A customer signs up, passes every KYC check, and gets onboarded without a single alert. For months, the account stays inactive. Then it suddenly starts moving high-value funds. By the time your fraud team investigates, the money is gone. The fraud did not happen at onboarding. It happened afterward, when no one was watching.

This is not an isolated case. In 2025 alone, Nigerian banks recorded a 71.5% increase in dormant and sleeper accounts, with more than 33 million inactive accounts across the banking system. For African fintechs, sleeper account fraud works because fraud networks exploit the period after onboarding, when inactive accounts often receive little scrutiny.

This article explains what sleeper account fraud is, why onboarding-only detection misses it, and how continuous monitoring helps early detection.

What Sleeper Account Fraud Is and How It Gets Created

Sleeper account fraud happens when an account passes onboarding without raising any concerns, remains inactive for a period, and later activates to carry out fraudulent activity. The account looks legitimate when it is created. The fraud happens much later, after onboarding controls have already cleared it.

Three things make sleeper account fraud different:

• It is not account takeover: Account takeover happens when a fraudster gains access to someone else's legitimate account. Sleeper account fraud starts with an account the fraudster creates or acquires themselves. The account appears legitimate from the beginning. The fraud simply has not started yet.
• The identity is not what defines it: Sleeper accounts can be created with real, farmed, stolen, or synthetic identities. What makes them sleeper accounts is not the type of identity used. It is the deliberate delay between onboarding and the eventual fraud.
• Dormancy is part of the strategy: The period of inactivity is intentional. It allows the account to appear like any other low-activity customer before the fraud begins. By the time a high-value transaction appears, the account has already outlived most onboarding controls.

How Sleeper Accounts Are Created

Sleeper accounts are usually created in three stages:

• A verified identity clears onboarding: The account begins with an identity that passes KYC, whether it is real, farmed, stolen, or synthetic. Once verification is complete, the account stays inactive. Nothing about it appears suspicious.
• Fake reactivation builds legitimacy: Fraudsters do not always leave the account untouched. They may log in occasionally, update account details, or make a few low-value transactions before carrying out the fraud. This gradual activity creates the appearance of normal customer behaviour and makes the eventual fraud look less unusual.
• Organised fraud networks seed accounts at scale: According to the Dojah Fraud Insights Report 2025, organised fraud networks often plant sleeper accounts across multiple fintech platforms as part of coordinated campaigns. Instead of activating one account at a time, they can trigger many accounts together when the opportunity arises.

What an account looks like on the day it is created is rarely what it looks like when the fraud begins. That change is exactly where many onboarding-focused fraud controls lose sight of the risk.

What Activation Looks Like

A sleeper account can remain inactive for weeks or months before its behaviour changes completely. That shift is often the strongest fraud signal, but you only see it if you look beyond the latest transaction.

Here's what activation looks like:

• Sudden activity after a long silence: An account with little or no activity suddenly processes a high-value transfer, rapid withdrawals, or multiple loan applications within a short period. Each action may appear legitimate on its own. The real signal is how different it is from the account's history.
• Funds move quickly across accounts: Sleeper account fraud rarely stops with one transaction. Fraudsters often move funds through multiple accounts, sometimes across different platforms, before the activity is detected. That makes the funds harder to trace and recover.
• Multiple accounts activate together: Organised fraud networks often activate several sleeper accounts at the same time across different platforms. If you only monitor activity within your own platform, you may miss the wider pattern behind the attack.

By the time the activation pattern becomes obvious, the fraud has often already run its course. Detecting it means spotting the warning signs before that happens.

Why Onboarding-Only Detection Misses It

Sleeper account fraud succeeds because it avoids the point where most fraud controls are strongest. The account passes onboarding without raising concerns. For teams tackling post-onboarding fraud in fintechs across Nigeria, the real risk begins after onboarding, when many platforms are no longer watching as closely.

