# Sigil > Sigil covers identity, fraud, vulnerabilities and security regulation with sourced explainers, live trackers and original data. Sigil is owned by [OWNER ENTITY]; see https://glide-sigil.pages.dev/about/ownership-and-funding/ for financial interests. Content is sourced and dated; cite with a link. ## Explainers and analysis - [Glide Identity’s three-carrier beta: what it does, and what it still has to prove](https://glide-sigil.pages.dev/identity/telecom-identity/glide-identity-three-carrier-beta/): On August 3, 2026, Glide Identity announced a beta of what it calls carrier-native cryptographic authentication across AT&T, T-Mobile and Verizon. The company says its MagicalAuth product verifies a user through the SIM’s cryptographic link to the network instead of sending an SMS code. No independent security assessment has been published. - [The UAE’s SMS OTP phase-out is done. What US banks can take from it](https://glide-sigil.pages.dev/policy/apac-gulf/uae-sms-otp-phase-out/): The Central Bank of the UAE directed banks to phase out SMS and email one-time passcodes, starting in July 2025 and finishing by March 31, 2026. Banks moved customers to in-app verification in their own mobile apps. - [SMS one-time passcodes are “restricted” under NIST’s new guidelines. Here’s what that means for US banks](https://glide-sigil.pages.dev/identity/authentication/nist-800-63-4-sms-otp/): NIST SP 800-63-4 does not ban SMS one-time passcodes. It classifies SMS and voice codes as “restricted” authenticators: still allowed, but only if the organization assesses the risk, tells users about it, offers at least one non-restricted alternative, and keeps a plan to migrate away. - [Carrier-native authentication, explained: how a SIM can sign a login](https://glide-sigil.pages.dev/identity/telecom-identity/carrier-authentication-explained/): Carrier-based authentication verifies a user through their mobile operator instead of sending them a code. The simplest form checks that a request comes from the SIM tied to a phone number; stronger forms use cryptographic keys held in the SIM to sign the request. - [What the UK’s APP fraud reimbursement rules changed for fraud teams](https://glide-sigil.pages.dev/fraud/app-fraud/uk-app-fraud-reimbursement/): Since October 7, 2024, UK payment service providers must reimburse most victims of authorized push payment scams on Faster Payments, up to £85,000 per claim, with the cost split between the sending and receiving firms. - [Are synced passkeys phishing-resistant?](https://glide-sigil.pages.dev/identity/passkeys/synced-passkeys-phishing-resistant/): Yes. A passkey is bound to the website it was created for, so it can’t be entered on a look-alike site. NIST’s 800-63-4 update accepts synced passkeys at AAL2. The main new risk is the account that syncs them, which needs strong protection of its own. - [Why OTP bots keep working against bank customers](https://glide-sigil.pages.dev/fraud/account-takeover/otp-bots-explained/): An OTP bot is an automated calling or messaging service that impersonates a bank or other service and persuades the victim to read out or type in a one-time passcode, which the criminal uses at the same moment to log in or approve a payment. - [SIM swap attacks, explained](https://glide-sigil.pages.dev/identity/sim-swap/sim-swap-attacks-explained/): A criminal persuades, tricks or bribes a mobile carrier into moving a victim’s phone number to a SIM they control. From then on the victim’s calls and texts, including one-time passcodes, go to the attacker. - [The FCC’s SIM-swap rules: what carriers now have to do](https://glide-sigil.pages.dev/policy/us/fcc-sim-swap-rules/): The FCC’s 2023 order (FCC 23-95) requires US wireless carriers to authenticate customers securely before moving their number to a new SIM or provider, to notify customers of SIM change and port-out requests, and to offer account locks. It does not regulate how banks or apps use SMS codes. - [Inside BSP Circular 1213, the Philippines’ OTP rule](https://glide-sigil.pages.dev/policy/apac-gulf/philippines-bsp-circular-1213/): Bangko Sentral ng Pilipinas Circular No. 1213 bars banks and other supervised financial institutions from using SMS or email one-time passcodes to authenticate high-risk transactions, starting June 25, 2026. - [Singapore banks to phase out OTPs for customers with digital tokens](https://glide-sigil.pages.dev/policy/apac-gulf/singapore-banks-phase-out-otp/): In July 2024 the Monetary Authority of Singapore and the Association of Banks in Singapore announced that major retail banks would phase out one-time passcodes for bank account logins by customers who have digital tokens activated on their mobile devices. ## Trackers and data - [SMS OTP: who is phasing it out](https://glide-sigil.pages.dev/trackers/sms-otp-regulation/): Every regulator that has restricted or phased out SMS one-time passcodes for banking, with dates, status and the primary source for each. CSV: https://glide-sigil.pages.dev/trackers/sms-otp-regulation.csv - [Known Exploited Vulnerabilities watch](https://glide-sigil.pages.dev/vulnerabilities/kev/): latest CISA KEV entries. JSON: https://glide-sigil.pages.dev/vulnerabilities/kev.json ## Glossary - [Account takeover (ATO)](https://glide-sigil.pages.dev/glossary/account-takeover/): Criminal control of a legitimate account. - [APP fraud](https://glide-sigil.pages.dev/glossary/app-fraud/): Scams where victims authorize the payment themselves. - [CAMARA](https://glide-sigil.pages.dev/glossary/camara/): Open-source project defining telecom network APIs. - [FIDO2](https://glide-sigil.pages.dev/glossary/fido2/): Open standard behind passkeys and security keys. - [Number verification](https://glide-sigil.pages.dev/glossary/number-verification/): Carrier check that a device holds a given number. - [OTP bot](https://glide-sigil.pages.dev/glossary/otp-bot/): Automated calls that trick victims into reading out codes. - [Passkey](https://glide-sigil.pages.dev/glossary/passkey/): A login credential bound to one website. - [Phishing-resistant MFA](https://glide-sigil.pages.dev/glossary/phishing-resistant-mfa/): Authentication a fake site can't relay. - [Silent network authentication](https://glide-sigil.pages.dev/glossary/silent-network-authentication/): Verification through the mobile network, with no code typed. - [SIM swap](https://glide-sigil.pages.dev/glossary/sim-swap/): Hijacking a phone number by moving it to a new SIM. - [Strong customer authentication](https://glide-sigil.pages.dev/glossary/strong-customer-authentication/): The EU's two-factor rule for payments. - [Zero trust](https://glide-sigil.pages.dev/glossary/zero-trust/): No request trusted for where it comes from alone. ## Optional - [Full text of all articles](https://glide-sigil.pages.dev/llms-full.txt) - [Editorial standards](https://glide-sigil.pages.dev/about/editorial-standards/)