https://glide-sigil.pages.dev/Sigil covers identity, fraud, vulnerabilities and security regulation with sourced explainers, live trackers and original data.enhttps://glide-sigil.pages.dev/identity/telecom-identity/glide-identity-three-carrier-beta/https://glide-sigil.pages.dev/identity/telecom-identity/glide-identity-three-carrier-beta/Thu, 24 Sep 2026 12:00:00 +0000Identity & AccessOn August 3, 2026, Glide Identity announced a beta of what it calls carrier-native cryptographic authentication across AT&T, T-Mobile and Verizon. The company says its MagicalAuth product verifies a user through the SIM’s cryptographic link to the network instead of sending an SMS code. No independent security assessment has been published.https://glide-sigil.pages.dev/policy/apac-gulf/uae-sms-otp-phase-out/https://glide-sigil.pages.dev/policy/apac-gulf/uae-sms-otp-phase-out/Wed, 23 Sep 2026 12:00:00 +0000Policy & RegulationThe Central Bank of the UAE directed banks to phase out SMS and email one-time passcodes, starting in July 2025 and finishing by March 31, 2026. Banks moved customers to in-app verification in their own mobile apps.https://glide-sigil.pages.dev/identity/authentication/nist-800-63-4-sms-otp/https://glide-sigil.pages.dev/identity/authentication/nist-800-63-4-sms-otp/Tue, 22 Sep 2026 12:00:00 +0000Identity & AccessNIST SP 800-63-4 does not ban SMS one-time passcodes. It classifies SMS and voice codes as “restricted” authenticators: still allowed, but only if the organization assesses the risk, tells users about it, offers at least one non-restricted alternative, and keeps a plan to migrate away.https://glide-sigil.pages.dev/identity/telecom-identity/carrier-authentication-explained/https://glide-sigil.pages.dev/identity/telecom-identity/carrier-authentication-explained/Sun, 20 Sep 2026 12:00:00 +0000Identity & AccessCarrier-based authentication verifies a user through their mobile operator instead of sending them a code. The simplest form checks that a request comes from the SIM tied to a phone number; stronger forms use cryptographic keys held in the SIM to sign the request.https://glide-sigil.pages.dev/fraud/app-fraud/uk-app-fraud-reimbursement/https://glide-sigil.pages.dev/fraud/app-fraud/uk-app-fraud-reimbursement/Sat, 12 Sep 2026 12:00:00 +0000Fraud & PaymentsSince October 7, 2024, UK payment service providers must reimburse most victims of authorized push payment scams on Faster Payments, up to £85,000 per claim, with the cost split between the sending and receiving firms.https://glide-sigil.pages.dev/identity/passkeys/synced-passkeys-phishing-resistant/https://glide-sigil.pages.dev/identity/passkeys/synced-passkeys-phishing-resistant/Sat, 05 Sep 2026 12:00:00 +0000Identity & AccessYes. A passkey is bound to the website it was created for, so it can’t be entered on a look-alike site. NIST’s 800-63-4 update accepts synced passkeys at AAL2. The main new risk is the account that syncs them, which needs strong protection of its own.https://glide-sigil.pages.dev/fraud/account-takeover/otp-bots-explained/https://glide-sigil.pages.dev/fraud/account-takeover/otp-bots-explained/Tue, 01 Sep 2026 12:00:00 +0000Fraud & PaymentsAn OTP bot is an automated calling or messaging service that impersonates a bank or other service and persuades the victim to read out or type in a one-time passcode, which the criminal uses at the same moment to log in or approve a payment.https://glide-sigil.pages.dev/identity/sim-swap/sim-swap-attacks-explained/https://glide-sigil.pages.dev/identity/sim-swap/sim-swap-attacks-explained/Tue, 18 Aug 2026 12:00:00 +0000Identity & AccessA criminal persuades, tricks or bribes a mobile carrier into moving a victim’s phone number to a SIM they control. From then on the victim’s calls and texts, including one-time passcodes, go to the attacker.https://glide-sigil.pages.dev/policy/us/fcc-sim-swap-rules/https://glide-sigil.pages.dev/policy/us/fcc-sim-swap-rules/Mon, 10 Aug 2026 12:00:00 +0000Policy & RegulationThe FCC’s 2023 order (FCC 23-95) requires US wireless carriers to authenticate customers securely before moving their number to a new SIM or provider, to notify customers of SIM change and port-out requests, and to offer account locks. It does not regulate how banks or apps use SMS codes.https://glide-sigil.pages.dev/policy/apac-gulf/philippines-bsp-circular-1213/https://glide-sigil.pages.dev/policy/apac-gulf/philippines-bsp-circular-1213/Fri, 26 Jun 2026 12:00:00 +0000Policy & RegulationBangko Sentral ng Pilipinas Circular No. 1213 bars banks and other supervised financial institutions from using SMS or email one-time passcodes to authenticate high-risk transactions, starting June 25, 2026.https://glide-sigil.pages.dev/policy/apac-gulf/singapore-banks-phase-out-otp/https://glide-sigil.pages.dev/policy/apac-gulf/singapore-banks-phase-out-otp/Tue, 09 Jul 2024 12:00:00 +0000Policy & RegulationIn July 2024 the Monetary Authority of Singapore and the Association of Banks in Singapore announced that major retail banks would phase out one-time passcodes for bank account logins by customers who have digital tokens activated on their mobile devices.