On Aug 3, 2026, Glide Identity announced a beta of what it calls \"carrier-native cryptographic authentication\" across AT&T, T-Mobile and Verizon. The release, distributed on Business Wire, includes a quote from a Verizon Business executive.[1] Biometric Update covered the three-carrier launch on Aug 7,[2] and on Aug 23 Fox News' CyberGuy featured Glide in a piece on SIM-based bank login as a replacement for SMS one-time passcodes.[3]
\nThe product behind it, MagicalAuth, replaces SMS codes with verification through the mobile network, according to the company. Glide says it \"confirms identity using the SIM's cryptographic link to the network\" and completes authentication in under one second with no codes.[4]
\n| Question | What our sources show | Kind of source |
|---|---|---|
| Was a three-carrier beta announced? | Yes, on Aug 3, 2026, naming AT&T, T-Mobile and Verizon | Company release, covered by the press |
| Did a carrier speak to it? | The release quotes a Verizon Business executive | Company release |
| Is the company in the relevant industry bodies? | FIDO Alliance member at Sponsor level; listed as a GSMA Open Gateway partner | The bodies' own listing pages[6][7] |
| What came before? | A Series A of more than $20 million on Oct 13, 2025, and selection as one of 10 finalists for the RSAC 2026 Innovation Sandbox contest | Press, company releases and the organizer; see the dossier timeline |
The dossier also runs a computed check of CISA's Known Exploited Vulnerabilities catalog for any vendor matching \"Glide\", recalculated every time the site is built.
\nOn Jul 8, 2026, Aduna, a network-API joint venture, announced number verification with the same three carriers.[5] Number verification, a CAMARA API, confirms that a request comes from the SIM tied to a number. Glide describes its approach as SIM-based cryptographic authentication. The difference matters, and our carrier authentication primer sets out the approaches, but Telemetry has not independently tested either.
\nOther companies offering network-based or SMS-alternative verification include Prove, Twilio, Vonage, Sinch, Infobip, Telesign and IPification. For where regulators stand on SMS codes, see the SMS OTP regulation board.
\nThe Central Bank of the UAE told licensed financial institutions to stop relying on one-time passcodes sent by SMS or email to authenticate customers. The phase-out began in July 2025, with a deadline of March 31, 2026.[1][2]
\nBanks moved customers to verification inside their own mobile apps: the customer confirms a login or payment in the app on a device the bank has already registered, instead of typing a code from a text message.[1]
\nThe UAE rule is unusually direct. Most regulators describe outcomes and leave the method to banks. Here the regulator named the method to retire and set a date. That gives US banks a finished case study rather than a forecast:
\nNo US regulator has ordered a similar phase-out. The closest signals are NIST classifying SMS codes as restricted and the FCC’s rules on SIM-swap fraud. Telemetry tracks every jurisdiction that has moved in its SMS OTP regulation board.
", "date_published": "2026-09-23T00:00:00Z", "date_modified": "2026-09-23T00:00:00Z", "tags": [ "Assessment", "Policy", "sms-otp" ], "authors": [ { "name": "[Editor Name]" } ] }, { "id": "https://glide-telemetry.pages.dev/briefings/nist-800-63-4-sms-otp/", "url": "https://glide-telemetry.pages.dev/briefings/nist-800-63-4-sms-otp/", "title": "SMS one-time passcodes are “restricted” under NIST’s new guidelines. Here’s what that means for US banks", "summary": "NIST SP 800-63-4 does not ban SMS one-time passcodes. It classifies SMS and voice codes as “restricted” authenticators: still allowed, but only if the organization assesses the risk, tells users about it, offers at least one non-restricted alternative, and keeps a plan to migrate away.", "content_html": "NIST’s Digital Identity Guidelines are the reference US agencies must follow and that banks, auditors and examiners reach for when they argue about authentication. Revision 4, finalized in 2025, is split into three volumes: identity proofing (63A), authentication (63B) and federation (63C).[1]
\nFor SMS, the headline is continuity. Codes sent over the phone network stay on the list of allowed authenticators, in the same “restricted” category NIST created in Revision 3. What’s new is the alternative: Revision 4 explicitly accommodates synced passkeys, the kind stored in Apple, Google or password-manager accounts, and treats them as phishing-resistant.[2]
\nAn organization that keeps offering SMS or voice codes takes on four obligations:[1]
\n| Method | Phishing-resistant? | NIST 800-63B-4 |
|---|---|---|
| SMS or voice OTP | No | Restricted |
| Authenticator app code (TOTP) | No | Allowed at AAL2 |
| Synced passkey | Yes | Allowed at AAL2 |
| Hardware security key (FIDO2) | Yes | Eligible for AAL3 |
| Carrier / SIM-based verification | [Editorial: confirm] | [Editorial: confirm classification] |
Probably not by decree. US banking regulators rarely name a technology, and the FFIEC’s 2021 authentication guidance is written in terms of risk, not methods.[4] The pressure is arriving from other directions: NIST’s conditions, the FCC’s 2023 SIM-swap and port-out rules for carriers,[3] and a growing list of markets where the codes are already gone.
