# KEV Now

> KEV Now tracks CISA's Known Exploited Vulnerabilities catalog by vendor, product, weakness and date, runs a status board of SMS OTP regulation, and publishes short, sourced intel briefings. Every figure is computed from public data and carries a citation.

All KEV figures below are computed from CISA's Known Exploited Vulnerabilities catalog, version 2026.11.04 (released 2026-11-04). Rolling windows end on 2026-11-04. When quoting a figure, cite the catalog version and the page URL.

## Key figures

- CISA KEV lists 1,768 vulnerabilities (catalog 2026.11.04), added between 2021-11-03 and 2026-11-04.
- Added in the last 7 / 30 / 90 days to 2026-11-04: 6 / 34 / 107.
- Known ransomware campaign use: 361 entries (20.4%).
- Median days from dateAdded to dueDate: 21.
- Top vendor: Microsoft with 390 entries (22.1%). Top 10 vendors: 52.9% of entries.
- Top weakness: CWE-20 (Improper input validation) on 119 entries.

## Data pages

- [Dashboard](https://kevnow.com/): live KEV figures, regulation board, latest briefings
- [State of KEV report](https://kevnow.com/stats/): 8 computed figures, each with a chart, a table and a citation
- [KEV index](https://kevnow.com/kev/): all entries, year archives, open deadlines
- [Ransomware-linked KEV entries](https://kevnow.com/kev/ransomware/)
- [Vendors ranked](https://kevnow.com/vendors/), [Products](https://kevnow.com/products/), [Weaknesses (CWE)](https://kevnow.com/cwe/)

## Figures

- [KEV additions per year](https://kevnow.com/stats/#additions-by-year): CISA added 555 entries in 2022, the catalog's first full calendar year, and 284 in 2026 through 2026-11-04. The catalog's first year, 2021, began on 2021-11-03 with 311 entries by year end.
- [KEV additions per month](https://kevnow.com/stats/#additions-by-month): The busiest month on record was November 2021, with 291 additions (the catalog's first month). Across all 61 months the median is 19 a month.
- [Top vendors by KEV entries](https://kevnow.com/stats/#top-vendors): Microsoft has the most KEV entries, 390 (22.1% of the catalog). The top 10 vendors account for 52.9%.
- [Top weaknesses (CWE) in KEV](https://kevnow.com/stats/#top-cwes): CWE-20 (Improper input validation) is the most-listed weakness, on 119 entries (6.7%). 175 entries list no CWE.
- [Known ransomware use](https://kevnow.com/stats/#ransomware-by-year): 361 of 1,768 KEV entries (20.4%) are flagged as known to be used in ransomware campaigns. By year added, the share ranges from 9.5% to 27%.
- [Days from addition to federal due date](https://kevnow.com/stats/#remediation-by-year): The median KEV entry gives federal agencies 21 days from dateAdded to dueDate. The median by year added was 2021: 181; 2022: 21; 2023: 21; 2024: 21; 2025: 21; 2026: 3.
- [Age of CVE IDs when added](https://kevnow.com/stats/#cve-age-by-year): 21.1% of KEV entries carry a CVE ID at least five years older than the year they were added. In 2022 that share was 47%.
- [KEV additions per week (last 26 weeks)](https://kevnow.com/stats/#weekly-additions): 180 entries were added in the 26 weeks to 2026-11-04, an average of 6.9 a week.

