Checklist
SIM swap: the first hour
Containment and verification steps when a customer’s number may have been hijacked.
Desk 02For Fraud & risk
The fraud & risk desk
How account takeover actually happens, and the controls that close it: OTP bots, SIM swaps and authorized-payment scams.
For fraud and risk teams.
What matters now
OTP bots work because a one-time code can be used by whoever holds it within its validity window.
Explainer: Why OTP bots keep working against bank customersSince October 7, 2024, UK firms reimburse most APP scam victims on Faster Payments, up to £85,000 per claim, with sending and receiving firms sharing the cost.
Dispatch: What the UK’s APP fraud reimbursement rules changed for fraud teamsUS wireless carriers must authenticate customers before a SIM change or port-out and notify them of the request, under FCC 23-95.
Explainer: The FCC’s SIM-swap rules: what carriers now have to do
Your reading path
Start at the top. Each step builds on the last.
Start here · Field guide
Shutting down OTP bots: a fraud team’s field guide
Start here: the attack chain and the controls that break it.
Then · Field guide
SIM swap incident response: the first hour and the first week
The first hour and the first week after a hijacked number.
Then · Dispatch
What the UK’s APP fraud reimbursement rules changed for fraud teams
What happens when criminals switch to authorized payments.
Checklists for this desk
Checklist
OTP bot hardening
Controls that narrow the window for code-relay attacks while codes remain.
Rules that apply
Markets most relevant to this desk. Every row links to its primary source.
| Market | Regulator | Measure | Timing | Status | Primary source |
|---|---|---|---|---|---|
| UAE | Central Bank of the UAE | SMS and email OTP phase-out | Jul 2025 – Mar 2026 | Complete | UAE banks cancel OTPs, switching to in-app verification (The Paypers) |
| Philippines | Bangko Sentral ng Pilipinas | Circular 1213: no SMS or email OTP for high-risk transactions | From Jun 25, 2026 | In force | No more SMS, email OTPs for high-risk financial transactions (GMA News) |
| Singapore | MAS and the Association of Banks in Singapore | OTP login phase-out for customers with digital tokens | From Jul 2024 | In force | Banks in Singapore to strengthen resilience against phishing scams (MAS) |
| United States | NIST | SP 800-63B-4: SMS OTP is a "restricted" authenticator | Final 2025 | Guidance | SP 800-63B-4: Authentication and Authenticator Management (NIST) |
Quick answers
How should a bank move customers off SMS one-time passcodes?
Inventory every flow that sends a code, write the risk assessment NIST SP 800-63B-4 asks for, fix account recovery and new-payee setup first, then move customers to phishing-resistant or device-bound methods such as passkeys and in-app approval. Keep SMS only as a restricted fallback, with a dated plan to remove it.
How can banks stop OTP bot attacks?
The durable fix is to remove the code the bot asks for, using passkeys, in-app approval on a registered device or network-based verification. While codes remain, say in every message what the code approves and that the bank will never ask for it, and treat a new-device sign-in during an inbound call as a strong fraud signal.
How should a bank respond to a suspected SIM swap?
Treat the account as compromised until proven otherwise: stop trusting the phone number, revoke sessions, hold new payees and contact-detail changes, and reach the customer through a channel that isn’t the hijacked number. Then help them reclaim the number from their carrier, review everything that changed during the exposure window, and re-enroll them with a method that doesn’t depend on SMS.
How can a bank detect a SIM swap?
The most direct signal comes from the mobile operator: a SIM swap check reports whether the SIM tied to a number changed recently, and number verification confirms a request comes from that SIM. The CAMARA project standardizes both APIs. Banks combine them with their own device and session signals, and use them before trusting a number for recovery, new payees or high-risk payments.
Buyer’s guides and vendor briefs
Approaches, evaluation criteria and pre-pilot questions. No rankings; owner interest disclosed.
Buyer’s guide
SIM swap detection: a buyer’s guide
The most direct signal comes from the mobile operator: a SIM swap check reports whether the SIM tied to a number changed recently, and number verification confirms a request comes from that SIM. The CAMARA project standardizes both APIs. Banks combine them with their own device and session signals, and use them before trusting a number for recovery, new payees or high-risk payments.
Buyer’s guide
SMS OTP alternatives: a buyer’s guide
There is no single best alternative for every flow. Passkeys are the most widely standardized phishing-resistant option and are accepted by NIST at AAL2. In-app approval on a registered device is what UAE and Singapore banks moved customers to. Carrier network checks are useful risk signals, and SIM-based cryptographic methods are emerging. Most organizations combine two or more.
Owner-affiliated vendor brief
Evaluating Glide Identity: what each desk should ask before a pilot
The Fraud & risk question set, then the pilot plan and who owns each step. No scores or recommendations.