A bank account was emptied. That is the sharp end of Entersekt's origin story. In 2008, a relative of the young engineers who would start the company was hacked, and the one-time-password defenses of the day did not save the money. The group at Stellenbosch University began with an unfashionable question: what if the phone could prove more than possession of a code? What if it could establish a private, encrypted relationship between the bank and the customer?
The answer became certificate-based mobile authentication. A registered device carried cryptographic credentials; the bank could send a transaction to that device; the customer could approve or reject it inside a trusted channel. No tiny hardware token. No code hopping from an SMS into a browser. No need to pretend that a password stolen yesterday remained a secret today.
Eighteen years later, Entersekt is a different-sized machine. The company says it serves more than 1,100 financial institutions, employs more than 250 people, and processes billions of transactions for cardholders and merchants in more than 70 countries. Its co-headquarters are in Atlanta and Stellenbosch, with teams across Europe, Africa, and the United States. The family fraud incident became enterprise infrastructure.
The first broken thingThe OTP was a doorbell, not a deadbolt
The early failure was not simply technical. It was a bad mental model. An OTP can show that someone received a message, but it says little about whether that person intended the transfer, whether the device was trusted, or whether a fraudster was coaching the victim on the phone. Social engineering, SIM swaps, phishing kits, and malware turned a supposedly strong step into a transferable commodity.
Entersekt's founders changed the unit of trust. Instead of authenticating a string of digits, they bound a device to a bank and protected the communication between them. Their early Transakt technology turned push approval into an interaction: here is the payee, here is the amount, do you approve? The company patented variations of that architecture and earned card-network certifications. Nedbank became an early customer and investor. The technology left the lab because banks had both the fraud problem and the distribution channel: their own mobile apps.
“Our customers and partners shouldn't have to rebuild authentication every time fraud evolves.”Mzukisi Rusi, Entersekt VP of Product Development
That sentence explains the modern company better than the alphabet soup of MFA, SCA, FIDO, ACS, and 3DS. Entersekt is selling a decision layer. It gathers signals about device, browser, behavior, location, account, and transaction. It then chooses an authentication path: allow the low-risk action silently, ask for a biometric or in-app approval, or stop the event. The goal is not frictionless everything. It is friction with a reason.
One transaction, many clues
The question mark is the product: not “Can this user enter a code?” but “Does this person, on this device, intend this exact action?”
What it sellsA traffic controller for money in motion
The product line now has three broad jobs. Digital Account Authentication protects logins, password resets, device enrollment, call-center conversations, and money movement such as wires or peer-to-peer payments. The 3-D Secure suite handles card-not-present commerce through an access-control server, 3DS server, and directory server. Authentication Advisor supplies risk intelligence to both, using real-time signals to recommend the right response.
Two newer products show where the strategy is going. Browser ID uses cryptographic keypairs to recognize a trusted browser without relying on tracking cookies or conventional device fingerprinting. Orkestrate packages more than 150 authentication journeys across more than 10 use cases behind a single API. Entersekt says the low-code service can cut integration time by 85 percent, from projects that can exceed a year to less than two months.
The business is enterprise software, sold directly and through platforms and partners. Banks, credit unions, processors, issuers, fintechs, merchants, and digital-banking vendors buy the technology. Entersekt does not publish list pricing. Its sales argument is built around the bill a bank already pays: fraud losses, false declines, abandoned checkouts, call-center work, compliance overhead, and engineers maintaining brittle authentication flows.
The company widened that addressable problem in December 2023 by acquiring Modirum's 3-D Secure software business. Modirum brought issuer, merchant, and cardholder scale plus a mature position in online payment authentication. Entersekt brought digital-banking authentication and device trust. The combination joined two views of the same customer that banks often keep in separate systems.
