Your bank may stop texting you six‑digit codes

Top headlines are ready. Look at Fox News Flash. Visit FoxNews.com now.

If you use online banking, you probably know the steps: type your password and then wait for a six‑digit code that arrives by text. The code is meant to prove you are really you. Sadly, scammers have learned how to use those codes against us. This makes online banking riskier.

A fake bank worker may call and ask you to read the code out loud. A fake website can trick you into typing it. A SIM‑swap attack can let a thief control your phone number and see the texted codes.

The FTC says people lost $15.9 billion to fraud in 2025, up from $12.5 billion in 2024. Imposter scams were the biggest fraud type in 2025, causing more than $3.5 billion in losses.

A new phone‑based login method could soon replace texted codes. Glide.id has opened a public beta called MagicalAuth, a cryptographic system that works on AT&T, T‑Mobile and Verizon phones. Banks still need to add the technology before you see it when you log in.

Here is how the system works and what it could mean for future bank logins.

New! Free live CyberGuy class: Protect Your Money From Today’s Biggest Threats

Join us Saturday, Aug. 29 at 10 a.m. ET for a free CyberGuy LIVE class. We will cover five easy steps to guard against AI scams, fraud, identity theft and financial hacks. Kurt “CyberGuy” Knutsson will show how to set bank alerts, harden logins, protect your phone number, freeze credit and secure retirement accounts. No tech skill needed. You will also get a protection checklist and a link to the class recording.

Reserve your free spot today at CyberGuyLive.com.

YOUR FAMILY COULD BE ONE PHONE CALL FROM A BANK SCAM

A six‑digit text code can be used in phishing calls, fake bank calls and account‑takeover scams. (Kurt “CyberGuy” Knutsson)

Your bank sends a one‑time password (SMS OTP) to your phone and asks you to type it in. The problem is the code travels through many hands. “A texted code is a shared secret,” says Eran Haggiag, founder of Glide.id. “It is created, sent, read and typed, and each step can be intercepted.”

MagicalAuth works differently. Instead of sending a code, it uses cryptographic credentials stored in the SIM or eSIM of your phone. Eran says, “It relies on a secret built into the SIM that never leaves the phone, like a chip in a credit card.”

During login, the bank can ask the carrier network to confirm the expected SIM is present, instead of asking you to give a secret. “That lets the carrier verify it is really your SIM,” Eran explained.

Glide says each SIM has a carrier‑issued cryptographic key. MagicalAuth uses that key to answer a math challenge during login. “No app to download, no setting to change, and nothing for you to enroll in,” Eran told CyberGuy.

Instead, the bank adds the system on its side. The first time you see it, you will get a consent screen saying your phone number and device are being used to verify you. After that, the check runs in the background. Eran said, unlike SMS, “there is no code sent and nothing to type.”

“After that, verification happens quietly in the background in a fraction of a second, so the experience is faster and smoother than waiting on a text,” he said. For you, that means fewer moments staring at your Messages app for a bank code.

A SIM‑swap scam raises a clear question. If the SIM proves who you are, what happens when a thief moves your number to another SIM?

In a SIM‑swap attack, a criminal takes control of your phone number by moving it to a new SIM or eSIM. Your phone may lose service while calls and texts go to the attacker’s device. We covered a real case on The CyberGuy Report podcast where a sudden loss of service led to a SIM swap and thousands of dollars stolen.

Glide says MagicalAuth checks for recent SIM changes before allowing login. “We watch for SIM changes in real time, so we know the moment a number moves to a new SIM,” Eran said. “When that happens, we block the new SIM for a short time.”

That short pause gives the real owner time to notice the problem and recover the number. “So a stolen number alone is not enough to take over your accounts,” Eran added.

AT&T says the carrier can also share recent SIM activity information before a sensitive login is approved. “From the carrier side, we can help verify what is happening on the network before a login is allowed,” said Shawn Hakl, SVP of AT&T Business. “If a number was recently moved to a new SIM or eSIM, that is an important signal.”

A bank could use that signal to ask for another identity check or pause the action. “That matters because SIM‑swap fraud relies on speed,” Shawn said. “A scammer tries to move your number and use it before you notice your phone stopped working.”

YOUR MICROSOFT TEXT CODES ARE GOING AWAY

Banks could later use SIM‑based verification to confirm your identity in the background without sending a text code. (Kurt “CyberGuy” Knutsson)

Yes. Stronger login does not stop social engineering. A scammer can still pretend to be from your bank. AI‑generated voices can make those calls sound real. I also talked with JPMorgan Chase’s head of scam prevention about how scammers manipulate people live on The CyberGuy Report podcast.

MagicalAuth is meant to take one powerful tool away from scammers: the one‑time code. “They can’t reuse a stolen code because there is no code to steal, and they can’t phish something the user never sees or types,” Eran said.

There are limits. “No security makes fraud impossible,” Eran warned. A thief could still convince someone to send money or approve a transfer themselves. That is a different kind of scam because the real account holder is authorizing the move.

“What it doesn’t yet solve is a scammer tricking you into approving a transfer yourself, like romance or investment scams,” Eran said. Your judgment still matters. Better login security can make account takeover harder, but it cannot stop a scammer from persuading you to move money yourself.

Getting a new phone, changing a SIM or switching to an eSIM can change the data the carrier sees. That may trigger another verification check.

