# Tradecraft

> Tradecraft is a practitioner’s magazine for identity, fraud and security teams: field guides, a weekly briefing, neutral buyer’s guides and a sourced regulations tracker, organized by the job you do.

Ownership: Tradecraft is owned by [OWNER ENTITY], which has a financial interest in Glide Identity (Glide.id), an authentication vendor. Pages mentioning it carry a disclosure. Buyer's guides never rank vendors. Details: https://glide-tradecraft.pages.dev/about/ownership-and-funding/

Citation: please cite with a link to the page. Every factual claim links to a numbered primary source on the page.

## Desks (organized by reader role)

- [The CISO desk](https://glide-tradecraft.pages.dev/for/ciso/): The decisions, deadlines and board questions behind moving customers off phishable authentication.
- [The fraud & risk desk](https://glide-tradecraft.pages.dev/for/fraud-and-risk/): How account takeover actually happens, and the controls that close it: OTP bots, SIM swaps and authorized-payment scams.
- [The IAM desk](https://glide-tradecraft.pages.dev/for/iam-engineers/): Passkeys, recovery design, carrier APIs and NIST assurance levels, for the people who build sign-in.
- [The security engineering desk](https://glide-tradecraft.pages.dev/for/security-engineers/): What’s being exploited this week, and the identity signals worth wiring into detection.
- [The compliance desk](https://glide-tradecraft.pages.dev/for/compliance/): Every rule that restricts SMS codes, the dates that matter, and the evidence regulators and auditors expect.
- [The product & payments desk](https://glide-tradecraft.pages.dev/for/product-and-payments/): Replacing codes without losing customers: what banks moved to, and how to explain it.

## Field guides

- [Moving a bank off SMS OTP: the field guide](https://glide-tradecraft.pages.dev/field-guides/moving-a-bank-off-sms-otp/): Inventory every flow that sends a code, write the risk assessment NIST SP 800-63B-4 asks for, fix account recovery and new-payee setup first, then move customers to phishing-resistant or device-bound methods such as passkeys and in-app approval. Keep SMS only as a restricted fallback, with a dated plan to remove it.
- [SIM swap incident response: the first hour and the first week](https://glide-tradecraft.pages.dev/field-guides/sim-swap-incident-response/): Treat the account as compromised until proven otherwise: stop trusting the phone number, revoke sessions, hold new payees and contact-detail changes, and reach the customer through a channel that isn’t the hijacked number. Then help them reclaim the number from their carrier, review everything that changed during the exposure window, and re-enroll them with a method that doesn’t depend on SMS.
- [Rolling out passkeys to retail banking customers](https://glide-tradecraft.pages.dev/field-guides/passkeys-for-retail-banking/): Decide which passkeys you accept for which customers, offer enrollment right after a strong sign-in, make passkeys the default for returning users, and design account recovery that doesn’t fall back to an SMS code. Keep a non-SMS alternative for customers who can’t use passkeys, and a device-bound option for staff and other high-risk users.
- [Preparing for NIST SP 800-63-4: a working plan for banks and agencies](https://glide-tradecraft.pages.dev/field-guides/preparing-for-nist-800-63-4/): Map every authenticator you use to NIST’s assurance levels, identify the restricted ones (SMS and voice codes), and for each restricted authenticator document a risk assessment, user notice, a non-restricted alternative and a migration plan. Add a phishing-resistant option such as passkeys, which Revision 4 accepts at AAL2.
- [Shutting down OTP bots: a fraud team’s field guide](https://glide-tradecraft.pages.dev/field-guides/otp-bot-defense/): The durable fix is to remove the code the bot asks for, using passkeys, in-app approval on a registered device or network-based verification. While codes remain, say in every message what the code approves and that the bank will never ask for it, and treat a new-device sign-in during an inbound call as a strong fraud signal.

