Banks May Phase Out Text Message Security Codes With New SIM-Based Authentication

The Federal Trade Commission documented $15.9 billion in fraud losses during 2025, up from $12.5 billion in 2024, with imposter scams accounting for more than $3.5 billion of reported losses. Text-based security codes, long a standard defense against unauthorized account access, have become a vulnerability as criminals develop sophisticated methods to intercept or manipulate them.

Glide.id has introduced MagicalAuth, a cryptographic authentication platform now in public beta across AT&T, T-Mobile and Verizon on iOS and Android devices. The system replaces traditional one-time passwords sent via text message with credentials embedded directly in a phone’s SIM card, eliminating the need for users to enter security codes manually.

Unlike texted codes that pass through multiple networks and require user intervention, MagicalAuth relies on cryptographic keys stored within the SIM itself. Banks and financial services must integrate the technology on their end before customers experience the new verification process, which occurs silently in the background within fractions of a second.

SIM-swap attacks, where criminals redirect a phone number to a device under their control, pose a threat to any phone-based verification system. MagicalAuth addresses this by monitoring for recent SIM changes in real time and temporarily preventing authentication when a number moves to a new SIM, giving legitimate owners time to recover their accounts.

The technology does not eliminate all fraud risks. Criminals can still manipulate account holders into authorizing transfers themselves through social engineering, romance scams or investment fraud schemes. However, removing the texted code eliminates one widely exploited attack vector.

Coverage remains incomplete, with some mobile virtual network operators, smaller carriers and prepaid users not yet supported. Customers switching phones, replacing SIM cards or activating eSIMs may trigger additional verification steps until carrier systems confirm the device-number pairing remains valid.

Wireless carriers participating in the system share only verification signals rather than personal customer data with banks. AT&T describes the information exchange as a “yes-or-no trust signal” about whether a phone number matches carrier network records, not a transfer of customer personal information.

Banks are adopting MagicalAuth individually, with no universal rollout date announced. Glide’s long-term strategy aims to make SIM-based verification the primary authentication method for supported users rather than leaving text message codes as a fallback option.

Until widespread adoption occurs, account holders should enable passkeys where available, establish PIN protections with carriers, and request number-lock or port-out protection features. Consumers should never provide security codes to callers claiming to represent their bank and should verify requests by contacting banks directly through official channels.