https://glide-tradecraft.pages.dev/Tradecraft is a practitioner’s magazine for identity, fraud and security teams: field guides, a weekly briefing, neutral buyer’s guides and a sourced regulations tracker, organized by the job you do.enThu, 24 Sep 2026 12:00:00 +0000https://glide-tradecraft.pages.dev/field-guides/moving-a-bank-off-sms-otp/https://glide-tradecraft.pages.dev/field-guides/moving-a-bank-off-sms-otp/Thu, 24 Sep 2026 12:00:00 +0000Field guideInventory every flow that sends a code, write the risk assessment NIST SP 800-63B-4 asks for, fix account recovery and new-payee setup first, then move customers to phishing-resistant or device-bound methods such as passkeys and in-app approval. Keep SMS only as a restricted fallback, with a dated plan to remove it.https://glide-tradecraft.pages.dev/field-guides/otp-bot-defense/https://glide-tradecraft.pages.dev/field-guides/otp-bot-defense/Thu, 24 Sep 2026 12:00:00 +0000Field guideThe durable fix is to remove the code the bot asks for, using passkeys, in-app approval on a registered device or network-based verification. While codes remain, say in every message what the code approves and that the bank will never ask for it, and treat a new-device sign-in during an inbound call as a strong fraud signal.https://glide-tradecraft.pages.dev/field-guides/passkeys-for-retail-banking/https://glide-tradecraft.pages.dev/field-guides/passkeys-for-retail-banking/Thu, 24 Sep 2026 12:00:00 +0000Field guideDecide which passkeys you accept for which customers, offer enrollment right after a strong sign-in, make passkeys the default for returning users, and design account recovery that doesn’t fall back to an SMS code. Keep a non-SMS alternative for customers who can’t use passkeys, and a device-bound option for staff and other high-risk users.https://glide-tradecraft.pages.dev/field-guides/preparing-for-nist-800-63-4/https://glide-tradecraft.pages.dev/field-guides/preparing-for-nist-800-63-4/Thu, 24 Sep 2026 12:00:00 +0000Field guideMap every authenticator you use to NIST’s assurance levels, identify the restricted ones (SMS and voice codes), and for each restricted authenticator document a risk assessment, user notice, a non-restricted alternative and a migration plan. Add a phishing-resistant option such as passkeys, which Revision 4 accepts at AAL2.https://glide-tradecraft.pages.dev/field-guides/sim-swap-incident-response/https://glide-tradecraft.pages.dev/field-guides/sim-swap-incident-response/Thu, 24 Sep 2026 12:00:00 +0000Field guideTreat the account as compromised until proven otherwise: stop trusting the phone number, revoke sessions, hold new payees and contact-detail changes, and reach the customer through a channel that isn’t the hijacked number. Then help them reclaim the number from their carrier, review everything that changed during the exposure window, and re-enroll them with a method that doesn’t depend on SMS.https://glide-tradecraft.pages.dev/buyers-guides/phishing-resistant-mfa/https://glide-tradecraft.pages.dev/buyers-guides/phishing-resistant-mfa/Thu, 24 Sep 2026 12:00:00 +0000Buyer’s guidePhishing-resistant MFA is authentication that a fake site or man-in-the-middle can’t capture and replay, because the credential is cryptographically bound to the real site. FIDO2 passkeys and hardware security keys are the common examples, and CISA also counts PKI-based smart cards. SMS codes, authenticator-app codes and simple push approvals are not phishing-resistant.https://glide-tradecraft.pages.dev/buyers-guides/sim-swap-detection/https://glide-tradecraft.pages.dev/buyers-guides/sim-swap-detection/Thu, 24 Sep 2026 12:00:00 +0000Buyer’s guideThe most direct signal comes from the mobile operator: a SIM swap check reports whether the SIM tied to a number changed recently, and number verification confirms a request comes from that SIM. The CAMARA project standardizes both APIs. Banks combine them with their own device and session signals, and use them before trusting a number for recovery, new payees or high-risk payments.https://glide-tradecraft.pages.dev/buyers-guides/sms-otp-alternatives/https://glide-tradecraft.pages.dev/buyers-guides/sms-otp-alternatives/Thu, 24 Sep 2026 12:00:00 +0000Buyer’s guideThere is no single best alternative for every flow. Passkeys are the most widely standardized phishing-resistant option and are