## Explainers

- [SMS one-time passcodes are “restricted” under NIST’s new guidelines. Here’s what that means for US banks](https://glide-tradecraft.pages.dev/explainers/nist-800-63-4-sms-otp/): NIST SP 800-63-4 does not ban SMS one-time passcodes. It classifies SMS and voice codes as “restricted” authenticators: still allowed, but only if the organization assesses the risk, tells users about it, offers at least one non-restricted alternative, and keeps a plan to migrate away.
- [Carrier-native authentication, explained: how a SIM can sign a login](https://glide-tradecraft.pages.dev/explainers/carrier-authentication-explained/): Carrier-based authentication verifies a user through their mobile operator instead of sending them a code. The simplest form checks that a request comes from the SIM tied to a phone number; stronger forms use cryptographic keys held in the SIM to sign the request.
- [The FCC’s SIM-swap rules: what carriers now have to do](https://glide-tradecraft.pages.dev/explainers/fcc-sim-swap-rules/): The FCC’s 2023 order (FCC 23-95) requires US wireless carriers to authenticate customers securely before moving their number to a new SIM or provider, to notify customers of SIM change and port-out requests, and to offer account locks. It does not regulate how banks or apps use SMS codes.
- [SIM swap attacks, explained](https://glide-tradecraft.pages.dev/explainers/sim-swap-attacks-explained/): A criminal persuades, tricks or bribes a mobile carrier into moving a victim’s phone number to a SIM they control. From then on the victim’s calls and texts, including one-time passcodes, go to the attacker.
- [Are synced passkeys phishing-resistant?](https://glide-tradecraft.pages.dev/explainers/synced-passkeys-phishing-resistant/): Yes. A passkey is bound to the website it was created for, so it can’t be entered on a look-alike site. NIST’s 800-63-4 update accepts synced passkeys at AAL2. The main new risk is the account that syncs them, which needs strong protection of its own.
- [Why OTP bots keep working against bank customers](https://glide-tradecraft.pages.dev/explainers/otp-bots-explained/): An OTP bot is an automated calling or messaging service that impersonates a bank or other service and persuades the victim to read out or type in a one-time passcode, which the criminal uses at the same moment to log in or approve a payment.

## Dispatches

- [The UAE’s SMS OTP phase-out is done. What US banks can take from it](https://glide-tradecraft.pages.dev/dispatches/uae-sms-otp-phase-out/): The Central Bank of the UAE directed banks to phase out SMS and email one-time passcodes, starting in July 2025 and finishing by March 31, 2026. Banks moved customers to in-app verification in their own mobile apps.
- [What the UK’s APP fraud reimbursement rules changed for fraud teams](https://glide-tradecraft.pages.dev/dispatches/uk-app-fraud-reimbursement/): Since October 7, 2024, UK payment service providers must reimburse most victims of authorized push payment scams on Faster Payments, up to £85,000 per claim, with the cost split between the sending and receiving firms.
- [Inside BSP Circular 1213, the Philippines’ OTP rule](https://glide-tradecraft.pages.dev/dispatches/philippines-bsp-circular-1213/): Bangko Sentral ng Pilipinas Circular No. 1213 bars banks and other supervised financial institutions from using SMS or email one-time passcodes to authenticate high-risk transactions, starting June 25, 2026.
- [Singapore banks to phase out OTPs for customers with digital tokens](https://glide-tradecraft.pages.dev/dispatches/singapore-banks-phase-out-otp/): In July 2024 the Monetary Authority of Singapore and the Association of Banks in Singapore announced that major retail banks would phase out one-time passcodes for bank account logins by customers who have digital tokens activated on their mobile devices.

