Nigeria's fintech industry has made moving money easier than ever. But while financial services have become faster and more accessible, the systems behind them are facing increasingly sophisticated threats.

Recent reports of coordinated cyberattacks targeting Nigerian financial institutions have exposed a difficult question: is the industry's approach to security and fraud prevention keeping pace with the technology it has built?

The answer goes beyond keeping hackers out of a company's systems. It depends on how well cybersecurity, identity, fraud prevention, and industry collaboration work together. And recent events show there are gaps worth closing.

What's happening to Nigerian fintechs?

On November 6, 2026, Nigerian lending technology company Lendsqr published a security advisory warning of a sustained wave of attacks on banks, fintechs, and lenders. It described several attack patterns:

• Compromised developer credentials: old GitHub access tokens used to push malicious code into software repositories, putting later builds and developer machines at risk.
• Phishing: fake emails sent through hijacked email-service accounts to steal logins, two-factor authentication codes and API keys.
• Attacks on admin accounts: repeated login attempts against privileged accounts across many organisations.
• API probing: scripted tests of payment links, password resets, webhooks and other endpoints for anything that leaks data or moves money.
• Hunting for exposed secrets: automated scans of public websites for configuration files and cloud credentials.

One finding stood out: mule accounts and weak account validation. Lendsqr reported that at some banks, account-name enquiry returned a real account name for an obviously invalid account number, and that attackers were routing stolen funds to such accounts. The advisory does not say how many banks are affected, so this should be read as Lendsqr's observation rather than an established industry-wide finding.

Separately, BusinessDay reported on November 7 on allegations, first published by the newsletter Notadeepdive, that several unnamed fintechs had suffered significant losses. The companies were not identified, and the figures have not been independently verified.

What these reports do show is that attackers are probing multiple layers of a financial institution, from developer tools and staff accounts to payment systems and customer-facing apps.

What Nigeria's fraud numbers actually tell us

The attacks come against a mixed picture of fraud. According to figures published by NIBSS, the Nigeria Inter-Bank Settlement System, industry fraud losses were:

• 2023: ₦17.67 billion
• 2024: ₦52.26 billion
• 2025: ₦25.85 billion

The 51% fall from 2024 to 2025 looks encouraging, but it needs context. NIBSS CEO Premier Oiwoh explained that 2024 was inflated by a single ₦31.1 billion fraud incident at one entity. Losses in 2025 were still higher than in 2023.

Incident counts tell a similar story. Reported cases fell from 123,918 in 2021 to 67,518 in 2025, but the decline in the last year was only about 4%.

NIBSS also named social engineering, insider abuse, SIM swap fraud, phishing and account compromise as threats that continue to evolve.

The numbers reveal an important distinction. While reported fraud incidents have declined, financial institutions are still exposed to significant losses and evolving attack methods. Measuring progress requires looking beyond the number of reported cases to understand the severity of incidents, the effectiveness of existing controls, and the threats that may go undetected.

The problem is bigger than one fintech

Modern financial services run on interconnected systems. A fintech may rely on outside providers for cloud hosting, payments, identity verification, messaging and more. These integrations speed up innovation, but they also create dependencies that have to be managed.

In September 2026, the Central Bank of Nigeria warned that a cyber incident at one bank, fintech, payment provider or technology vendor could spread across the wider financial system. Dr Rakiya Yusuf, director of the CBN's Payments System Supervision Department, urged institutions to keep reviewing their third-party dependencies and to report cyber incidents promptly.

The risk is easy to picture. A compromised service provider can affect every organisation that depends on it. Credentials held by a developer or contractor who works with several companies can open doors well beyond the place they were first stolen.

Fintech leaders need to know who has access to critical systems, how third-party services are connected, and whether essential operations can keep running during a disruption. Security can no longer be judged within the walls of one organisation.

Security, fraud prevention and identity: different jobs, one defence

Cybersecurity and fraud prevention are often treated as the same thing. They are not.

Cybersecurity protects systems, applications, networks and data from unauthorised access. Fraud prevention identifies and stops deceptive activity aimed at obtaining money or other benefits. Identity verification establishes who a customer is.

The attacks Lendsqr described show how these differ:

• A stolen developer token that lets malicious code into a repository is mainly a cybersecurity problem.
• An attacker exploiting weak account validation to move stolen funds is a payment security and fraud problem.
• A fraudster opening an account with someone else's details is an identity and customer due diligence problem.

Identity verification matters, but its role must be understood correctly. At onboarding, identity checks help confirm customers are who they claim to be, which reduces impersonation and some forms of fraudulent account creation. But passing verification once doesn't make every later action legitimate. A genuine customer's account can be taken over through phishing. A properly opened account can be misused to receive stolen funds. And weak payment validation can be abused even when the identity data is accurate.

