment in the app on a device the bank has already registered, instead of typing a code from a text message. Why it matters outside the Gulf The UAE rule is unusually direct. Most regulators describe outcomes and leave the method to banks. Here the regulator named the method to retire and set a date. That gives US banks a finished case study rather than a forecast: - The timeline was months, not years. A defined deadline forced the migration work to the top of the roadmap. - Email went with SMS. Regulators treated both as the same class of risk, because both can be phished or intercepted. - The replacement was already in customers’ hands. Moving approval into the bank’s own app avoided a new device or a new login habit. What US banks should watch No US regulator has ordered a similar phase-out. The closest signals are NIST classifying SMS codes as restricted and the FCC’s rules on SIM-swap fraud. Sigil tracks every jurisdiction that has moved in its SMS OTP regulation tracker.", "date_published": "2026-09-23T12:00:00Z", "date_modified": "2026-09-23T12:00:00Z", "authors": [ { "name": "[Editor Name]" } ], "tags": [ "Policy & Regulation" ] }, { "id": "https://glide-sigil.pages.dev/identity/authentication/nist-800-63-4-sms-otp/", "url": "https://glide-sigil.pages.dev/identity/authentication/nist-800-63-4-sms-otp/", "title": "SMS one-time passcodes are “restricted” under NIST’s new guidelines. Here’s what that means for US banks", "summary": "NIST SP 800-63-4 does not ban SMS one-time passcodes. It classifies SMS and voice codes as “restricted” authenticators: still allowed, but only if the organization assesses the risk, tells users about it, offers at least one non-restricted alternative, and keeps a plan to migrate away.", "content_text": "SMS one-time passcodes are “restricted” under NIST’s new guidelines. Here’s what that means for US banks Revision 4 keeps SMS codes on the permitted list, with strings attached, and adds synced passkeys as a phishing-resistant alternative. The strings read like a migration plan. NIST SP 800-63-4 does not ban SMS one-time passcodes. It classifies SMS and voice codes as “restricted” authenticators: still allowed, but only if the organization assesses the risk, tells users about it, offers at least one non-restricted alternative, and keeps a plan to migrate away. What changed in NIST SP 800-63-4? NIST’s Digital Identity Guidelines are the reference US agencies must follow and that banks, auditors and examiners reach for when they argue about authentication. Revision 4, finalized in 2025, is split into three volumes: identity proofing (63A), authentication (63B) and federation (63C). For SMS, the headline is continuity. Codes sent over the phone network stay on the list of allowed authenticators, in the same “restricted” category NIST created in Revision 3. What’s new is the alternative: Revision 4 explicitly accommodates synced passkeys, the kind stored in Apple, Google or password-manager accounts, and treats them as phishing-resistant. What does “restricted” actually require? An organization that keeps offering SMS or voice codes takes on four obligations: 1. Offer an alternative that isn’t restricted, so no customer is stuck with SMS. 2. Tell users the risks of the restricted option in plain language. 3. Assess the risk to users and the organization of continuing to allow it. 4. Keep a migration plan in case the authenticator is removed in a future revision. How do the alternatives compare? Method Phishing-resistant? NIST 800-63B-4 --- --- --- SMS or voice OTP No Restricted Authenticator app code (TOTP) No Allowed at AAL2 Synced passkey Yes Allowed at AAL2 Hardware security key (FIDO2) Yes Eligible for AAL3 Carrier / SIM-based verification [Editorial: confirm] [Editorial: confirm classification] Table: Status under NIST SP 800-63B-4. Sigil analysis of sources [1] and [2]. Will the US follow the UAE and ban SMS codes? Probably not by decree. US banking regulators rarely name a technology, and the FFIEC’s 2021 authentication guidance is written in terms of risk, not methods. The pressure is arriving from other directions: NIST’s conditions, the FCC’s 2023 SIM-swap and port-out rules for carriers, and a growing list of markets where the codes are already gone. - 2022: Malaysia’s central bank directs banks off SMS OTP. - Jul 2024: Singapore banks begin phasing out OTP logins for customers with digital tokens. - 2025: NIST finalizes SP 800-63-4. - Mar 2026: The UAE completes its SMS and email OTP phase-out. - Apr 2026: India’s RBI Authentication Directions take effect. - Jun 2026: The Philippines