## Vendor dossiers

- [Microsoft](https://kevnow.com/vendors/microsoft/): 390 KEV entries (22.1%), 117 ransomware-linked, latest added 2026-10-13
- [Cisco](https://kevnow.com/vendors/cisco/): 102 KEV entries (5.8%), 7 ransomware-linked, latest added 2026-10-29
- [Apple](https://kevnow.com/vendors/apple/): 96 KEV entries (5.4%), 0 ransomware-linked, latest added 2026-11-04
- [Adobe](https://kevnow.com/vendors/adobe/): 83 KEV entries (4.7%), 11 ransomware-linked, latest added 2026-10-27
- [Google](https://kevnow.com/vendors/google/): 76 KEV entries (4.3%), 0 ransomware-linked, latest added 2026-10-27
- [Oracle](https://kevnow.com/vendors/oracle/): 46 KEV entries (2.6%), 13 ransomware-linked, latest added 2026-08-24
- [Apache](https://kevnow.com/vendors/apache/): 41 KEV entries (2.3%), 8 ransomware-linked, latest added 2026-10-08
- [Ivanti](https://kevnow.com/vendors/ivanti/): 38 KEV entries (2.1%), 12 ransomware-linked, latest added 2026-10-30
- [Fortinet](https://kevnow.com/vendors/fortinet/): 32 KEV entries (1.8%), 14 ransomware-linked, latest added 2026-10-16
- [Linux](https://kevnow.com/vendors/linux/): 32 KEV entries (1.8%), 2 ransomware-linked, latest added 2026-10-28
- [Citrix](https://kevnow.com/vendors/citrix/): 27 KEV entries (1.5%), 7 ransomware-linked, latest added 2026-10-04
- [D-Link](https://kevnow.com/vendors/d-link/): 26 KEV entries (1.5%), 2 ransomware-linked, latest added 2026-04-24
- [VMware](https://kevnow.com/vendors/vmware/): 26 KEV entries (1.5%), 9 ransomware-linked, latest added 2025-03-04
- [SonicWall](https://kevnow.com/vendors/sonicwall/): 19 KEV entries (1.1%), 13 ransomware-linked, latest added 2026-09-02
- [Synacor](https://kevnow.com/vendors/synacor/): 19 KEV entries (1.1%), 6 ransomware-linked, latest added 2026-08-21
- [Android](https://kevnow.com/vendors/android/): 17 KEV entries (1%), 0 ransomware-linked, latest added 2026-06-02
- [Palo Alto Networks](https://kevnow.com/vendors/palo-alto-networks/): 16 KEV entries (0.9%), 6 ransomware-linked, latest added 2026-10-14
- [Samsung](https://kevnow.com/vendors/samsung/): 15 KEV entries (0.8%), 0 ransomware-linked, latest added 2026-04-24
- [Atlassian](https://kevnow.com/vendors/atlassian/): 14 KEV entries (0.8%), 8 ransomware-linked, latest added 2026-10-15
- [SAP](https://kevnow.com/vendors/sap/): 14 KEV entries (0.8%), 3 ransomware-linked, latest added 2025-05-15
- [Mozilla](https://kevnow.com/vendors/mozilla/): 13 KEV entries (0.7%), 1 ransomware-linked, latest added 2025-10-06
- [Zyxel](https://kevnow.com/vendors/zyxel/): 13 KEV entries (0.7%), 2 ransomware-linked, latest added 2026-09-21
- [Qualcomm](https://kevnow.com/vendors/qualcomm/): 12 KEV entries (0.7%), 0 ransomware-linked, latest added 2026-03-03
- [Trend Micro](https://kevnow.com/vendors/trend-micro/): 12 KEV entries (0.7%), 0 ransomware-linked, latest added 2026-05-21
- [QNAP](https://kevnow.com/vendors/qnap/): 11 KEV entries (0.6%), 9 ransomware-linked, latest added 2023-12-21
- [Roundcube](https://kevnow.com/vendors/roundcube/): 11 KEV entries (0.6%), 0 ransomware-linked, latest added 2026-02-20