\n\n[Expert quote: from a named bank CISO or head of fraud, gathered in original reporting.]
| Approach | What it checks | What the user does |
|---|---|---|
| Number verification | The request comes from the SIM tied to a given number | Nothing; it runs over mobile data |
| SIM swap check | Whether the number’s SIM changed recently | Nothing; it’s a risk signal |
| SIM-based cryptography | A key held in the SIM signs the request | Usually one tap |
The CAMARA project, hosted by the Linux Foundation, defines common network APIs such as Number Verification and SIM Swap, so developers can call the same interface across operators.[1] GSMA Open Gateway packages those APIs commercially.[2]
\nIn July 2026, Aduna, a network-API joint venture, announced number verification with AT&T, T-Mobile and Verizon.[3] In August, Glide Identity announced a beta of SIM-based cryptographic authentication across the same three carriers.[4]
\nA network check proves something about a SIM, not about the person holding the phone. It is strongest combined with a device-bound credential and weakest as the only factor for account recovery.
", "date_published": "2026-09-20T00:00:00Z", "date_modified": "2026-09-20T00:00:00Z", "tags": [ "Primer", "Identity", "sms-otp" ], "authors": [ { "name": "[Editor Name]" } ] }, { "id": "https://glide-telemetry.pages.dev/briefings/uk-app-fraud-reimbursement/", "url": "https://glide-telemetry.pages.dev/briefings/uk-app-fraud-reimbursement/", "title": "What the UK’s APP fraud reimbursement rules changed for fraud teams", "summary": "Since October 7, 2024, UK payment service providers must reimburse most victims of authorized push payment scams on Faster Payments, up to £85,000 per claim, with the cost split between the sending and receiving firms.", "content_html": "From October 7, 2024, payment firms sending Faster Payments must reimburse eligible victims of authorized push payment (APP) scams, up to a maximum of £85,000 per claim.[1] The cost is shared between the firm that sent the payment and the firm that received it.[2]
\nIn an APP scam the customer authorizes the payment themselves. Strong authentication confirms it really was the customer, which is exactly the problem. Defenses have to look at the payment’s context: a new payee, an unusual amount, or a customer who is on the phone with someone claiming to be their bank.
\nA passkey is a key pair. The website stores the public key; the private key stays with the user. When the user signs in, the browser checks the site’s domain and only offers the passkey registered for that exact domain. A phishing page on a look-alike domain never receives a credential it could replay.[1]
\nSynced passkeys are copied across the user’s devices through a provider such as Apple, Google or a password manager. That fixes the biggest usability problem of device-bound credentials, losing the device, but it moves part of the risk to the sync account. If an attacker takes over that account, they may be able to restore the user’s passkeys to a device they control.
\nNIST’s 800-63-4 guidelines accept synced passkeys at authentication assurance level 2 (AAL2), the level most consumer and banking logins target.[1][2] High-assurance use cases that require AAL3 still call for hardware-bound keys.
