{
 "name": "Sigil security glossary",
 "license": "https://creativecommons.org/licenses/by/4.0/",
 "terms": [
  {
   "term": "Account takeover (ATO)",
   "short": "Criminal control of a legitimate account.",
   "definition": "Account takeover is when a criminal gains control of a real customer's account, usually with stolen credentials, a phished one-time passcode or a hijacked phone number, and then uses it to move money, change contact details or open new products.",
   "related": [
    "otp-bot",
    "sim-swap",
    "phishing-resistant-mfa"
   ]
  },
  {
   "term": "APP fraud",
   "short": "Scams where victims authorize the payment themselves.",
   "definition": "Authorized push payment (APP) fraud is a scam in which the victim is tricked into sending a payment themselves, for example to someone impersonating their bank, a supplier or a romantic partner. Because the customer authorized it, strong authentication alone does not stop it.",
   "related": [
    "account-takeover",
    "strong-customer-authentication"
   ]
  },
  {
   "term": "CAMARA",
   "short": "Open-source project defining telecom network APIs.",
   "definition": "CAMARA is an open-source project hosted by the Linux Foundation that defines common network APIs, such as Number Verification and SIM Swap, so developers can call the same interface across different mobile operators. GSMA Open Gateway builds on it.",
   "related": [
    "number-verification",
    "silent-network-authentication"
   ]
  },
  {
   "term": "FIDO2",
   "short": "Open standard behind passkeys and security keys.",
   "definition": "FIDO2 is the FIDO Alliance's set of specifications, made up of the W3C's WebAuthn API and FIDO's CTAP protocol, that lets people sign in with public-key cryptography instead of passwords. Passkeys and hardware security keys are both FIDO2 credentials.",
   "related": [
    "passkey",
    "phishing-resistant-mfa"
   ]
  },
  {
   "term": "Number verification",
   "short": "Carrier check that a device holds a given number.",
   "definition": "Number verification is a mobile network API that confirms whether the device making a request is using the SIM registered to a given phone number, without sending the user a code.",
   "related": [
    "camara",
    "silent-network-authentication",
    "sim-swap"
   ]
  },
  {
   "term": "OTP bot",
   "short": "Automated calls that trick victims into reading out codes.",
   "definition": "An OTP bot is an automated calling or messaging service that impersonates a bank or service and persuades the victim to read out or type in a one-time passcode, which the criminal then uses in real time.",
   "related": [
    "account-takeover",
    "phishing-resistant-mfa"
   ]
  },
  {
   "term": "Passkey",
   "short": "A login credential bound to one website.",
   "definition": "A passkey is a FIDO2 credential: a key pair where the private key stays on the user's device or in their password manager, and the public key is stored by the website. Because it is bound to the site's domain, it cannot be used on a look-alike phishing site.",
   "related": [
    "fido2",
    "phishing-resistant-mfa"
   ]
  },
  {
   "term": "Phishing-resistant MFA",
   "short": "Authentication a fake site can't relay.",
   "definition": "Phishing-resistant MFA is authentication that a fake website or man-in-the-middle cannot capture and replay, because the credential is cryptographically bound to the real site. FIDO2 passkeys and security keys are the common examples. SMS codes and authenticator-app codes are not phishing-resistant.",
   "related": [
    "passkey",
    "fido2",
    "otp-bot"
   ]
  },
  {
   "term": "Silent network authentication",
   "short": "Verification through the mobile network, with no code typed.",
   "definition": "Silent network authentication verifies a user by checking, with their mobile operator, that the request comes from the SIM tied to their phone number. The check happens over the cellular data connection, so the user never sees or types a code.",
   "related": [
    "number-verification",
    "camara"
   ]
  },
  {
   "term": "SIM swap",
   "short": "Hijacking a phone number by moving it to a new SIM.",
   "definition": "A SIM swap is when a criminal gets a mobile carrier to move a victim's phone number to a SIM or eSIM they control, by social engineering, bribery or stolen credentials. The criminal then receives the victim's calls and texts, including one-time passcodes.",
   "related": [
    "account-takeover",
    "number-verification"
   ]
  },
  {
   "term": "Strong customer authentication",
   "short": "The EU's two-factor rule for payments.",
   "definition": "Strong customer authentication (SCA) is the requirement in EU payments law that customers authenticate with at least two independent factors from knowledge, possession and inherence for most electronic payments and account access.",
   "related": [
    "app-fraud"
   ]
  },
  {
   "term": "Zero trust",
   "short": "No request trusted for where it comes from alone.",
   "definition": "Zero trust is a security model in which no user, device or request is trusted because of its network location. Every access decision is made from identity, device health and context, and re-checked continuously.",
   "related": [
    "phishing-resistant-mfa"
   ]
  }
 ]
}