- [SolarWinds](https://kevnow.com/vendors/solarwinds/): 11 KEV entries (0.6%), 2 ransomware-linked, latest added 2026-06-05
- [Arm](https://kevnow.com/vendors/arm/): 9 KEV entries (0.5%), 0 ransomware-linked, latest added 2024-06-12
- [Progress](https://kevnow.com/vendors/progress/): 9 KEV entries (0.5%), 4 ransomware-linked, latest added 2026-08-07
- [Red Hat](https://kevnow.com/vendors/red-hat/): 9 KEV entries (0.5%), 4 ransomware-linked, latest added 2026-08-26
- [Zoho](https://kevnow.com/vendors/zoho/): 9 KEV entries (0.5%), 2 ransomware-linked, latest added 2023-03-07
- [F5](https://kevnow.com/vendors/f5/): 8 KEV entries (0.5%), 4 ransomware-linked, latest added 2026-09-22
- [IBM](https://kevnow.com/vendors/ibm/): 8 KEV entries (0.5%), 2 ransomware-linked, latest added 2026-08-04
- [Juniper](https://kevnow.com/vendors/juniper/): 8 KEV entries (0.5%), 0 ransomware-linked, latest added 2025-10-02
- [NETGEAR](https://kevnow.com/vendors/netgear/): 8 KEV entries (0.5%), 0 ransomware-linked, latest added 2022-09-08
- [Mitel](https://kevnow.com/vendors/mitel/): 7 KEV entries (0.4%), 5 ransomware-linked, latest added 2025-02-12
- [Sophos](https://kevnow.com/vendors/sophos/): 7 KEV entries (0.4%), 2 ransomware-linked, latest added 2025-02-06
- [WordPress](https://kevnow.com/vendors/wordpress/): 7 KEV entries (0.4%), 0 ransomware-linked, latest added 2026-11-03
- [Broadcom](https://kevnow.com/vendors/broadcom/): 6 KEV entries (0.3%), 1 ransomware-linked, latest added 2026-10-28
- [GitLab](https://kevnow.com/vendors/gitlab/): 6 KEV entries (0.3%), 1 ransomware-linked, latest added 2026-10-29
- [Jenkins](https://kevnow.com/vendors/jenkins/): 6 KEV entries (0.3%), 1 ransomware-linked, latest added 2025-10-02
- [TP-Link](https://kevnow.com/vendors/tp-link/): 6 KEV entries (0.3%), 0 ransomware-linked, latest added 2025-09-03
- [Check Point](https://kevnow.com/vendors/check-point/): 5 KEV entries (0.3%), 2 ransomware-linked, latest added 2026-09-22
- [DrayTek](https://kevnow.com/vendors/draytek/): 5 KEV entries (0.3%), 0 ransomware-linked, latest added 2025-05-15
- [Drupal](https://kevnow.com/vendors/drupal/): 5 KEV entries (0.3%), 2 ransomware-linked, latest added 2026-05-22
- [Exim](https://kevnow.com/vendors/exim/): 5 KEV entries (0.3%), 1 ransomware-linked, latest added 2022-03-25
- [GNU](https://kevnow.com/vendors/gnu/): 5 KEV entries (0.3%), 0 ransomware-linked, latest added 2026-01-26
- [Langflow](https://kevnow.com/vendors/langflow/): 5 KEV entries (0.3%), 1 ransomware-linked, latest added 2026-07-21
- [MikroTik](https://kevnow.com/vendors/mikrotik/): 5 KEV entries (0.3%), 0 ransomware-linked, latest added 2026-09-25
- [N-able](https://kevnow.com/vendors/n-able/): 5 KEV entries (0.3%), 0 ransomware-linked, latest added 2026-09-08
- [PaperCut](https://kevnow.com/vendors/papercut/): 5 KEV entries (0.3%), 2 ransomware-linked, latest added 2026-08-31
- [Plex](https://kevnow.com/vendors/plex/): 5 KEV entries (0.3%), 0 ransomware-linked, latest added 2026-10-20
- [RARLAB](https://kevnow.com/vendors/rarlab/): 5 KEV entries (0.3%), 4 ransomware-linked, latest added 2025-12-09