The proofSecurity that can survive a spreadsheet
Cybersecurity case studies tend to be fog machines. Entersekt's more useful customer stories attach numbers to the work. A top-20 U.S. bank reported a 70 percent reduction in card-not-present fraud. A top-50 bank reported a 90 percent reduction in account takeover fraud. Nedbank said successful phishing attacks fell by more than 99 percent after mobile authentication. The company advertises frictionless authentication rates of up to 98 percent.
The Capitec checkout effect
Reported change after streamlining 3-D Secure. Bars are indexed visually, not to a shared maximum.
Capitec offers the cleanest commercial example. The South African retail bank replaced an inflexible outsourced 3DS setup, enrolled customers automatically, and made checkout more consistent with its banking app. It reported a 54 percent increase in conversion over six months and 149 percent growth in transaction value in the first year. That result is not proof that authentication manufactures spending. It does show that a clumsy challenge can suppress legitimate purchases just as surely as a fraud rule can stop bad ones.
This is Entersekt's place in the market. Okta, Ping, Duo, and Entrust sell broad identity infrastructure. BioCatch and similar firms specialize in behavioral intelligence. Payment-security vendors focus on 3-D Secure. Banks also build their own combinations. Entersekt's distinction is narrower and more integrated: financial services only, digital banking plus card payments, active and silent factors, and orchestration across channels. Its partner roster - Mastercard, Q2, Alloy, CGI, MEA Financial, and ebankIT - gives it routes into bank systems that are famously reluctant to welcome new plumbing.
The transitionThe founder moves one chair over
Growth has demanded adult furniture. Accel-KKR invested in 2021 to fund hiring, cloud products, and expansion. PAPE Fund 3 later increased its stake. The funding amounts and the Modirum purchase price remained private. In August 2026, Clare Conway became CEO after serving as chief operating officer. She arrived with more than 25 years of enterprise technology and operational experience. Schalk Nolte, who had led the company for 17 years, became a founder and board member focused on market insight, product innovation, regulation, AI, and long-term strategy.
The handoff is less dramatic than a founder exit and more useful. Entersekt has crossed from proving that a phone can be trusted to coordinating a global platform, an acquisition, hundreds of employees, and regulated customers on several continents. The next bottleneck is disciplined execution. Conway's appointment says the company knows it.
Five things builders can copy
- Start with a failed assumption. Entersekt did not make OTPs prettier; it questioned what an OTP proved.
- Move the unit of value upward. The product evolved from one authenticator into the decision and orchestration layer.
- Measure the customer's economics. Fraud reduction matters, but so do conversion, call volume, false declines, and deployment time.
- Use partners as distribution. Q2, Alloy, CGI, and Mastercard place Entersekt inside systems banks already trust.
- Buy the adjacent data plane. Modirum added payment context and customers faster than an organic 3DS build would have.
The catchContext is only useful when you have it
The approach is not a universal recipe. It works best at regulated institutions with high transaction volume, a mobile or digital relationship, reliable device and behavior signals, and enough fraud cost to justify integration. A low-volume app with sparse data may not need this machinery. A bank that cannot connect its channels will still make partial decisions. A team that treats every unfamiliar event as dangerous will recreate the friction it meant to remove.
When the model breaks
Bad signals produce confident mistakes. Lost phones and new browsers require recovery. Behavioral models need monitoring for drift and bias. Bank teams must agree who owns the rules. And no authentication layer can rescue a customer who is fully deceived into approving a payment unless the system also examines intent and transaction context.
That last condition is the whole contest now. Fraud has moved beyond stealing credentials toward persuading real customers to perform real actions. Entersekt's original idea - make the device part of the proof - was a necessary correction to the password era. Its current idea is harder: understand the action well enough to know when the real customer is still making the wrong payment.
The company has grown by making authentication less visible. Its future depends on making judgment more visible to the institutions buying it: why this customer passed, why that transfer stopped, and what changed in the threat. The best outcome remains delightfully boring. The right person moves the right money, the fraudster does not, and nobody has to hunt for a six-digit code.