Format5 published
Step-by-step playbooks for the work itself: decision tables, “who owns this” charts and checklists you can take into a meeting.
A step-by-step plan for retiring text-message codes: which flows go first, what replaces them, who owns each step, and what the markets that already did it can teach you.
For CISOs Fraud & risk IAM engineers Product & payments Compliance
When a customer’s phone number is hijacked, every account that trusts it is exposed. A response playbook for fraud and security teams: signals, containment, recovery and the fix that stops a repeat.
Passkeys are the phishing-resistant option NIST now accepts at AAL2. Getting millions of customers to use them is a product problem as much as a security one. A rollout plan, from policy to recovery.
Revision 4 of NIST’s Digital Identity Guidelines doesn’t ban SMS codes, but it puts conditions on keeping them. How to map your authenticators, document the restricted ones and show an examiner a plan.
OTP bots automate the call that talks a customer into reading out their code. The durable fix is removing the code; until then, context, timing and customer education narrow the window.