Passkeys are gaining ground, but SA’s device gap remains a hurdle
Arno van der Merwe, Product Manager
While passkeys quickly gain traction in developed markets, South African banks will need to address device compatibility and digital-readiness gaps before rolling them out at scale.
Fortunately, with a tiered approach, local customers can enjoy better biometric-based, browser protection as AI continues to ratchet up its fraud victim count.
SABRIC’s latest data shows that South Africa recorded 110,074 digital-banking crime incidents in 2025, with reported client losses up 29% year-on-year. In addition, Microsoft reports that when AI is embedded into phishing operations, they are seeing click-through rates reach 54%, compared to just 12% for more traditional campaigns, making AI-assisted lures around 4.5 times more effective.
Arno van der Merwe, Product Manager: Browser Experience at Entersekt, says the threat is evolving quickly, adding that while artificial intelligence has not fundamentally changed phishing, it has certainly industrialised it.
“Attackers can create convincing emails and voice calls more easily, launch campaigns faster, and replace fraudulent sites before they are caught. SMS one-time passwords remain a weak point because they can be exposed to phishing and SIM-swap fraud,” he shares.
Phishing-resistant browser-based security
Passkeys are a major step towards secure, low-friction, phishing-resistant passwordless authentication and are a way for financial institutions to replace passwords and OTPs with biometric, FIDO-based authentication across their digital channels. However, the technology, while readily adopted in developed markets, may not be a seamless fit for South Africa’s unique challenges.
“Passkeys can make it much harder for criminals to steal and reuse login credentials. But they are not a practical fit for every South African banking customer today,” van der Merwe says. “A local rollout would assume everyone has a compatible device, uses biometrics, and knows how to manage digital credentials. Without proper forethought, this could widen the gap between customers who can access stronger security and those who can’t,” he warns.
A tiered approach
The barrier to passkeys is not just whether a phone has biometric sensors. Van der Merwe says many affordable smartphones now have the necessary hardware, but users may not enable biometrics or be familiar with the password-management systems that store and sync credentials. What’s more, there are still several South Africans still using feature phones.
His recommendation is to match authentication options to customers’ circumstances. Banks could offer passkeys to customers with compatible devices who are ready to use them, while moving customers who cannot use passkeys away from SMS OTPs to app-based cryptographic identifiers.
A tiered system should not mean that only the most technologically equipped customers receive meaningful protection. Risk-based authentication, such as using relevant data about a customer’s typical behaviour, can help banks assess activity across different devices and authentication methods, van der Merwe says.
Recovery is part of security
A proper passkey rollout doesn’t end once the customer has enrolled. Customers can lose or replace phones, change devices or get locked out, and van der Merwe argues that banks have underinvested in the reset and re-enrolment process.
“Recovery needs to be secure enough to prevent criminals taking over an account, but workable for legitimate customers. Options could include identity checks using document or face scanning, or, where necessary, re-binding a device at a bank branch. South Africa’s existing branch networks may provide a useful fallback for some customers,” he says.
He also warns that banks should stop treating a phone number as a customer’s identity saying that a number is tied to a device and SIM, and SIM swaps can redirect SMS codes to criminals.
Weighing up the options and avoiding a two-speed system
Van der Merwe points out that there are always trade-offs when it comes to implementing a new technology. Passkeys depend on compatible devices, user understanding, and the systems used to store credentials. What’s more, strong recovery checks can also add friction, whereas weak ones can undermine the security they are meant to protect. And, if banks introduce passkeys for some customers but leave others relying on SMS OTPs, the result may be a two-speed system in which the people with fewer options remain more exposed.
Banks also face practical obstacles. Authentication processes may be spread across different teams and systems, and changing customer guidance takes time.
Van der Merwe says banks should start by auditing where SMS OTPs are still used, what devices their customers have and how often customers need to re-enrol a device.
“They should also update fraud-prevention messaging. ‘Don’t share your OTP’ is not enough if customers are being pressured into approving a request. Customers need guidance to read what they are approving and to be wary of pressure from someone on the phone,” he says.
Van der Merwe is a fan of passkeys and believes they can be an important part of stronger authentication. But he’s also clear that they are not a standalone solution.
“For banks, the challenge is to improve security across the customer base, not just for those who already have the newest devices and the confidence to use them. Authentication that only works for the users of the newest devices isn't an authentication policy. It's just a filter to see who gets defrauded first,” he says.
