South Africa's SIM-swap problem Entersekt has been solving for its customers for years
Entersekt
Financial Mail says the fintech revolution has a SIM-swap problem. We agree, and we’re glad the rest of the industry is finally seeing it the way we always have.
Michael Avery is right. In his November Financial Mail article, “Fintech revolution has a SIM-swap problem,” he warns that South Africa is opening up instant payments while one of its most important identity credentials, the mobile number, remains easy to hijack.
Then he asks the question that matters: why shouldn’t every bank and payments provider know in real time that a SIM has just been replaced?
Our answer: they can. Entersekt’s technology does exactly this, and we've been enabling our customers for more than a decade to protect against SIM-swap fraud with an approach we've been refining since long before PayShap existed—and long before the problem made headlines.
We are glad to see the conversation catch up, though.
A huge problem, getting bigger
The scale is hard to overstate. The Communications Risk Information Centre reports that roughly 60% of mobile-banking fraud is associated with SIM-swap attacks. SABRIC puts digital-banking fraud losses at R2.4bn in 2025, up from about R1.9bn the year before.
And as payments become instant, the window to stop a fraudster shrinks from days to seconds. An institution that only learns about a SIM swap when the customer calls to complain has already lost.
Much of that loss flows through one weak point: institutions that still treat a text message as proof of identity.
How Entersekt stops SIM-swap fraud
Our approach rests on one principle, and has from day one: owning a phone number should never be enough to empty a bank account.
Entersekt’s MNO authentication checks SIM age and status with mobile network operators in real time, so an institution knows whether a SIM has recently changed before it sends a verification code or trusts that number with anything sensitive. It’s exactly the real-time warning Avery is calling for, and it’s already in production.
We go further. A SIM swap gets a criminal your text messages. It doesn’t get them your device. Entersekt’s cryptographic device binding ties authentication and transaction signing to the customer’s trusted device, and Context Aware™ Authentication weighs device, behavior, and location to decide when an action needs closer scrutiny. Hijacking a number simply doesn’t give an attacker what they need to move money.
Capitec Bank put this to work when it launched Samsung Pay in June 2022. As the Capitec case study describes, the bank used Entersekt’s SIM check to confirm a customer’s SIM hadn’t recently been swapped before letting them add a card to their digital wallet.
The same check protects any high-risk journey today, from account recovery to new-device registration and payment approval.
The fix doesn’t need to wait
Avery frames this as a sequencing problem: fix SIM security before opening the payments system to more players. We’d put it differently. South Africa doesn’t need to wait for SIM-registration reform. The tools to stop treating a phone number as proof of identity exist today, and they’ve been proven for years.
The Reserve Bank’s authorisation framework for non-bank payment providers, due by the end of November, is the moment to make them standard. Real-time SIM-change checks and device-bound authentication should be baseline requirements for any provider, bank, or fintech that initiates instant payments. Same activity, same risk, same safeguards.
If your institution still trusts a text message to prove who your customer is, you’re relying on the one channel criminals already know how to steal. We’ve been closing that gap for more than a decade, and we can close it for you now.
Talk to an Entersekt expert, and let's get your customers protected too.
