https://glide-tradecraft.pages.dev/briefing/Tradecraft’s weekly issue.enWed, 23 Sep 2026 12:00:00 +0000https://glide-tradecraft.pages.dev/briefing/2026-09-23/https://glide-tradecraft.pages.dev/briefing/2026-09-23/Wed, 23 Sep 2026 12:00:00 +0000BriefingThis week: The Central Bank of the UAE directed banks to phase out SMS and email one-time passcodes, starting in July 2025 and finishing by March 31, 2026. Banks moved customers to in-app verification in their own mobile apps. Also: SMS one-time passcodes are “restricted” under NIST’s new guidelines. Here’s what that means for US banks; Carrier-native authentication, explained: how a SIM can sign a login. Plus 8 vulnerabilities CISA added to its Known Exploited Vulnerabilities catalog.https://glide-tradecraft.pages.dev/briefing/2026-09-16/https://glide-tradecraft.pages.dev/briefing/2026-09-16/Wed, 16 Sep 2026 12:00:00 +0000BriefingThis week: Since October 7, 2024, UK payment service providers must reimburse most victims of authorized push payment scams on Faster Payments, up to £85,000 per claim, with the cost split between the sending and receiving firms. Also: The FCC’s SIM-swap rules: what carriers now have to do; SIM swap attacks, explained. Plus 10 vulnerabilities CISA added to its Known Exploited Vulnerabilities catalog.https://glide-tradecraft.pages.dev/briefing/2026-09-09/https://glide-tradecraft.pages.dev/briefing/2026-09-09/Wed, 09 Sep 2026 12:00:00 +0000BriefingThis week: Yes. A passkey is bound to the website it was created for, so it can’t be entered on a look-alike site. NIST’s 800-63-4 update accepts synced passkeys at AAL2. The main new risk is the account that syncs them, which needs strong protection of its own. Plus 9 vulnerabilities CISA added to its Known Exploited Vulnerabilities catalog.https://glide-tradecraft.pages.dev/briefing/2026-09-02/https://glide-tradecraft.pages.dev/briefing/2026-09-02/Wed, 02 Sep 2026 12:00:00 +0000BriefingThis week: An OTP bot is an automated calling or messaging service that impersonates a bank or other service and persuades the victim to read out or type in a one-time passcode, which the criminal uses at the same moment to log in or approve a payment. Plus 12 vulnerabilities CISA added to its Known Exploited Vulnerabilities catalog.https://glide-tradecraft.pages.dev/briefing/2026-08-26/https://glide-tradecraft.pages.dev/briefing/2026-08-26/Wed, 26 Aug 2026 12:00:00 +0000Briefing11 vulnerabilities CISA added to its Known Exploited Vulnerabilities catalog between August 20, 2026 and August 26, 2026.https://glide-tradecraft.pages.dev/briefing/2026-08-19/https://glide-tradecraft.pages.dev/briefing/2026-08-19/Wed, 19 Aug 2026 12:00:00 +0000BriefingThis week: A criminal persuades, tricks or bribes a mobile carrier into moving a victim’s phone number to a SIM they control. From then on the victim’s calls and texts, including one-time passcodes, go to the attacker. Plus 6 vulnerabilities CISA added to its Known Exploited Vulnerabilities catalog.https://glide-tradecraft.pages.dev/briefing/2026-08-12/https://glide-tradecraft.pages.dev/briefing/2026-08-12/Wed, 12 Aug 2026 12:00:00 +0000BriefingThis week: The FCC’s 2023 order (FCC 23-95) requires US wireless carriers to authenticate customers securely before moving their number to a new SIM or provider, to notify customers of SIM change and port-out requests, and to offer account locks. It does not regulate how banks or apps use SMS codes. Plus 4 vulnerabilities CISA added to its Known Exploited Vulnerabilities catalog.