## Buyer’s guides

- [Phishing-resistant MFA: a buyer’s guide](https://glide-tradecraft.pages.dev/buyers-guides/phishing-resistant-mfa/): Phishing-resistant MFA is authentication that a fake site or man-in-the-middle can’t capture and replay, because the credential is cryptographically bound to the real site. FIDO2 passkeys and hardware security keys are the common examples, and CISA also counts PKI-based smart cards. SMS codes, authenticator-app codes and simple push approvals are not phishing-resistant.
- [SIM swap detection: a buyer’s guide](https://glide-tradecraft.pages.dev/buyers-guides/sim-swap-detection/): The most direct signal comes from the mobile operator: a SIM swap check reports whether the SIM tied to a number changed recently, and number verification confirms a request comes from that SIM. The CAMARA project standardizes both APIs. Banks combine them with their own device and session signals, and use them before trusting a number for recovery, new payees or high-risk payments.
- [SMS OTP alternatives: a buyer’s guide](https://glide-tradecraft.pages.dev/buyers-guides/sms-otp-alternatives/): There is no single best alternative for every flow. Passkeys are the most widely standardized phishing-resistant option and are accepted by NIST at AAL2. In-app approval on a registered device is what UAE and Singapore banks moved customers to. Carrier network checks are useful risk signals, and SIM-based cryptographic methods are emerging. Most organizations combine two or more.

## Vendor briefs

- [Evaluating Glide Identity: what each desk should ask before a pilot](https://glide-tradecraft.pages.dev/vendor-briefs/glide-identity/): Owner-affiliated vendor brief (Tradecraft's owner has a financial interest in Glide Identity; no ratings or recommendations). Glide Identity, a US company that trades as Glide.id, says its MagicalAuth product replaces SMS codes with verification through the mobile network, and in August 2026 it announced a beta across AT&T, T-Mobile and Verizon. Before a pilot, get written answers on how the method would be classified under NIST SP 800-63B-4, when and how fallback triggers, which devices, operating systems and plans are covered, how SIM swaps and eSIM transfers are handled, what data is processed, what it costs and how you would leave. We found no independent security assessment in our sources.

## Data

- [SMS OTP: who is phasing it out](https://glide-tradecraft.pages.dev/regulations/): Singapore, Malaysia, the UAE and the Philippines have ordered banks off SMS or email codes for some or all transactions since 2022. India's 2025 RBI rules, in force April 2026, open the door to alternatives. CSV: https://glide-tradecraft.pages.dev/regulations/sms-otp-regulation.csv

## The Wednesday Briefing (weekly)

- [No. 7, September 23, 2026](https://glide-tradecraft.pages.dev/briefing/2026-09-23/): This week: The Central Bank of the UAE directed banks to phase out SMS and email one-time passcodes, starting in July 2025 and finishing by March 31, 2026. Banks moved customers to in-app verification in their own mobile apps. Also: SMS one-time passcodes are “restricted” under NIST’s new guidelines. Here’s what that means for US banks; Carrier-native authentication, explained: how a SIM can sign a login. Plus 8 vulnerabilities CISA added to its Known Exploited Vulnerabilities catalog.
- [No. 6, September 16, 2026](https://glide-tradecraft.pages.dev/briefing/2026-09-16/): This week: Since October 7, 2024, UK payment service providers must reimburse most victims of authorized push payment scams on Faster Payments, up to £85,000 per claim, with the cost split between the sending and receiving firms. Also: The FCC’s SIM-swap rules: what carriers now have to do; SIM swap attacks, explained. Plus 10 vulnerabilities CISA added to its Known Exploited Vulnerabilities catalog.
- [No. 5, September 9, 2026](https://glide-tradecraft.pages.dev/briefing/2026-09-09/): This week: Yes. A passkey is bound to the website it was created for, so it can’t be entered on a look-alike site. NIST’s 800-63-4 update accepts synced passkeys at AAL2. The main new risk is the account that syncs them, which needs strong protection of its own. Plus 9 vulnerabilities CISA added to its Known Exploited Vulnerabilities catalog.
- [No. 4, September 2, 2026](https://glide-tradecraft.pages.dev/briefing/2026-09-02/): This week: An OTP bot is an automated calling or messaging service that impersonates a bank or other service and persuades the victim to read out or type in a one-time passcode, which the criminal uses at the same moment to log in or approve a payment. Plus 12 vulnerabilities CISA added to its Known Exploited Vulnerabilities catalog.
- [No. 2, August 19, 2026](https://glide-tradecraft.pages.dev/briefing/2026-08-19/): This week: A criminal persuades, tricks or bribes a mobile carrier into moving a victim’s phone number to a SIM they control. From then on the victim’s calls and texts, including one-time passcodes, go to the attacker. Plus 6 vulnerabilities CISA added to its Known Exploited Vulnerabilities catalog.
- [No. 1, August 12, 2026](https://glide-tradecraft.pages.dev/briefing/2026-08-12/): This week: The FCC’s 2023 order (FCC 23-95) requires US wireless carriers to authenticate customers securely before moving their number to a new SIM or provider, to notify customers of SIM change and port-out requests, and to offer account locks. It does not regulate how banks or apps use SMS codes. Plus 4 vulnerabilities CISA added to its Known Exploited Vulnerabilities catalog.