bars SMS and email OTP for high-risk transactions. [Expert quote: from a named bank CISO or head of fraud, gathered in original reporting.] -- [Name], [Title], [Institution] What should a bank do this quarter? - Inventory every flow that still sends a code: login, step-up, password reset, new payees. - Write the risk assessment NIST asks for, and date it. - Offer a phishing-resistant option, passkeys first, and track adoption. - Start with account recovery and new-payee setup, where SIM-swap fraud tends to cash out.", "date_published": "2026-09-22T12:00:00Z", "date_modified": "2026-09-24T12:00:00Z", "authors": [ { "name": "[Editor Name]" } ], "tags": [ "Identity & Access" ] }, { "id": "https://glide-sigil.pages.dev/identity/telecom-identity/carrier-authentication-explained/", "url": "https://glide-sigil.pages.dev/identity/telecom-identity/carrier-authentication-explained/", "title": "Carrier-native authentication, explained: how a SIM can sign a login", "summary": "Carrier-based authentication verifies a user through their mobile operator instead of sending them a code. The simplest form checks that a request comes from the SIM tied to a phone number; stronger forms use cryptographic keys held in the SIM to sign the request.", "content_text": "Carrier-native authentication, explained: how a SIM can sign a login Number verification, silent network authentication and SIM-based cryptography all use the mobile network instead of a text message. They are not the same thing. Carrier-based authentication verifies a user through their mobile operator instead of sending them a code. The simplest form checks that a request comes from the SIM tied to a phone number; stronger forms use cryptographic keys held in the SIM to sign the request. Three things people call “carrier authentication” Approach What it checks What the user does --- --- --- Number verification The request comes from the SIM tied to a given number Nothing; it runs over mobile data SIM swap check Whether the number’s SIM changed recently Nothing; it’s a risk signal SIM-based cryptography A key held in the SIM signs the request Usually one tap Table: Sigil’s summary of vendor and standards documentation. Where the APIs come from The CAMARA project, hosted by the Linux Foundation, defines common network APIs such as Number Verification and SIM Swap, so developers can call the same interface across operators. GSMA Open Gateway packages those APIs commercially. What happened in the US in 2026 In July 2026, Aduna, a network-API joint venture, announced number verification with AT&T, T-Mobile and Verizon. In August, Glide Identity announced a beta of SIM-based cryptographic authentication across the same three carriers. What it doesn’t solve A network check proves something about a SIM, not about the person holding the phone. It is strongest combined with a device-bound credential and weakest as the only factor for account recovery.", "date_published": "2026-09-20T12:00:00Z", "date_modified": "2026-09-20T12:00:00Z", "authors": [ { "name": "[Editor Name]" } ], "tags": [ "Identity & Access" ] }, { "id": "https://glide-sigil.pages.dev/fraud/app-fraud/uk-app-fraud-reimbursement/", "url": "https://glide-sigil.pages.dev/fraud/app-fraud/uk-app-fraud-reimbursement/", "title": "What the UK’s APP fraud reimbursement rules changed for fraud teams", "summary": "Since October 7, 2024, UK payment service providers must reimburse most victims of authorized push payment scams on Faster Payments, up to £85,000 per claim, with the cost split between the sending and receiving firms.", "content_text": "What the UK’s APP fraud reimbursement rules changed for fraud teams Since October 2024, UK payment firms split the cost of reimbursing most authorized push payment scam victims. The incentive to stop scams moved to the receiving side too. Since October 7, 2024, UK payment service providers must reimburse most victims of authorized push payment scams on Faster Payments, up to £85,000 per claim, with the cost split between the sending and receiving firms. What the rules require From October 7, 2024, payment firms sending Faster Payments must reimburse eligible victims of authorized push payment (APP) scams, up to a maximum of £85,000 per claim. The cost is shared between the firm that sent the payment and the firm that received it. Why authentication isn’t the answer here In an APP scam the customer authorizes the payment themselves. Strong authentication confirms it really was the customer, which is exactly the problem. Defenses have to look at the payment’s context: a new payee, an unusual