Checklist
Passkey launch readiness
What to settle before offering passkeys to customers or staff.
Desk 03For IAM engineers
The IAM desk
Passkeys, recovery design, carrier APIs and NIST assurance levels, for the people who build sign-in.
For identity and access engineers.
What matters now
NIST 800-63-4 accepts synced passkeys at AAL2; AAL3 still calls for hardware-bound keys.
Explainer: Are synced passkeys phishing-resistant?Recovery is where passkey deployments get attacked. A recovery flow that ends in an SMS code keeps the weak link.
Field guide: Rolling out passkeys to retail banking customersThe CAMARA project defines common Number Verification and SIM Swap APIs across mobile operators.
Explainer: Carrier-native authentication, explained: how a SIM can sign a login
Your reading path
Start at the top. Each step builds on the last.
Start here · Explainer
Are synced passkeys phishing-resistant?
Start here: what stays phishing-resistant when passkeys sync.
Then · Field guide
Rolling out passkeys to retail banking customers
Enrollment, default sign-in and recovery, step by step.
Then · Explainer
Carrier-native authentication, explained: how a SIM can sign a login
Three different things called “carrier authentication”.
Then · Field guide
Preparing for NIST SP 800-63-4: a working plan for banks and agencies
Map every authenticator to an assurance level.
Then · Buyer’s guide
Phishing-resistant MFA: a buyer’s guide
Evaluation criteria for FIDO2 platforms and keys.
Checklists for this desk
Checklist
NIST 800-63B-4 restricted-authenticator file
The four conditions for keeping SMS or voice codes, and the evidence to keep for each.
Rules that apply
Markets most relevant to this desk. Every row links to its primary source.
| Market | Regulator | Measure | Timing | Status | Primary source |
|---|---|---|---|---|---|
| India | Reserve Bank of India | Authentication Directions 2025 | From Apr 1, 2026 | In force | RBI mandates 2FA and new security rules for digital payments (Regulation Asia) |
| Singapore | MAS and the Association of Banks in Singapore | OTP login phase-out for customers with digital tokens | From Jul 2024 | In force | Banks in Singapore to strengthen resilience against phishing scams (MAS) |
| United States | NIST | SP 800-63B-4: SMS OTP is a "restricted" authenticator | Final 2025 | Guidance | SP 800-63B-4: Authentication and Authenticator Management (NIST) |
Quick answers
How should a bank move customers off SMS one-time passcodes?
Inventory every flow that sends a code, write the risk assessment NIST SP 800-63B-4 asks for, fix account recovery and new-payee setup first, then move customers to phishing-resistant or device-bound methods such as passkeys and in-app approval. Keep SMS only as a restricted fallback, with a dated plan to remove it.
How should a bank roll out passkeys to its customers?
Decide which passkeys you accept for which customers, offer enrollment right after a strong sign-in, make passkeys the default for returning users, and design account recovery that doesn’t fall back to an SMS code. Keep a non-SMS alternative for customers who can’t use passkeys, and a device-bound option for staff and other high-risk users.
What do organizations need to do to prepare for NIST SP 800-63-4?
Map every authenticator you use to NIST’s assurance levels, identify the restricted ones (SMS and voice codes), and for each restricted authenticator document a risk assessment, user notice, a non-restricted alternative and a migration plan. Add a phishing-resistant option such as passkeys, which Revision 4 accepts at AAL2.
What counts as phishing-resistant MFA?
Phishing-resistant MFA is authentication that a fake site or man-in-the-middle can’t capture and replay, because the credential is cryptographically bound to the real site. FIDO2 passkeys and hardware security keys are the common examples, and CISA also counts PKI-based smart cards. SMS codes, authenticator-app codes and simple push approvals are not phishing-resistant.
Buyer’s guides and vendor briefs
Approaches, evaluation criteria and pre-pilot questions. No rankings; owner interest disclosed.
Buyer’s guide
Phishing-resistant MFA: a buyer’s guide
Phishing-resistant MFA is authentication that a fake site or man-in-the-middle can’t capture and replay, because the credential is cryptographically bound to the real site. FIDO2 passkeys and hardware security keys are the common examples, and CISA also counts PKI-based smart cards. SMS codes, authenticator-app codes and simple push approvals are not phishing-resistant.
Buyer’s guide
SMS OTP alternatives: a buyer’s guide
There is no single best alternative for every flow. Passkeys are the most widely standardized phishing-resistant option and are accepted by NIST at AAL2. In-app approval on a registered device is what UAE and Singapore banks moved customers to. Carrier network checks are useful risk signals, and SIM-based cryptographic methods are emerging. Most organizations combine two or more.
Owner-affiliated vendor brief
Evaluating Glide Identity: what each desk should ask before a pilot
The IAM engineers question set, then the pilot plan and who owns each step. No scores or recommendations.
Words this desk uses
- Passkey A login credential bound to one website.
- FIDO2 Open standard behind passkeys and security keys.
- Phishing-resistant MFA Authentication a fake site can't relay.
- Number verification Carrier check that a device holds a given number.
- Silent network authentication Verification through the mobile network, with no code typed.