## Checklists

- [SMS OTP flow inventory](https://glide-tradecraft.pages.dev/checklists/sms-otp-flow-inventory/): Every place your organization still sends a code, ranked by where fraud cashes out.
- [NIST 800-63B-4 restricted-authenticator file](https://glide-tradecraft.pages.dev/checklists/nist-restricted-authenticator/): The four conditions for keeping SMS or voice codes, and the evidence to keep for each.
- [SIM swap: the first hour](https://glide-tradecraft.pages.dev/checklists/sim-swap-first-hour/): Containment and verification steps when a customer’s number may have been hijacked.
- [Passkey launch readiness](https://glide-tradecraft.pages.dev/checklists/passkey-launch-readiness/): What to settle before offering passkeys to customers or staff.
- [OTP bot hardening](https://glide-tradecraft.pages.dev/checklists/otp-bot-hardening/): Controls that narrow the window for code-relay attacks while codes remain.
- [Questions for SMS OTP alternative vendors](https://glide-tradecraft.pages.dev/checklists/sms-alternative-vendor-questions/): Eight questions to put to every vendor, in writing.

## Glossary

- [Account takeover (ATO)](https://glide-tradecraft.pages.dev/glossary/account-takeover/): Criminal control of a legitimate account.
- [APP fraud](https://glide-tradecraft.pages.dev/glossary/app-fraud/): Scams where victims authorize the payment themselves.
- [CAMARA](https://glide-tradecraft.pages.dev/glossary/camara/): Open-source project defining telecom network APIs.
- [FIDO2](https://glide-tradecraft.pages.dev/glossary/fido2/): Open standard behind passkeys and security keys.
- [Number verification](https://glide-tradecraft.pages.dev/glossary/number-verification/): Carrier check that a device holds a given number.
- [OTP bot](https://glide-tradecraft.pages.dev/glossary/otp-bot/): Automated calls that trick victims into reading out codes.
- [Passkey](https://glide-tradecraft.pages.dev/glossary/passkey/): A login credential bound to one website.
- [Phishing-resistant MFA](https://glide-tradecraft.pages.dev/glossary/phishing-resistant-mfa/): Authentication a fake site can't relay.
- [Silent network authentication](https://glide-tradecraft.pages.dev/glossary/silent-network-authentication/): Verification through the mobile network, with no code typed.
- [SIM swap](https://glide-tradecraft.pages.dev/glossary/sim-swap/): Hijacking a phone number by moving it to a new SIM.
- [Strong customer authentication](https://glide-tradecraft.pages.dev/glossary/strong-customer-authentication/): The EU's two-factor rule for payments.
- [Zero trust](https://glide-tradecraft.pages.dev/glossary/zero-trust/): No request trusted for where it comes from alone.

## Optional

- [Full text of every field guide, explainer, dispatch, buyer's guide and vendor brief](https://glide-tradecraft.pages.dev/llms-full.txt)
- [Editorial standards](https://glide-tradecraft.pages.dev/about/editorial-standards/)
- [Buyer's guide methodology](https://glide-tradecraft.pages.dev/buyers-guides/methodology/)