This week’s issueNo. 07 · September 23, 2026
Cover storyField guide No. 01
Moving a bank off SMS OTP: the field guide
A step-by-step plan for retiring text-message codes: which flows go first, what replaces them, who owns each step, and what the markets that already did it can teach you.
Choose your desk
Tradecraft is organized by the job you do. Pick yours for a reading path, checklists and the rules that apply.
Fraud & risk
How account takeover actually happens, and the controls that close it: OTP bots, SIM swaps and authorized-payment scams.Start with: Shutting down OTP bots: a fraud team’s field guideIAM engineers
Passkeys, recovery design, carrier APIs and NIST assurance levels, for the people who build sign-in.Start with: Are synced passkeys phishing-resistant?Security engineers
What’s being exploited this week, and the identity signals worth wiring into detection.Start with: The Wednesday Briefing No. 7Compliance
Every rule that restricts SMS codes, the dates that matter, and the evidence regulators and auditors expect.Start with: SMS OTP regulations trackerProduct & payments
Replacing codes without losing customers: what banks moved to, and how to explain it.Start with: Moving a bank off SMS OTP: the field guideField guides
Step-by-step playbooks with owners, decision tables and checklists.
Moving a bank off SMS OTP: the field guide
A step-by-step plan for retiring text-message codes: which flows go first, what replaces them, who owns each step, and what the markets that already did it can teach you.
SIM swap incident response: the first hour and the first week
When a customer’s phone number is hijacked, every account that trusts it is exposed. A response playbook for fraud and security teams: signals, containment, recovery and the fix that stops a repeat.
Rolling out passkeys to retail banking customers
Passkeys are the phishing-resistant option NIST now accepts at AAL2. Getting millions of customers to use them is a product problem as much as a security one. A rollout plan, from policy to recovery.
Preparing for NIST SP 800-63-4: a working plan for banks and agencies
Revision 4 of NIST’s Digital Identity Guidelines doesn’t ban SMS codes, but it puts conditions on keeping them. How to map your authenticators, document the restricted ones and show an examiner a plan.
Shutting down OTP bots: a fraud team’s field guide
OTP bots automate the call that talks a customer into reading out their code. The durable fix is removing the code; until then, context, timing and customer education narrow the window.
The Wednesday BriefingNo. 07 · Wednesday, September 23, 2026
The UAE’s SMS OTP phase-out is done. What US banks can take from it + 2 more
The UAE’s deadline for retiring SMS and email codes has passed, and NIST’s “restricted” label for SMS is a benchmark US examiners and auditors use. This week’s reading is about what each means for a US bank’s roadmap.
8 exploited vulnerabilities added by CISA this week
- CVE-2026-94127 F5 BIG-IP APM
- CVE-2026-93952 Arista VeloCloud Orchestrator
- CVE-2026-93616 Check Point Multiple Products
- CVE-2026-85102 Check Point Multiple Products
- CVE-2026-7273 Zyxel GS1900 Series Switches
Featured buyer’s guideCommercial-intent · Not sponsored · No rankings
SMS OTP alternatives: a buyer’s guide
The options for replacing text-message codes, how to evaluate them and what to ask vendors. We explain approaches; we don’t rank products.
Our owner has a financial interest in a vendor in this category. Ownership & funding · Methodology
- Passkeys (FIDO2) Phishing-resistant key pairs bound to the site’s domain; synced passkeys accepted at AAL2.
- In-app approval on a registered device The customer confirms a sign-in or payment in the organization’s own app.
- Carrier network checks Number verification and SIM-change signals from the mobile operator.
- SIM-based cryptographic authentication A key held in the SIM signs the request; newer and carrier-dependent.
- Authenticator app codes (TOTP) Allowed at AAL2, but the code can still be phished or read out.
Explainers and dispatches
One question answered well, and the news behind it.
Explainer
SMS one-time passcodes are “restricted” under NIST’s new guidelines. Here’s what that means for US banks
NIST SP 800-63-4 does not ban SMS one-time passcodes. It classifies SMS and voice codes as “restricted” authenticators: still allowed, but only if the organization assesses the risk, tells users about it, offers at least one non-restricted alternative, and keeps a plan to migrate away.
Explainer
Carrier-native authentication, explained: how a SIM can sign a login
Carrier-based authentication verifies a user through their mobile operator instead of sending them a code. The simplest form checks that a request comes from the SIM tied to a phone number; stronger forms use cryptographic keys held in the SIM to sign the request.
Explainer
The FCC’s SIM-swap rules: what carriers now have to do
The FCC’s 2023 order (FCC 23-95) requires US wireless carriers to authenticate customers securely before moving their number to a new SIM or provider, to notify customers of SIM change and port-out requests, and to offer account locks. It does not regulate how banks or apps use SMS codes.
Dispatch
The UAE’s SMS OTP phase-out is done. What US banks can take from it
The Central Bank of the UAE directed banks to phase out SMS and email one-time passcodes, starting in July 2025 and finishing by March 31, 2026. Banks moved customers to in-app verification in their own mobile apps.
Dispatch
What the UK’s APP fraud reimbursement rules changed for fraud teams
Since October 7, 2024, UK payment service providers must reimburse most victims of authorized push payment scams on Faster Payments, up to £85,000 per claim, with the cost split between the sending and receiving firms.
Dispatch
Inside BSP Circular 1213, the Philippines’ OTP rule
Bangko Sentral ng Pilipinas Circular No. 1213 bars banks and other supervised financial institutions from using SMS or email one-time passcodes to authenticate high-risk transactions, starting June 25, 2026.
Get the Wednesday Briefing
One email a week: what we published, what changed and what CISA added to its exploited-vulnerabilities list. Routed by desk.