## SMS OTP regulation board (verified 2026-09-24)

- [Board](https://kevnow.com/regulations/): Singapore, Malaysia, the UAE and the Philippines have ordered banks off SMS or email codes for some or all transactions since 2022. India's 2025 RBI rules, in force April 2026, open the door to alternatives.
- [UAE](https://kevnow.com/regulations/uae/): SMS and email OTP phase-out. Jul 2025 – Mar 2026. Complete. Source: https://thepaypers.com/fraud-and-fincrime/news/uae-banks-cancel-otps-switching-to-in-app-verification
- [Philippines](https://kevnow.com/regulations/philippines/): Circular 1213: no SMS or email OTP for high-risk transactions. From Jun 25, 2026. In force. Source: https://www.gmanetwork.com/news/money/economy/992561/no-more-sms-email-otps-for-high-risk-financial-transactions-starting-june-25/story/
- [India](https://kevnow.com/regulations/india/): Authentication Directions 2025. From Apr 1, 2026. In force. Source: https://www.regulationasia.com/articles/rbi-mandates-2fa-and-new-security-rules-for-digital-payments
- [Singapore](https://kevnow.com/regulations/singapore/): OTP login phase-out for customers with digital tokens. From Jul 2024. In force. Source: https://www.mas.gov.sg/news/media-releases/2024/banks-in-singapore-to-strengthen-resilience-against-phishing-scams
- [Malaysia](https://kevnow.com/regulations/malaysia/): Banks directed off SMS OTP. 2022 – 2024. In force. Source: https://commsrisk.com/malaysian-banks-stop-using-sms-for-two-factor-authentication/
- [European Union](https://kevnow.com/regulations/european-union/): PSR / PSD3 fraud and SCA package. Deal Nov 27, 2025. Pending. Source: https://www.consilium.europa.eu/en/press/press-releases/2025/11/27/payment-services-council-and-parliament-agree-to-step-up-the-fight-against-fraud-and-increase-transparency/
- [United States](https://kevnow.com/regulations/united-states/): SP 800-63B-4: SMS OTP is a "restricted" authenticator. Final 2025. Guidance. Source: https://pages.nist.gov/800-63-4/sp800-63b.html

