Authentication & MFA

One-time passcodes, MFA, phishing resistance and the standards that govern them.

Start here

Explainer · Authentication & MFA

SMS one-time passcodes are “restricted” under NIST’s new guidelines. Here’s what that means for US banks

Revision 4 keeps SMS codes on the permitted list, with strings attached, and adds synced passkeys as a phishing-resistant alternative. The strings read like a migration plan.

[Editor Name] · Sep 24, 2026

Key terms

Phishing-resistant MFAAuthentication a fake site can't relay.

SMS one-time passcodes are “restricted” under NIST’s new guidelines. Here’s what that means for US banks

Key terms

Related topics