Briefings
Intel briefings
Short, sourced commentary on the data: bottom line first, confidence stated, sources numbered.
Glide Identity's three-carrier beta: what the data does and doesn't show
BLUF The sources establish that Glide Identity announced a beta of SIM-based cryptographic authentication across AT&T, T-Mobile and Verizon on Aug 3, 2026, and that trade and general press covered it. They do not show which devices, operating systems and plans work, how often fallback triggers, what it costs, or how it holds up under independent security review.
The UAE’s SMS OTP phase-out is done. What US banks can take from it
BLUF The Central Bank of the UAE directed banks to phase out SMS and email one-time passcodes, starting in July 2025 and finishing by March 31, 2026. Banks moved customers to in-app verification in their own mobile apps.
SMS one-time passcodes are “restricted” under NIST’s new guidelines. Here’s what that means for US banks
BLUF NIST SP 800-63-4 does not ban SMS one-time passcodes. It classifies SMS and voice codes as “restricted” authenticators: still allowed, but only if the organization assesses the risk, tells users about it, offers at least one non-restricted alternative, and keeps a plan to migrate away.
Carrier-native authentication, explained: how a SIM can sign a login
BLUF Carrier-based authentication verifies a user through their mobile operator instead of sending them a code. The simplest form checks that a request comes from the SIM tied to a phone number; stronger forms use cryptographic keys held in the SIM to sign the request.
What the UK’s APP fraud reimbursement rules changed for fraud teams
BLUF Since October 7, 2024, UK payment service providers must reimburse most victims of authorized push payment scams on Faster Payments, up to £85,000 per claim, with the cost split between the sending and receiving firms.
Are synced passkeys phishing-resistant?
BLUF Yes. A passkey is bound to the website it was created for, so it can’t be entered on a look-alike site. NIST’s 800-63-4 update accepts synced passkeys at AAL2. The main new risk is the account that syncs them, which needs strong protection of its own.
Why OTP bots keep working against bank customers
BLUF An OTP bot is an automated calling or messaging service that impersonates a bank or other service and persuades the victim to read out or type in a one-time passcode, which the criminal uses at the same moment to log in or approve a payment.
SIM swap attacks, explained
BLUF A criminal persuades, tricks or bribes a mobile carrier into moving a victim’s phone number to a SIM they control. From then on the victim’s calls and texts, including one-time passcodes, go to the attacker.
The FCC’s SIM-swap rules: what carriers now have to do
BLUF The FCC’s 2023 order (FCC 23-95) requires US wireless carriers to authenticate customers securely before moving their number to a new SIM or provider, to notify customers of SIM change and port-out requests, and to offer account locks. It does not regulate how banks or apps use SMS codes.
Inside BSP Circular 1213, the Philippines’ OTP rule
BLUF Bangko Sentral ng Pilipinas Circular No. 1213 bars banks and other supervised financial institutions from using SMS or email one-time passcodes to authenticate high-risk transactions, starting June 25, 2026.
Singapore banks to phase out OTPs for customers with digital tokens
BLUF In July 2024 the Monetary Authority of Singapore and the Association of Banks in Singapore announced that major retail banks would phase out one-time passcodes for bank account logins by customers who have digital tokens activated on their mobile devices.
KBriefing types
- Flash
- News: what changed, fast.
- Assessment
- Analysis: what it means and what to watch.
- Primer
- Explainer: one question answered well, kept current.