## Company dossiers

- [Company dossiers](https://kevnow.com/companies/): sourced fact files with a computed CISA KEV check
- [Aduna (Aduna Global, LLC)](https://kevnow.com/companies/aduna/): Aduna (Aduna Global, LLC) is a network-API joint venture of Ericsson and twelve mobile operators that, according to the company, aggregates carrier APIs such as Number Verification and SIM Swap for developer platforms. KEV Now's fact file (verified 2026-11-05) records 10 dated milestones between Sep 11, 2024 and Jul 8, 2026; the most recent is the U.S. Number Verification rollout announced Jul 8, 2026. Carriers in our sources: AT&T (Number Verification and SIM Swap announced Feb 27, 2025; Number Verification rollout announced Jul 8, 2026), T-Mobile (Number Verification and SIM Swap announced Feb 27, 2025; Number Verification rollout announced Jul 8, 2026), Verizon (Number Verification and SIM Swap announced Feb 27, 2025; Number Verification rollout announced Jul 8, 2026) and Bell, Rogers and TELUS (Canada, via EnStream) (reached through Aduna's integration with EnStream; Vonage launch announced Jun 30, 2026). CISA's KEV catalog 2026.11.04 lists 0 entries with a vendorProject matching “Aduna” (all 1,768 entries checked). No independent security assessment appears in our sources.
- [Boku (Boku, Inc. (formerly including Boku Identity))](https://kevnow.com/companies/boku/): Boku (Boku, Inc. (formerly including Boku Identity)) is a London-headquartered, AIM-listed payments company that, according to the company, connects merchants to local payment methods, and which built and then sold a carrier-connected mobile identity business (Boku Identity) to Twilio in 2022. KEV Now's fact file (verified 2026-11-05) records 9 dated milestones between Nov 20, 2017 and Mar 17, 2026; the most recent is the FY2025 results announced Mar 17, 2026. Carriers in our sources: Orange (France) (identity partnership announced Apr 20, 2021; the identity business was sold to Twilio in 2022 and the current status of the connection is not in our sources), SFR (France) (identity partnership announced Apr 20, 2021; current status not in our sources) and Bouygues Telecom (France) (identity partnership announced Apr 20, 2021; current status not in our sources). CISA's KEV catalog 2026.11.04 lists 0 entries with a vendorProject matching “Boku” (all 1,768 entries checked). No independent security assessment appears in our sources.
- [Entersekt (The Financial Authentication Company)](https://kevnow.com/companies/entersekt/): Entersekt (The Financial Authentication Company) is a South African-founded company that, according to the company, sells risk-based authentication and 3-D Secure payment authentication to banks, credit unions and card issuers. KEV Now's fact file (verified 2026-11-05) records 8 dated milestones between 2010 and Jul 30, 2026; the most recent is the New CEO announced Jul 30, 2026. CISA's KEV catalog 2026.11.04 lists 0 entries with a vendorProject matching “Entersekt” (all 1,768 entries checked). No independent security assessment appears in our sources.
- [Glide Identity (Glide.id)](https://kevnow.com/companies/glide-identity/): Glide Identity (Glide.id) is a US company that, according to the company, sells SIM-based authentication as a replacement for SMS one-time passcodes. KEV Now's fact file (verified 2026-09-24) records 5 dated milestones between 2024 and Aug 3, 2026; the most recent is the three-carrier beta announced Aug 3, 2026. Carriers in our sources: AT&T, T-Mobile and Verizon (beta announced Aug 3, 2026). CISA's KEV catalog 2026.11.04 lists 0 entries with a vendorProject matching “Glide” (all 1,768 entries checked). No independent security assessment appears in our sources.
- [Infobip (Infobip Group)](https://kevnow.com/companies/infobip/): Infobip (Infobip Group) is a Croatian cloud communications company that, according to the company, delivers one-time passcodes over SMS, voice and email and, since August 2026, sells SIM-based number verification as an alternative to them. KEV Now's fact file (verified 2026-11-05) records 9 dated milestones between Jul 30, 2020 and Aug 25, 2026; the most recent is the SIM-based Number Verification announced Aug 25, 2026. Carriers in our sources: Vivo (Brazil) (quoted in Infobip's Aug 25, 2026 launch release). CISA's KEV catalog 2026.11.04 lists 0 entries with a vendorProject matching “Infobip” (all 1,768 entries checked). No independent security assessment appears in our sources.
- [Okta (Okta, Inc.)](https://kevnow.com/companies/okta/): Okta (Okta, Inc.) is a US identity company that, according to the company, secures workforce and customer logins with its Okta and Auth0 platforms, including the Okta Verify app, FastPass passwordless sign-in and FIDO2/passkey authenticators. KEV Now's fact file (verified 2026-11-05) records 8 dated milestones between May 3, 2021 and Nov 1, 2024; the most recent is the 52-character username bug announced Nov 1, 2024. CISA's KEV catalog 2026.11.04 lists 0 entries with a vendorProject matching “Okta” (all 1,768 entries checked). No independent security assessment appears in our sources.
