Glossary

Account takeover is when a criminal gains control of a real customer's account, usually with stolen credentials, a phished one-time passcode or a hijacked phone number, and then uses it to move money, change contact details or open new products.

Desks Fraud & risk

Authorized push payment (APP) fraud is a scam in which the victim is tricked into sending a payment themselves, for example to someone impersonating their bank, a supplier or a romantic partner. Because the customer authorized it, strong authentication alone does not stop it.

Desks Fraud & risk Compliance Product & payments

CAMARA is an open-source project hosted by the Linux Foundation that defines common network APIs, such as Number Verification and SIM Swap, so developers can call the same interface across different mobile operators. GSMA Open Gateway builds on it.

Desks Security engineers

FIDO2 is the FIDO Alliance's set of specifications, made up of the W3C's WebAuthn API and FIDO's CTAP protocol, that lets people sign in with public-key cryptography instead of passwords. Passkeys and hardware security keys are both FIDO2 credentials.

Desks IAM engineers Security engineers

Number verification is a mobile network API that confirms whether the device making a request is using the SIM registered to a given phone number, without sending the user a code.

Desks IAM engineers

An OTP bot is an automated calling or messaging service that impersonates a bank or service and persuades the victim to read out or type in a one-time passcode, which the criminal then uses in real time.

Desks Fraud & risk Product & payments

A passkey is a FIDO2 credential: a key pair where the private key stays on the user's device or in their password manager, and the public key is stored by the website. Because it is bound to the site's domain, it cannot be used on a look-alike phishing site.

Desks CISOs IAM engineers Product & payments

Phishing-resistant MFA is authentication that a fake website or man-in-the-middle cannot capture and replay, because the credential is cryptographically bound to the real site. FIDO2 passkeys and security keys are the common examples. SMS codes and authenticator-app codes are not phishing-resistant.

Desks CISOs IAM engineers Security engineers Compliance

Silent network authentication verifies a user by checking, with their mobile operator, that the request comes from the SIM tied to their phone number. The check happens over the cellular data connection, so the user never sees or types a code.

Desks IAM engineers

A SIM swap is when a criminal gets a mobile carrier to move a victim's phone number to a SIM or eSIM they control, by social engineering, bribery or stolen credentials. The criminal then receives the victim's calls and texts, including one-time passcodes.

Desks CISOs Fraud & risk Compliance

Strong customer authentication (SCA) is the requirement in EU payments law that customers authenticate with at least two independent factors from knowledge, possession and inherence for most electronic payments and account access.

Desks Compliance Product & payments

Zero trust is a security model in which no user, device or request is trusted because of its network location. Every access decision is made from identity, device health and context, and re-checked continuously.

Desks CISOs Security engineers