Here's where onboarding-only detection falls short:

• The account looked legitimate at signup: Nothing at onboarding suggested the account would become fraudulent. Standard KYC verifies identity and assesses risk at a single point in time. It cannot tell you how an account will behave months after it goes live.
• Inactivity does not raise suspicion: Dormant accounts rarely trigger alerts because there is little or no activity to analyse. They remain in the system looking like legitimate, low-activity customers. If you only monitor active behaviour, that period of silence is easy to overlook.
• Activation looks different from new account fraud: A months-old account making a high-value transaction often receives less scrutiny than a newly created account doing the same thing. The dormancy period builds trust that onboarding-focused controls were never designed to reassess.

What sleeper account fraud needs is not stronger onboarding checks alone. It requires continuous visibility across the entire account lifecycle.

What Detection Requires Beyond KYC

Catching sleeper account fraud requires more than a successful onboarding check. You need continuous monitoring that tracks how account behaviour changes over time, not just what the account looked like on day one. Here's what effective detection looks like:

1. Track the shift from dormant to active

One of the clearest fraud signals is a dormant account suddenly becoming active. A monitoring system should detect that shift, especially when it is followed by high-value or unusual transactions that do not match the account's previous behaviour.

2. Monitor device consistency over time

A device fingerprint that has never been seen on an account is a strong signal that something has changed. When a dormant account logs in from a new device just before a high-value transaction, it should be flagged for further review.

3. Compare transactions with account history

Every transaction should be assessed against the account's own history, not just platform-wide thresholds. An amount that seems normal across your platform may be highly unusual for that specific account.

4. Monitor behaviour throughout the account lifecycle

Risk changes as customer behaviour changes. Continuous monitoring keeps updating an account's risk profile over time, helping you identify unusual patterns before they become costly fraud events.

Continuous monitoring after onboarding closes the gap sleeper account fraud depends on. That is the layer Dojah's Profiled Risk is built to provide.

How Dojah's Profiled Risk Detects Sleeper Account Fraud

Sleeper account fraud is difficult to catch when monitoring ends at onboarding. Profiled Risk extends risk monitoring across the full account lifecycle, helping fraud teams identify behaviour that changes over time instead of relying on a one-time onboarding assessment.

• Continuous behavioural monitoring: Monitoring continues after onboarding, building a behavioural baseline for every account. As activity changes, unusual patterns surface instead of relying on the risk score assigned at signup.
• Detect the shift from dormant to active: A dormant account suddenly becoming active is treated as an important risk signal. Activity is assessed against the account's history, helping fraud teams identify behaviour that does not fit its established pattern.
• Track device and behavioural signals: A new device, changing login patterns, or other behavioural shifts become more meaningful when viewed together. Connecting these signals helps surface suspicious activity that isolated checks can miss.
• Update risk as behaviour changes: Risk is continuously reassessed as new activity occurs. Instead of relying on what an account looked like during onboarding, decisions reflect how it behaves over time.

For African fintechs and lending platforms, Profiled Risk extends fraud detection into the stage of the account lifecycle where sleeper account fraud is most likely to emerge.

 Sign up on Dojah's Profiled Risk  to detect sleeper account fraud after onboarding on your platform 

Frequently Asked Questions

1. What is sleeper account fraud?

Sleeper account fraud happens when an account passes onboarding, remains inactive for a period, and is later activated to carry out fraudulent activity. The fraud succeeds because the account appears legitimate at signup and only becomes risky long after onboarding.

2. Why is sleeper account fraud becoming a growing concern for African fintechs?

As digital financial services expand, fraud networks are increasingly exploiting the period after onboarding. Sleeper account fraud across Africa highlights why fraud teams need continuous monitoring instead of relying only on identity verification at account creation.

3. How can fintechs improve dormant account fraud detection?

Effective dormant account fraud detection in Africa requires monitoring behavioural changes over time. Signals such as sudden account reactivation, unfamiliar devices, unusual login activity, and transactions that differ from an account's history can help identify fraud earlier.

4. Why does onboarding alone fail to stop post-onboarding fraud?

Onboarding verifies who a customer is at a single point in time. It cannot predict how an account will behave months later. For teams managing post-onboarding fraud in Nigerian fintechs, continuous monitoring is essential to detect suspicious activity that emerges after onboarding.