accepted by NIST at AAL2. In-app approval on a registered device is what UAE and Singapore banks moved customers to. Carrier network checks are useful risk signals, and SIM-based cryptographic methods are emerging. Most organizations combine two or more.https://glide-tradecraft.pages.dev/vendor-briefs/glide-identity/https://glide-tradecraft.pages.dev/vendor-briefs/glide-identity/Thu, 24 Sep 2026 12:00:00 +0000Vendor briefGlide Identity, a US company that trades as Glide.id, says its MagicalAuth product replaces SMS codes with verification through the mobile network, and in August 2026 it announced a beta across AT&T, T-Mobile and Verizon. Before a pilot, get written answers on how the method would be classified under NIST SP 800-63B-4, when and how fallback triggers, which devices, operating systems and plans are covered, how SIM swaps and eSIM transfers are handled, what data is processed, what it costs and how you would leave. We found no independent security assessment in our sources.https://glide-tradecraft.pages.dev/dispatches/uae-sms-otp-phase-out/https://glide-tradecraft.pages.dev/dispatches/uae-sms-otp-phase-out/Wed, 23 Sep 2026 12:00:00 +0000DispatchThe Central Bank of the UAE directed banks to phase out SMS and email one-time passcodes, starting in July 2025 and finishing by March 31, 2026. Banks moved customers to in-app verification in their own mobile apps.https://glide-tradecraft.pages.dev/briefing/2026-09-23/https://glide-tradecraft.pages.dev/briefing/2026-09-23/Wed, 23 Sep 2026 12:00:00 +0000BriefingThis week: The Central Bank of the UAE directed banks to phase out SMS and email one-time passcodes, starting in July 2025 and finishing by March 31, 2026. Banks moved customers to in-app verification in their own mobile apps. Also: SMS one-time passcodes are “restricted” under NIST’s new guidelines. Here’s what that means for US banks; Carrier-native authentication, explained: how a SIM can sign a login. Plus 8 vulnerabilities CISA added to its Known Exploited Vulnerabilities catalog.https://glide-tradecraft.pages.dev/explainers/nist-800-63-4-sms-otp/https://glide-tradecraft.pages.dev/explainers/nist-800-63-4-sms-otp/Tue, 22 Sep 2026 12:00:00 +0000ExplainerNIST SP 800-63-4 does not ban SMS one-time passcodes. It classifies SMS and voice codes as “restricted” authenticators: still allowed, but only if the organization assesses the risk, tells users about it, offers at least one non-restricted alternative, and keeps a plan to migrate away.https://glide-tradecraft.pages.dev/explainers/carrier-authentication-explained/https://glide-tradecraft.pages.dev/explainers/carrier-authentication-explained/Sun, 20 Sep 2026 12:00:00 +0000ExplainerCarrier-based authentication verifies a user through their mobile operator instead of sending them a code. The simplest form checks that a request comes from the SIM tied to a phone number; stronger forms use cryptographic keys held in the SIM to sign the request.https://glide-tradecraft.pages.dev/briefing/2026-09-16/https://glide-tradecraft.pages.dev/briefing/2026-09-16/Wed, 16 Sep 2026 12:00:00 +0000BriefingThis week: Since October 7, 2024, UK payment service providers must reimburse most victims of authorized push payment scams on Faster Payments, up to £85,000 per claim, with the cost split between the sending and receiving firms. Also: The FCC’s SIM-swap rules: what carriers now have to do; SIM swap attacks, explained. Plus 10 vulnerabilities CISA added to its Known Exploited Vulnerabilities catalog.https://glide-tradecraft.pages.dev/dispatches/uk-app-fraud-reimbursement/https://glide-tradecraft.pages.dev/dispatches/uk-app-fraud-reimbursement/Sat, 12 Sep 2026 12:00:00 +0000DispatchSince October 7, 2024, UK payment service providers must reimburse most victims of authorized push payment scams on Faster Payments, up to £85,000 per claim, with the cost split between the sending and receiving firms.https://glide-tradecraft.pages.dev/briefing/2026-09-09/https://glide-tradecraft.pages.dev/briefing/2026-09-09/Wed, 09 Sep 2026 12:00:00 +0000BriefingThis week: Yes. A passkey is bound to the website it was created for, so it can’t be entered on a look-alike site. NIST’s 800-63-4 update accepts synced passkeys at AAL2. The main new risk is the account that syncs them, which needs strong protection of its own. Plus 9 vulnerabilities CISA