South African Banks: Navigating Passkey Implementation Challenges

• South African banks face significant challenges in rolling out passkeys due to device compatibility and digital readiness gaps among customers.
• Digital banking crime in South Africa saw 110,074 incidents in 2025, with client losses increasing by 29% year-on-year, exacerbated by AI-powered phishing.
• SMS one-time passwords are a weak point, vulnerable to phishing and SIM-swap fraud, making passkeys a crucial alternative for secure authentication.
• A tiered approach is recommended, offering passkeys to compatible users while moving others to app-based cryptographic identifiers, to avoid widening the security gap.
• Robust recovery processes, including identity checks and branch re-binding, are essential for passkey systems, as banks have historically underinvested in this area.

Without a thoughtful strategy, this could inadvertently widen the security divide, leaving some customers with robust protection while others remain vulnerable.

The landscape of digital banking security is undergoing rapid transformation, marked by a significant increase in sophisticated cyber threats. South African financial institutions are grappling with a surge in digital banking crime, with SABRIC data indicating 110,074 incidents recorded in 2025 alone. This alarming figure is compounded by a 29% year-on-year rise in reported client losses, underscoring the urgent need for enhanced `SA digital banking security` measures.

Artificial intelligence (AI) is playing a pivotal role in this escalation, industrializing phishing attacks rather than fundamentally altering their nature. Microsoft reports a stark difference in effectiveness: AI-embedded phishing operations achieve click-through rates of 54%, a substantial increase compared to the 12% seen in traditional campaigns, making them approximately 4.5 times more potent. This enables attackers to generate highly convincing emails and voice calls with greater ease, launch campaigns more rapidly, and replace fraudulent sites before detection, as noted by Arno van der Merwe, Product Manager: Browser Experience at Entersekt. Traditional authentication methods, particularly SMS one-time passwords (OTPs), remain a critical vulnerability due to their susceptibility to both phishing and SIM-swap fraud.

In response to these evolving threats, passkeys offer a promising solution, providing secure, low-friction, and phishing-resistant passwordless authentication. This FIDO-based `biometric authentication South Africa` technology is designed to replace conventional passwords and OTPs across digital channels. While passkeys are rapidly gaining adoption in developed markets, their widespread implementation in South Africa presents unique `South African banks passkey implementation challenges` that require careful consideration.

One primary hurdle is the significant gap in device compatibility and digital readiness among the South African populace. A universal rollout of passkeys would presuppose that all customers possess compatible devices, actively use biometrics, and are proficient in managing digital credentials. This assumption is problematic, as many affordable smartphones now include the necessary biometric hardware, yet a substantial portion of users may not activate these features or be familiar with password management systems. Furthermore, a considerable number of South Africans still rely on feature phones, which lack the capabilities required for passkey usage. Without a thoughtful strategy, this could inadvertently widen the security divide, leaving some customers with robust protection while others remain vulnerable.

To navigate these complexities, a tiered approach is recommended, allowing financial institutions to match authentication options to individual customer circumstances. Banks can offer passkeys to customers with compatible devices who are prepared to adopt them, while simultaneously transitioning those unable to use passkeys away from vulnerable SMS OTPs towards more secure app-based cryptographic identifiers. This ensures that enhanced `phishing prevention banks ZA` strategies do not exclude any customer segment, and that meaningful protection is extended beyond only the most technologically equipped.

Beyond initial enrollment, the long-term success of passkey implementation hinges on robust recovery and re-enrollment processes. Banks have historically underinvested in these critical areas. A secure recovery mechanism must be stringent enough to thwart criminal account takeovers, yet sufficiently user-friendly for legitimate customers. Solutions could include identity verification through document or face scanning, or, where necessary, device re-binding at a physical bank branch, leveraging South Africa's existing branch networks as a valuable fallback. It is also crucial for banks to cease treating a phone number as a definitive customer identity, given its susceptibility to SIM-swap fraud which can redirect SMS codes to malicious actors. Implementing new technologies like `FIDO authentication South Africa` inherently involves trade-offs, necessitating a balanced approach to security and accessibility.

Compliance officers and legal counsel for South African financial institutions must assess their digital security strategies, particularly regarding the phased adoption of passkeys, to balance enhanced fraud prevention with customer accessibility and regulatory requirements. They should also review risk management protocols in light of increasing AI-powered fraud and the vulnerabilities of traditional SMS OTPs, ensuring robust recovery processes and alternative authentication methods are in place for all customer segments.

Source: Original reporting via industry analysis