\nThe call arrives exactly when the real code does, which makes it convincing. And a one-time passcode has no way of knowing who is typing it in or where: it works for anyone who has it within its validity window.[1]
\nA phone number belongs to an account at the carrier, not to a piece of plastic. A SIM swap exploits the process carriers use to move a number to a new SIM or eSIM, for example when a customer loses their phone. The attacker gets the carrier to do that move for them, using one of three routes:
\nOnce the number moves, the victim’s phone loses service and the attacker’s device starts receiving their calls and texts.
\nPhone numbers became the default recovery and verification channel for email, banking and crypto accounts. An attacker holding the number can request password resets and receive the one-time passcodes that confirm them. That is why SIM swaps often end in drained bank or crypto accounts within hours.
\nIn November 2023 the FCC adopted rules requiring US wireless carriers to use secure methods to authenticate a customer before moving their number to a new device or provider, to notify customers promptly of SIM change and port-out requests, and to offer account locks.[1] See Telemetry’s explainer on the FCC’s SIM-swap rules.
\nThe Report and Order, adopted on November 15, 2023, amends the FCC’s customer proprietary network information (CPNI) and number-portability rules.[1][2] Wireless carriers must:
\nThe rules were published in the Federal Register on December 8, 2023.[1] The FCC later waived the original July 2024 compliance date while the rules’ information-collection requirements went through federal review.[3] Check the FCC’s current notice before citing a compliance date.
\nThe order regulates carriers. It says nothing about whether a bank or app should keep using SMS codes. A carrier that follows the rules makes SIM swaps harder, but a bank that still treats an SMS code as proof of identity remains exposed to insiders, to account takeover at the carrier, and to phishing of the code itself.
", "date_published": "2026-08-10T00:00:00Z", "date_modified": "2026-09-15T00:00:00Z", "tags": [ "Primer", "Policy", "sms-otp" ], "authors": [ { "name": "[Editor Name]" } ] }, { "id": "https://glide-telemetry.pages.dev/briefings/philippines-bsp-circular-1213/", "url": "https://glide-telemetry.pages.dev/briefings/philippines-bsp-circular-1213/", "title": "Inside BSP Circular 1213, the Philippines’ OTP rule", "summary": "Bangko Sentral ng Pilipinas Circular No. 1213 bars banks and other supervised financial institutions from using SMS or email one-time passcodes to authenticate high-risk transactions, starting June 25, 2026.", "content_html": "Banks and other institutions supervised by the Bangko Sentral ng Pilipinas can no longer use one-time passcodes sent by SMS or email to authenticate high-risk transactions. The rule took effect on June 25, 2026.[1][2]
\nRegulators increasingly treat both channels as the same weakness. Codes sent by text or email can be phished, intercepted, or handed over by a customer who has been convinced they are talking to their bank.
\nThe Philippines joins Singapore, Malaysia and the UAE in moving banks off SMS codes. Telemetry tracks each of them in the SMS OTP regulation board.
", "date_published": "2026-06-26T00:00:00Z", "date_modified": "2026-06-26T00:00:00Z", "tags": [ "Flash", "Policy", "sms-otp" ], "authors": [ { "name": "[Editor Name]" } ] }, { "id": "https://glide-telemetry.pages.dev/briefings/singapore-banks-phase-out-otp/", "url": "https://glide-telemetry.pages.dev/briefings/singapore-banks-phase-out-otp/", "title": "Singapore banks to phase out OTPs for customers with digital tokens", "summary": "In July 2024 the Monetary Authority of Singapore and the Association of Banks in Singapore announced that major retail banks would phase out one-time passcodes for bank account logins by customers who have digital tokens activated on their mobile devices.", "content_html": "The Monetary Authority of Singapore and the Association of Banks in Singapore said major retail banks would phase out the use of one-time passcodes for logging into bank accounts, for customers who have activated a digital token on their mobile device.[1][2]
\nPhishing sites imitating banks can capture a customer’s password and OTP and use them immediately. A digital token bound to the customer’s registered device can’t be relayed that way.
\nInstead of typing a code, customers approve logins with the digital token in their bank’s app.
", "date_published": "2024-07-09T00:00:00Z", "date_modified": "2024-07-09T00:00:00Z", "tags": [ "Flash", "Policy", "sms-otp" ], "authors": [ { "name": "[Editor Name]" } ] } ] }