That's why strong authentication, checks on sensitive account changes, payment validation, behavioural monitoring and transaction controls all matter. The goal isn't to choose between cybersecurity, fraud prevention and identity. It's to make sure they reinforce each other across the whole customer relationship.

Five priorities Nigerian fintechs should reconsider

The recent incidents are a good prompt for financial institutions to review the controls they already have.

1. Review access to critical systems

The reported misuse of old developer tokens shows why access management needs constant attention. Keep an inventory of privileged accounts, review developer and contractor access regularly, and revoke credentials that are no longer needed.

A quarterly review of former staff and contractor access, plus immediate removal when a role or engagement ends, is a practical starting point. Teams should also check that no credentials are exposed in source code or configuration files, and that privileged accounts use strong authentication.

2. Strengthen account recovery and sensitive account changes

Not every account takeover starts with a stolen password, and a stolen password doesn't have to mean a takeover. According to BusinessDay's account, one attacker reportedly used a borrower's genuine password but was stopped by Lendsqr's device verification.

Fintechs should review how customers recover accounts, reset authentication factors and change sensitive details. They should also assess whether account recovery processes can be exploited to bypass existing authentication controls.

For higher-risk actions, extra verification, alerts, and transaction safeguards reduce the chance of unauthorised changes. These controls should match the actual risk rather than adding friction to every interaction.

3. Examine payment validation and mule-account risk

The account-validation weakness Lendsqr described shows why payment controls need checking well beyond onboarding. Institutions should review how beneficiary account details are validated, how unusual payment destinations are flagged, and how suspicious activity is escalated.

Testing how account-name enquiry handles invalid or unexpected inputs can reveal gaps. Fraud and compliance teams also need clear procedures for investigating accounts suspected of receiving illicit funds. Identity verification supports customer due diligence, but payment validation and transaction monitoring remain separate, necessary controls.

4. Look beyond onboarding when assessing fraud risk

Verification lays the foundation, but risk doesn't stay still after an account opens. A customer who presented no obvious concerns during onboarding may later exhibit unusual transaction patterns, changes in financial activity or other behaviour that warrants investigation.

Institutions should regularly assess whether their monitoring systems can identify emerging risks, detect suspicious transaction patterns and recognise changes in customer risk profiles.

This also means reviewing how risk assessments are updated over time and whether monitoring alerts lead to timely investigations. Fraud prevention should cover the whole customer lifecycle, not just the first interaction.

5. Improve incident reporting and industry collaboration

One of the most important findings in NIBSS's data concerns reporting. Oiwoh said fraud reporting fell by 34% in the last quarter of 2025, and that in several cases people involved in fraud simply moved to other institutions because incidents hadn't been reported. The CBN has made the same point, calling for prompt reporting so others can respond before an isolated incident spreads.

Institutions should have clear processes for documenting suspicious incidents, reporting through the right channels, and sharing actionable threat intelligence where the law allows.

This also intersects with data protection. Under Section 40 of the Nigeria Data Protection Act 2023, data controllers must notify the Nigeria Data Protection Commission (NDPC) within 72 hours of becoming aware of a personal data breach likely to put individuals' rights and freedoms at risk.

Not every cyberattack is a reportable breach. As an NDPC official told BusinessDay, an attack on internal infrastructure, source code or payment systems is not automatically reportable if customers' personal data isn't compromised. Each organisation has to assess the incident, the data involved and the rules that apply.

Good collaboration helps institutions spot threats early without compromising customer privacy or confidentiality.

Building a safer fintech ecosystem is a shared responsibility

Nigeria's fintech industry has shown how technology can make financial services more accessible. Protecting that progress takes sustained investment in the systems, processes, and partnerships that support trust.

The recent reports should push institutions to ask three questions. Do our security and fraud controls work together? Do we understand our technology dependencies? How quickly can we detect and respond to a new threat?

They should also encourage more open, responsible collaboration. Fraudsters exploit weaknesses across many institutions, and a threat one company spots may already be hitting others.

At Dojah, we believe identity verification and fraud prevention play an important role in building trust in digital financial services. But no single solution protects that trust on its own. It takes financial institutions, technology providers, and regulators treating security and fraud risk as connected responsibilities.

The question is no longer just whether Nigerian fintechs can prevent the next attack. It's whether the industry is building the systems, practices, and partnerships to respond when threats emerge.

If the next major threat were already emerging, would your organisation recognise the warning signs, and would it know how to respond?