“If a customer gets a new phone, replaces a SIM or activates an eSIM, the carrier may need to re‑check that the phone number and device still match before allowing a sensitive login or transaction,” Shawn explained. Normally that check runs in the background.

If something does not match, the bank or app could ask you to verify your identity another way until the change is confirmed. “That extra step may feel like a little friction, but it is there for a reason,” Shawn said. “It helps stop a fraudster from moving your number to a new SIM and instantly using it to get into your accounts.”

Not yet. Glide says MagicalAuth works on iOS and Android with AT&T, T‑Mobile and Verizon, but not every wireless customer is supported. Some MVNOs, smaller carriers and many prepaid users are still left out.

The age of your phone is not the main factor. “The experience depends more on whether the carrier, plan and app you use are supported,” Shawn said.

Sometimes a network check cannot be completed. “In those cases, the bank or app should have a fallback identity check so the real customer is not locked out,” Shawn added.

If your carrier helps verify a bank login, you may wonder what information is shared. AT&T says the goal is to give a verification signal without sharing more personal data than needed. “Privacy must be central,” Shawn said. “These APIs provide verification, not extra personal data.”

In a typical flow, a bank asks whether a phone number can be verified against carrier data. Shawn described the response: “It is more like a yes‑or‑no trust signal than a transfer of customer data.”

AT&T says the signals give information about the service and SIM, not personal details about the customer. That network signal can become one factor the bank uses to decide if a login should proceed.

MagicalAuth uses carrier network data tied to your SIM or eSIM to help verify the expected device is present. (Kurt “CyberGuy” Knutsson)

Wireless carriers already have network signals that banks cannot see themselves. For example, a carrier can know a phone number was recently moved to another SIM. Now, network APIs let trusted services use some of those signals during login. “What has changed is that we are bringing that network‑level intelligence into online identity checks,” Shawn said.

For banks, this gives another way to judge whether the phone used during login matches what the network expects. For you, the interesting part is that the extra check can happen without another app or another code to type.

There is no single rollout date. Glide has made MagicalAuth available to businesses and developers, but each bank must adopt it on its own. “Banks have to implement this on their end, and that is starting to happen now with some of the biggest and most innovative banks,” Eran said.

Glide’s long‑term goal is to move users away from SMS authentication, not just keep text messages as a fallback. “The intent is for this to become the main authentication method for supported numbers, not one option among many,” Eran explained.

Your bank will decide if and when it uses SIM‑based verification. Until then, you can tighten security on accounts that still rely on texted codes.

If your bank or another important account supports passkeys, consider using one. Passkeys resist phishing because there is no code or password to copy into a fake login page. Eran also recommends using passkeys while banks continue to rely on one‑time codes.

Set a PIN or password with your carrier. Check if your provider offers a number lock or port‑out protection feature. Those safeguards make it harder for someone to move your number to another carrier or SIM without your permission.

If your bank still sends security codes by text, keep them private. If someone calls claiming to be from your bank and asks for a code, hang up. Then contact your bank using the official number on its website, app or the back of your card. We have seen how convincing this can be. In one podcast case, a woman drove to her bank while a scammer stayed on the line and almost withdrew $15,000.

If your phone suddenly loses service, call your carrier. It could be a normal outage, but it might also signal that someone tried to move your number to another SIM.

If a scammer gathers enough of your personal data, the damage can go beyond one bank login. An identity‑theft protection service can watch for signs of misuse and help you respond. You can also freeze your credit for free with the three major bureaus to make it harder for someone to open new accounts in your name. See my tips and picks on Best Identity Theft Protection at Cyberguy.com

SIM‑based verification can make stolen text codes less useful, but scammers can still attack through phishing links and malicious sites. Good antivirus software can spot malware and warn you about dangerous links before they harm your device or data. Check my picks for the best 2026 antivirus winners for Windows, Mac, Android and iOS at Cyberguy.com

Scammers can use online details to make fake bank calls sound real. A data‑removal service can lower the amount of personal info available on people‑search sites and data‑broker databases. Look at my top data‑removal picks and get a free scan to see if your info is already online at Cyberguy.com

I have warned many times about fake bank calls that claim there is suspicious activity on your account. Soon they ask for the security code that just arrived on your phone. The good part of SIM‑based verification is simple: if the code never shows up, a thief cannot ask you to read it back. I also like that this method does not require another app or you becoming a security expert. If your bank adopts it, the heavy work happens between the bank and the carrier network. But stay alert. A convincing scammer can still persuade you to move money yourself, and AI‑generated voices can make those calls harder to spot. Removing the six‑digit code could take away one of the easiest tricks in a scammer’s playbook.

CLICK HERE TO DOWNLOAD THE FOX NEWS APP

Would you feel safer if your bank stopped texting security codes and used this kind of technology? Let us know by writing to us at Cyberguy.com

Kurt "CyberGuy" Knutsson is an award‑winning tech journalist who loves technology, gear and gadgets that improve life. He writes for Fox News & FOX Business and appears each morning on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.

COPYRIGHT DISCLAIMERS

4English does not own the rights to this content. All rights belong to the owner. 4English only uses this content to help users learn English via the app's features. Contact to request the removal of your content: contact@4englishapp.com.

Prática de escuta

Prática de escuta