- [Prove Identity (Prove (formerly Payfone))](https://kevnow.com/companies/prove/): Prove Identity (Prove (formerly Payfone)) is a US company that, according to the company, verifies and authenticates people, businesses and AI agents using phone-number and SIM-based signals, as an alternative to SMS one-time passcodes. KEV Now's fact file (verified 2026-11-05) records 10 dated milestones between Jun 2020 and Sep 30, 2026; the most recent is the silent auth over Wi-Fi announced Sep 30, 2026. CISA's KEV catalog 2026.11.04 lists 0 entries with a vendorProject matching “Prove” (all 1,768 entries checked). No independent security assessment appears in our sources.
- [Sinch (Sinch AB (publ))](https://kevnow.com/companies/sinch/): Sinch (Sinch AB (publ)) is a Swedish listed communications-platform company that, according to the company, sells a Verification API with SMS, flash-call, phone-call and carrier data verification, and is expanding carrier Number Verify and SIM Swap through Aduna. KEV Now's fact file (verified 2026-11-05) records 10 dated milestones between 2008 and Nov 4, 2026; the most recent is the SpaceX Super Intelligence Network announced Nov 4, 2026. CISA's KEV catalog 2026.11.04 lists 0 entries with a vendorProject matching “Sinch” (all 1,768 entries checked). No independent security assessment appears in our sources.
- [Telesign (Telesign, a Proximus Global company)](https://kevnow.com/companies/telesign/): Telesign (Telesign, a Proximus Global company) is a US company owned by Belgium's Proximus that, according to the company, verifies phone numbers and users through SMS, silent carrier-based verification and other channels, and sells phone-number risk intelligence. KEV Now's fact file (verified 2026-11-05) records 11 dated milestones between Apr 25, 2017 and May 28, 2025; the most recent is the G2 Spring 2025 Leader announced May 28, 2025. Carriers in our sources: Proximus (Belgium) (partnership announced Oct 23, 2019; current status not in our sources) and Bouygues Telecom (France) (partnership announced Dec 17, 2019; current status not in our sources). CISA's KEV catalog 2026.11.04 lists 0 entries with a vendorProject matching “Telesign” (all 1,768 entries checked). No independent security assessment appears in our sources.
- [tru.ID (IDlayr (4Auth Limited))](https://kevnow.com/companies/tru-id/): tru.ID (IDlayr (4Auth Limited)) is a UK company, now trading as IDlayr, that, according to the company, sells SIM-based silent network authentication and SIM-swap check APIs as a replacement for SMS one-time passcodes. KEV Now's fact file (verified 2026-11-05) records 7 dated milestones between Feb 17, 2020 and Jan 11, 2024; the most recent is the rebrand to IDlayr announced Jan 11, 2024. Carriers in our sources: Telekom (Germany) (integrated, reported Apr 14, 2022), O2 (Germany) (integrated, reported Apr 14, 2022), Vodafone (Germany) (integrated, reported Apr 14, 2022), Orange (France) (integrated, announced Apr 21, 2022), SFR (France) (integrated, announced Apr 21, 2022) and Bouygues Telecom (France) (integrated, announced Apr 21, 2022). CISA's KEV catalog 2026.11.04 lists 0 entries with a vendorProject matching “tru.ID” (all 1,768 entries checked). No independent security assessment appears in our sources.
- [Twilio (Twilio Inc. (Verify, Lookup, Silent Network Auth))](https://kevnow.com/companies/twilio/): Twilio (Twilio Inc. (Verify, Lookup, Silent Network Auth)) is a US public company that, according to the company, sells user verification and phone-number intelligence APIs (Verify and Lookup), including a SIM-based Silent Network Auth channel that confirms phone possession without a one-time passcode. KEV Now's fact file (verified 2026-11-05) records 7 dated milestones between Feb 24, 2015 and Oct 30, 2025; the most recent is the stytch acquisition agreed announced Oct 30, 2025. CISA's KEV catalog 2026.11.04 lists 1 entry with a vendorProject matching “Twilio” (all 1,768 entries checked). No independent security assessment appears in our sources.
- [Vonage (Vonage Holdings Corp.)](https://kevnow.com/companies/vonage/): Vonage (Vonage Holdings Corp.) is a US communications-API company owned by Ericsson that, according to the company, sells a Verify API with Silent Authentication and carrier-sourced SIM Swap detection as alternatives to SMS one-time passcodes. KEV Now's fact file (verified 2026-11-05) records 9 dated milestones between Nov 22, 2021 and Jun 30, 2026; the most recent is the canada launch announced Jun 30, 2026. Carriers in our sources: Deutsche Telekom (Germany) (Number Verification launched Feb 27, 2024), Telefonica (Germany and Spain) (Number Verification launched Feb 27, 2024), Vodafone (Germany and Spain) (Number Verification launched Feb 27, 2024), Orange (Spain) (Number Verification launched Feb 27, 2024) and Bell, Rogers and TELUS (Canada, via EnStream) (Silent Authentication and SIM Swap launched Jun 30, 2026 through Aduna's EnStream integration). CISA's KEV catalog 2026.11.04 lists 0 entries with a vendorProject matching “Vonage” (all 1,768 entries checked). No independent security assessment appears in our sources.
- [Yubico (Yubico AB)](https://kevnow.com/companies/yubico/): Yubico (Yubico AB) is a Swedish hardware security company that, according to the company, makes the YubiKey, a device-bound passkey and multi-protocol authenticator, and helped create the FIDO2, WebAuthn and U2F standards. KEV Now's fact file (verified 2026-11-05) records 9 dated milestones between 2007 and Apr 2, 2025; the most recent is the YSA-2025-02 announced Apr 2, 2025. CISA's KEV catalog 2026.11.04 lists 0 entries with a vendorProject matching “Yubico” (all 1,768 entries checked). No independent security assessment appears in our sources.