added to its Known Exploited Vulnerabilities catalog.https://glide-tradecraft.pages.dev/explainers/synced-passkeys-phishing-resistant/https://glide-tradecraft.pages.dev/explainers/synced-passkeys-phishing-resistant/Sat, 05 Sep 2026 12:00:00 +0000ExplainerYes. A passkey is bound to the website it was created for, so it can’t be entered on a look-alike site. NIST’s 800-63-4 update accepts synced passkeys at AAL2. The main new risk is the account that syncs them, which needs strong protection of its own.https://glide-tradecraft.pages.dev/briefing/2026-09-02/https://glide-tradecraft.pages.dev/briefing/2026-09-02/Wed, 02 Sep 2026 12:00:00 +0000BriefingThis week: An OTP bot is an automated calling or messaging service that impersonates a bank or other service and persuades the victim to read out or type in a one-time passcode, which the criminal uses at the same moment to log in or approve a payment. Plus 12 vulnerabilities CISA added to its Known Exploited Vulnerabilities catalog.https://glide-tradecraft.pages.dev/explainers/otp-bots-explained/https://glide-tradecraft.pages.dev/explainers/otp-bots-explained/Tue, 01 Sep 2026 12:00:00 +0000ExplainerAn OTP bot is an automated calling or messaging service that impersonates a bank or other service and persuades the victim to read out or type in a one-time passcode, which the criminal uses at the same moment to log in or approve a payment.https://glide-tradecraft.pages.dev/briefing/2026-08-26/https://glide-tradecraft.pages.dev/briefing/2026-08-26/Wed, 26 Aug 2026 12:00:00 +0000Briefing11 vulnerabilities CISA added to its Known Exploited Vulnerabilities catalog between August 20, 2026 and August 26, 2026.https://glide-tradecraft.pages.dev/briefing/2026-08-19/https://glide-tradecraft.pages.dev/briefing/2026-08-19/Wed, 19 Aug 2026 12:00:00 +0000BriefingThis week: A criminal persuades, tricks or bribes a mobile carrier into moving a victim’s phone number to a SIM they control. From then on the victim’s calls and texts, including one-time passcodes, go to the attacker. Plus 6 vulnerabilities CISA added to its Known Exploited Vulnerabilities catalog.https://glide-tradecraft.pages.dev/explainers/sim-swap-attacks-explained/https://glide-tradecraft.pages.dev/explainers/sim-swap-attacks-explained/Tue, 18 Aug 2026 12:00:00 +0000ExplainerA criminal persuades, tricks or bribes a mobile carrier into moving a victim’s phone number to a SIM they control. From then on the victim’s calls and texts, including one-time passcodes, go to the attacker.https://glide-tradecraft.pages.dev/briefing/2026-08-12/https://glide-tradecraft.pages.dev/briefing/2026-08-12/Wed, 12 Aug 2026 12:00:00 +0000BriefingThis week: The FCC’s 2023 order (FCC 23-95) requires US wireless carriers to authenticate customers securely before moving their number to a new SIM or provider, to notify customers of SIM change and port-out requests, and to offer account locks. It does not regulate how banks or apps use SMS codes. Plus 4 vulnerabilities CISA added to its Known Exploited Vulnerabilities catalog.https://glide-tradecraft.pages.dev/explainers/fcc-sim-swap-rules/https://glide-tradecraft.pages.dev/explainers/fcc-sim-swap-rules/Mon, 10 Aug 2026 12:00:00 +0000ExplainerThe FCC’s 2023 order (FCC 23-95) requires US wireless carriers to authenticate customers securely before moving their number to a new SIM or provider, to notify customers of SIM change and port-out requests, and to offer account locks. It does not regulate how banks or apps use SMS codes.https://glide-tradecraft.pages.dev/dispatches/philippines-bsp-circular-1213/https://glide-tradecraft.pages.dev/dispatches/philippines-bsp-circular-1213/Fri, 26 Jun 2026 12:00:00 +0000DispatchBangko Sentral ng Pilipinas Circular No. 1213 bars banks and other supervised financial institutions from using SMS or email one-time passcodes to authenticate high-risk transactions, starting June 25, 2026.https://glide-tradecraft.pages.dev/dispatches/singapore-banks-phase-out-otp/https://glide-tradecraft.pages.dev/dispatches/singapore-banks-phase-out-otp/Tue, 09 Jul 2024 12:00:00 +0000DispatchIn July 2024 the Monetary Authority of Singapore and the Association of Banks in Singapore announced that major retail banks would phase out one-time passcodes for bank account logins by customers who have digital tokens activated on their mobile devices.