amount, or a customer who is on the phone with someone claiming to be their bank. What changed for fraud teams - Receiving firms now pay too, which gives them a reason to spot and freeze mule accounts. - Friction at the point of payment became easier to justify: confirmation-of-payee warnings, holds and calls. - Data sharing between firms matters more when both sides carry the loss.", "date_published": "2026-09-12T12:00:00Z", "date_modified": "2026-09-12T12:00:00Z", "authors": [ { "name": "[Editor Name]" } ], "tags": [ "Fraud & Payments" ] }, { "id": "https://glide-sigil.pages.dev/identity/passkeys/synced-passkeys-phishing-resistant/", "url": "https://glide-sigil.pages.dev/identity/passkeys/synced-passkeys-phishing-resistant/", "title": "Are synced passkeys phishing-resistant?", "summary": "Yes. A passkey is bound to the website it was created for, so it can’t be entered on a look-alike site. NIST’s 800-63-4 update accepts synced passkeys at AAL2. The main new risk is the account that syncs them, which needs strong protection of its own.", "content_text": "Are synced passkeys phishing-resistant? Passkeys that sync across a user’s devices trade some control for usability. Here is what stays phishing-resistant, and what moves to the sync account. Yes. A passkey is bound to the website it was created for, so it can’t be entered on a look-alike site. NIST’s 800-63-4 update accepts synced passkeys at AAL2. The main new risk is the account that syncs them, which needs strong protection of its own. Why passkeys resist phishing A passkey is a key pair. The website stores the public key; the private key stays with the user. When the user signs in, the browser checks the site’s domain and only offers the passkey registered for that exact domain. A phishing page on a look-alike domain never receives a credential it could replay. What syncing changes Synced passkeys are copied across the user’s devices through a provider such as Apple, Google or a password manager. That fixes the biggest usability problem of device-bound credentials, losing the device, but it moves part of the risk to the sync account. If an attacker takes over that account, they may be able to restore the user’s passkeys to a device they control. How NIST treats them NIST’s 800-63-4 guidelines accept synced passkeys at authentication assurance level 2 (AAL2), the level most consumer and banking logins target. High-assurance use cases that require AAL3 still call for hardware-bound keys. What to do if you run a login - Offer passkeys as the default for returning users. - Protect recovery: account recovery is where passkey deployments get attacked, so don’t fall back to SMS codes there. - Keep a device-bound option for administrators and other high-risk users.", "date_published": "2026-09-05T12:00:00Z", "date_modified": "2026-09-05T12:00:00Z", "authors": [ { "name": "[Editor Name]" } ], "tags": [ "Identity & Access" ] }, { "id": "https://glide-sigil.pages.dev/fraud/account-takeover/otp-bots-explained/", "url": "https://glide-sigil.pages.dev/fraud/account-takeover/otp-bots-explained/", "title": "Why OTP bots keep working against bank customers", "summary": "An OTP bot is an automated calling or messaging service that impersonates a bank or other service and persuades the victim to read out or type in a one-time passcode, which the criminal uses at the same moment to log in or approve a payment.", "content_text": "Why OTP bots keep working against bank customers Automated calls that impersonate a bank get customers to hand over one-time passcodes in real time. The weakness is the code itself. An OTP bot is an automated calling or messaging service that impersonates a bank or other service and persuades the victim to read out or type in a one-time passcode, which the criminal uses at the same moment to log in or approve a payment. How an OTP bot attack works 1. The criminal already has the victim’s username and password, usually from a breach or a phishing page. 2. They start a login or payment, which makes the bank send the victim a one-time passcode. 3. At the same moment, the bot calls the victim, claims to be the bank’s fraud team, and asks them to “confirm” the code they just received. 