## Briefings

- [Glide Identity's three-carrier beta: what the data does and doesn't show](https://kevnow.com/briefings/glide-identity-three-carrier-beta/): The sources establish that Glide Identity announced a beta of SIM-based cryptographic authentication across AT&T, T-Mobile and Verizon on Aug 3, 2026, and that trade and general press covered it. They do not show which devices, operating systems and plans work, how often fallback triggers, what it costs, or how it holds up under independent security review. (Confidence: Moderate)
- [The UAE’s SMS OTP phase-out is done. What US banks can take from it](https://kevnow.com/briefings/uae-sms-otp-phase-out/): The Central Bank of the UAE directed banks to phase out SMS and email one-time passcodes, starting in July 2025 and finishing by March 31, 2026. Banks moved customers to in-app verification in their own mobile apps. (Confidence: Moderate)
- [SMS one-time passcodes are “restricted” under NIST’s new guidelines. Here’s what that means for US banks](https://kevnow.com/briefings/nist-800-63-4-sms-otp/): NIST SP 800-63-4 does not ban SMS one-time passcodes. It classifies SMS and voice codes as “restricted” authenticators: still allowed, but only if the organization assesses the risk, tells users about it, offers at least one non-restricted alternative, and keeps a plan to migrate away. (Confidence: High)
- [Carrier-native authentication, explained: how a SIM can sign a login](https://kevnow.com/briefings/carrier-authentication-explained/): Carrier-based authentication verifies a user through their mobile operator instead of sending them a code. The simplest form checks that a request comes from the SIM tied to a phone number; stronger forms use cryptographic keys held in the SIM to sign the request. (Confidence: Moderate)
- [What the UK’s APP fraud reimbursement rules changed for fraud teams](https://kevnow.com/briefings/uk-app-fraud-reimbursement/): Since October 7, 2024, UK payment service providers must reimburse most victims of authorized push payment scams on Faster Payments, up to £85,000 per claim, with the cost split between the sending and receiving firms. (Confidence: High)
- [Are synced passkeys phishing-resistant?](https://kevnow.com/briefings/synced-passkeys-phishing-resistant/): Yes. A passkey is bound to the website it was created for, so it can’t be entered on a look-alike site. NIST’s 800-63-4 update accepts synced passkeys at AAL2. The main new risk is the account that syncs them, which needs strong protection of its own. (Confidence: High)
- [Why OTP bots keep working against bank customers](https://kevnow.com/briefings/otp-bots-explained/): An OTP bot is an automated calling or messaging service that impersonates a bank or other service and persuades the victim to read out or type in a one-time passcode, which the criminal uses at the same moment to log in or approve a payment. (Confidence: Moderate)
- [SIM swap attacks, explained](https://kevnow.com/briefings/sim-swap-attacks-explained/): A criminal persuades, tricks or bribes a mobile carrier into moving a victim’s phone number to a SIM they control. From then on the victim’s calls and texts, including one-time passcodes, go to the attacker. (Confidence: High)
- [The FCC’s SIM-swap rules: what carriers now have to do](https://kevnow.com/briefings/fcc-sim-swap-rules/): The FCC’s 2023 order (FCC 23-95) requires US wireless carriers to authenticate customers securely before moving their number to a new SIM or provider, to notify customers of SIM change and port-out requests, and to offer account locks. It does not regulate how banks or apps use SMS codes. (Confidence: High)
- [Inside BSP Circular 1213, the Philippines’ OTP rule](https://kevnow.com/briefings/philippines-bsp-circular-1213/): Bangko Sentral ng Pilipinas Circular No. 1213 bars banks and other supervised financial institutions from using SMS or email one-time passcodes to authenticate high-risk transactions, starting June 25, 2026. (Confidence: Moderate)
- [Singapore banks to phase out OTPs for customers with digital tokens](https://kevnow.com/briefings/singapore-banks-phase-out-otp/): In July 2024 the Monetary Authority of Singapore and the Association of Banks in Singapore announced that major retail banks would phase out one-time passcodes for bank account logins by customers who have digital tokens activated on their mobile devices. (Confidence: High)

## Trust

- [Methodology](https://kevnow.com/trust/methodology/)
- [Editorial standards](https://kevnow.com/trust/editorial-standards/)
- [Corrections](https://kevnow.com/trust/corrections/)
- [AI use](https://kevnow.com/trust/ai-use/)
- [Full text for LLMs](https://kevnow.com/llms-full.txt)