Banks Explore SIM-Based Security to Replace Texted Verification Codes

Financial institutions are beginning to explore a new method of online security that could phase out the familiar six-digit verification codes sent via text message. This shift is driven by the increasing vulnerability of SMS-based one-time passcodes (OTPs) to phishing, social engineering, and SIM-swap attacks.

Glide.id has launched a public beta of its MagicalAuth system, a cryptographic authentication technology that works across AT&T, T-Mobile, and Verizon networks on both iOS and Android devices. While banks and other services must integrate the technology for consumers to use it, the system promises a more secure and streamlined login experience.

Why Texted Codes Are Vulnerable

Traditional SMS OTPs require a user to receive a code via text message and then manually enter it into a login portal. This process introduces several potential points of failure. Scammers can trick individuals into reading the code aloud over the phone, capture it through fake login websites, or gain access to it via SIM-swap attacks, where an attacker takes control of a user's phone number. The Federal Trade Commission reported that imposter scams, a category often relying on such tactics, accounted for over $3.5 billion in reported losses in 2025.

"A texted code is a shared secret," said Eran Haggiag, founder and CEO of Glide.id. "It gets created, sent across the network, and then a person has to read it and type it in, and every one of those steps is a place it can be intercepted or tricked out of someone."

How SIM-Based Authentication Works

MagicalAuth operates differently by leveraging cryptographic credentials embedded within a phone's SIM or eSIM. Instead of sending a code, the system uses a carrier-issued cryptographic key to respond to a mathematical challenge during the authentication process. This secret never leaves the SIM card, similar to a chip in a credit card.

During login, the bank or service can use the carrier network to confirm the presence of the correct SIM without requiring user interaction. "That's what lets the carrier confirm it's really your SIM," Haggiag explained.

For the user, this means no app to download or settings to configure. The first time a user encounters the system, they would see a consent screen. Subsequent verifications are designed to occur in the background, significantly speeding up the login process compared to waiting for and entering an SMS code.

Addressing SIM-Swap Concerns

Glide.id states that MagicalAuth is designed to mitigate SIM-swap risks by monitoring for recent SIM changes in real-time. If a number is moved to a new SIM, the system imposes a temporary pause on authentication. This window is intended to allow the legitimate owner to detect the unauthorized change and recover their number.

Shawn Hakl, SVP and head of product at AT&T Business, noted that carriers can provide signals about recent SIM activity. "The key is that we can help verify what is happening on the network before a login is approved," Hakl said. "If a phone number was recently moved to a new SIM or eSIM, that is an important signal." Banks could use this information to require additional verification or pause transactions, disrupting a scammer's reliance on speed.

Limitations and Future Rollout

While the technology aims to enhance security, it does not eliminate social engineering tactics. Scammers can still use AI-generated voices or impersonation to trick users into authorizing transactions themselves. "It does not make fraud impossible, no security does," Haggiag cautioned.

Furthermore, the system's compatibility is currently limited. It works across major carriers like AT&T, T-Mobile, and Verizon for iOS and Android users, but some smaller carriers, MVNOs, and prepaid users may not be supported. The phone itself does not need to be new, but the carrier, plan, and the app being used must support the system.

When users obtain a new phone, replace a SIM, or switch to an eSIM, re-verification might be triggered. In such cases, banks may implement fallback identity checks to ensure security until the changes are confirmed.

Glide has made MagicalAuth available to businesses, but widespread adoption depends on individual banks integrating the technology. Glide's ultimate goal is for SIM-based authentication to become the primary method for supported users, rather than just an alternative.

Protecting Yourself Now

Until SIM-based verification becomes more common, users can take several steps to bolster their account security:

• Use Passkeys: When available, passkeys offer phishing-resistant authentication.
• Secure Wireless Accounts: Set up PINs or passwords with carriers and enable features like number locks or port-out protection.
• Never Share Codes: Do not share verification codes with anyone, even if they claim to be from your bank.
• Monitor Phone Service: Pay attention to sudden loss of cellular service, as it could indicate a SIM-swap attempt.
• Consider Identity Protection: Services that monitor for identity theft and credit freezes can add layers of security.
• Use Antivirus Software: Strong antivirus protection can help defend against malware and malicious links.
• Reduce Online Information: Limit the amount of personal data shared online to make impersonation scams less convincing.