4. The victim reads it out or types it into the keypad, and the bot passes it straight to the criminal. Why it keeps working The call arrives exactly when the real code does, which makes it convincing. And a one-time passcode has no way of knowing who is typing it in or where: it works for anyone who has it within its validity window. What stops it - Remove the code: passkeys, in-app approval on a registered device and network-based verification leave the customer nothing to read out. - Put context in the message: if a code is unavoidable, say what it approves (“to add payee J. Smith”) and that the bank will never ask for it. - Watch the timing: a login from a new device while the customer is on an inbound call is a strong fraud signal.", "date_published": "2026-09-01T12:00:00Z", "date_modified": "2026-09-01T12:00:00Z", "authors": [ { "name": "[Editor Name]" } ], "tags": [ "Fraud & Payments" ] }, { "id": "https://glide-sigil.pages.dev/identity/sim-swap/sim-swap-attacks-explained/", "url": "https://glide-sigil.pages.dev/identity/sim-swap/sim-swap-attacks-explained/", "title": "SIM swap attacks, explained", "summary": "A criminal persuades, tricks or bribes a mobile carrier into moving a victim’s phone number to a SIM they control. From then on the victim’s calls and texts, including one-time passcodes, go to the attacker.", "content_text": "SIM swap attacks, explained How criminals take over a phone number, why it unlocks so many accounts, and what carriers, banks and customers can do about it. A criminal persuades, tricks or bribes a mobile carrier into moving a victim’s phone number to a SIM they control. From then on the victim’s calls and texts, including one-time passcodes, go to the attacker. How does a SIM swap work? A phone number belongs to an account at the carrier, not to a piece of plastic. A SIM swap exploits the process carriers use to move a number to a new SIM or eSIM, for example when a customer loses their phone. The attacker gets the carrier to do that move for them, using one of three routes: - Social engineering: calling or visiting a store while impersonating the customer, often with personal details from data breaches. - Insiders: paying a carrier or retail employee to make the change. - Account takeover: logging into the customer’s carrier account online with stolen credentials. Once the number moves, the victim’s phone loses service and the attacker’s device starts receiving their calls and texts. Why is it so damaging? Phone numbers became the default recovery and verification channel for email, banking and crypto accounts. An attacker holding the number can request password resets and receive the one-time passcodes that confirm them. That is why SIM swaps often end in drained bank or crypto accounts within hours. What are carriers now required to do? In November 2023 the FCC adopted rules requiring US wireless carriers to use secure methods to authenticate a customer before moving their number to a new device or provider, to notify customers promptly of SIM change and port-out requests, and to offer account locks. See Sigil’s explainer on the FCC’s SIM-swap rules. How can banks and apps defend against it? - Stop treating an SMS code as proof of identity for high-risk actions like password resets or adding a payee. - Check for recent SIM changes before trusting the number. Carrier network APIs can report whether a number’s SIM changed recently. - Offer phishing-resistant options such as passkeys, so the phone number isn’t the key to the account.", "date_published": "2026-08-18T12:00:00Z", "date_modified": "2026-09-10T12:00:00Z", "authors": [ { "name": "[Editor Name]" } ], "tags": [ "Identity & Access" ] }, { "id": "https://glide-sigil.pages.dev/policy/us/fcc-sim-swap-rules/", "url": "https://glide-sigil.pages.dev/policy/us/fcc-sim-swap-rules/", "title": "The FCC’s SIM-swap rules: what carriers now have to do", "summary": "The FCC’s 2023 order (FCC 23-95) requires US wireless carriers to authenticate customers securely before moving their number to a new SIM or provider, to notify customers of SIM change and port-out requests, and to offer account locks. It does not regulate how banks or apps use SMS codes.", "content_text": "The FCC’s SIM-swap rules: what carriers now have to do The 2023 order puts the burden on wireless carriers to authenticate customers before a phone number moves. Here is what it requires, and what it doesn’t. The FCC’s 2023 order (FCC 23-95) requires US wireless carriers to authenticate customers securely before moving their number to a new SIM or provider, to notify customers of SIM change and port-out requests, and to offer account locks. It does not regulate how banks or apps use SMS codes. What does the order require? The Report and Order, adopted on November 15, 2023, amends the FCC’s customer proprietary network information (CPNI) and number-portability rules. Wireless carriers must: - Authenticate securely before redirecting a customer’s number to a new device or another carrier. - Handle failed attempts: have procedures for responding to failed authentication. - Notify customers promptly when a SIM change or port-out is requested. - Offer account locks that customers can switch on to block number changes. - Train staff and keep records of SIM change and port-out requests. When did it take effect? The rules were published in the Federal Register on December 8, 2023. The FCC later waived the original July 2024 compliance date while the rules’ information-collection requirements went through federal review. Check the FCC’s current notice before citing a compliance date. What doesn’t it cover? The order regulates carriers. It says nothing about whether a bank or app should keep using SMS codes. A carrier that follows the rules makes SIM swaps harder, but a bank that still treats an SMS code as proof of identity remains exposed to insiders, to account takeover at the carrier, and to phishing of the code itself.", "date_published": "2026-08-10T12:00:00Z", "date_modified": "2026-09-15T12:00:00Z", "authors": [ { "name": "[Editor Name]" } ], "tags": [ "Policy & Regulation" ] }, { "id": "https://glide-sigil.pages.dev/policy/apac-gulf/philippines-bsp-circular-1213/", "url": "https://glide-sigil.pages.dev/policy/apac-gulf/philippines-bsp-circular-1213/", "title": "Inside BSP Circular 1213, the Philippines’ OTP rule", "summary": "Bangko Sentral ng Pilipinas Circular No. 1213 bars banks and other supervised financial institutions from using SMS or email one-time passcodes to authenticate high-risk transactions, starting June 25, 2026.", "content_text": "Inside BSP Circular 1213, the Philippines’ OTP rule From June 25, 2026, banks and e-money issuers in the Philippines can no longer rely on SMS or email one-time passcodes for high-risk transactions. Bangko Sentral ng Pilipinas Circular No. 1213 bars banks and other supervised financial institutions from using SMS or email one-time passcodes to authenticate high-risk transactions, starting June 25, 2026. What the circular changes Banks and other institutions supervised by the Bangko Sentral ng Pilipinas can no longer use one-time passcodes sent by SMS or email to authenticate high-risk transactions. The rule took effect on June 25, 2026. Why SMS and email together Regulators increasingly treat both channels as the same weakness. Codes sent by text or email can be phished, intercepted, or handed over by a customer who has been convinced they are talking to their bank. Where it fits The Philippines joins Singapore, Malaysia and the UAE in moving banks off SMS codes. Sigil tracks each of them in the SMS OTP regulation tracker.", "date_published": "2026-06-26T12:00:00Z", "date_modified": "2026-06-26T12:00:00Z", "authors": [ { "name": "[Editor Name]" } ], "tags": [ "Policy & Regulation" ] }, { "id": "https://glide-sigil.pages.dev/policy/apac-gulf/singapore-banks-phase-out-otp/", "url": "https://glide-sigil.pages.dev/policy/apac-gulf/singapore-banks-phase-out-otp/", "title": "Singapore banks to phase out OTPs for customers with digital tokens", "summary": "In July 2024 the Monetary Authority of Singapore and the Association of Banks in Singapore announced that major retail banks would phase out one-time passcodes for bank account logins by customers who have digital tokens activated on their mobile devices.", "content_text": "Singapore banks to phase out OTPs for customers with digital tokens MAS and the Association of Banks in Singapore say customers who have activated a digital token on their phone will no longer be able to log in with a one-time passcode. In July 2024 the Monetary Authority of Singapore and the Association of Banks in Singapore announced that major retail banks would phase out one-time passcodes for bank account logins by customers who have digital tokens activated on their mobile devices. What was announced The Monetary Authority of Singapore and the Association of Banks in Singapore said major retail banks would phase out the use of one-time passcodes for logging into bank accounts, for customers who have activated a digital token on their mobile device. Why Phishing sites imitating banks can capture a customer’s password and OTP and use them immediately. A digital token bound to the customer’s registered device can’t be relayed that way. What customers see Instead of typing a code, customers approve logins with the digital token in their bank’s app.", "date_published": "2024-07-09T12:00:00Z", "date_modified": "2024-07-09T12:00:00Z", "authors": [ { "name": "[Editor Name]" } ], "tags": [ "Policy & Regulation" ] } ] }