Fresh issues have emerged over cybersecurity threats dealing with Nigeria’s financial sector following a reported information safety incident involving InvestNaija, warnings by First Bank towards malicious cell purposes and alerts over the rising use of synthetic intelligence (AI) by fraudsters.
The developments have heightened issues concerning the security of consumers’ private and financial info as cybercriminals deploy more and more subtle strategies to deceive banking clients and achieve unauthorised entry to delicate information.
In a notification to clients, InvestNaija disclosed that it acquired details about a possible information safety incident on October 28, 2026, which can have resulted in unauthorised entry to a small portion of buyer information.
The digital funding platform stated the affected information represented lower than one per cent of its clients’ info.
It defined that uncommon visitors had been detected throughout its retail channels, prompting fast motion to handle the menace, strengthen safety controls and defend clients’ info.
The firm stated it had reported the incident to regulation enforcement authorities and the related regulatory physique in keeping with the Nigeria Data Protection Act 2023 and different relevant regulatory necessities.
Although the incident was believed to have been contained, InvestNaija warned {that a} third get together might need obtained some clients’ e mail addresses and different contact info.
It consequently suggested clients to stay vigilant towards suspicious communications, stressing that it might by no means request passwords, cost particulars or one-time passwords (OTPs) by means of emails, textual content messages or phone calls.
The platform additionally assured clients that their investments remained protected and had been unaffected by the incident.
Meanwhile, First Bank has warned clients a few rising rip-off involving fraudulent pop-up messages which will seem on cell gadgets by means of malicious purposes.
According to the financial institution, the messages are designed to trick customers into disclosing delicate banking info or authorising fraudulent transactions.
One instance includes a pretend safety alert claiming that an account has irregular exercise and instructing the client to log in instantly, full a transaction or change a transaction password.
The financial institution cautioned clients towards appearing on such messages, describing them as scams.
It suggested customers to obtain purposes solely from trusted sources, together with the Google Play Store and Apple App Store, and keep away from putting in software program by means of suspicious hyperlinks or pop-up commercials.
Customers had been additionally urged to overview put in purposes, replace their gadget working techniques and safety software program, and be cautious of unfamiliar purposes requesting pointless permissions, significantly entry to Accessibility Services or permission to show over different purposes.
Separately, Lotus Bank has warned that fraudsters are more and more utilizing AI to create convincing emails, phone calls, textual content messages and movies that may be troublesome to tell apart from respectable communications.
As a part of its Cybersecurity Awareness Month advisory, the financial institution urged clients to confirm uncommon cost requests by means of trusted various channels and keep away from clicking suspicious hyperlinks, opening surprising attachments or scanning unverified QR codes.
It additionally suggested clients by no means to reveal passwords, private identification numbers or OTPs, and to report suspicious exercise promptly.
Customers have been suggested to confirm surprising requests independently, defend their login credentials and report suspected fraud instantly to their financial institutions.
Experts weigh in
Meanwhile, specialists have stated Nigeria’s financial sector should urgently shift from reactive to proactive cybersecurity methods or threat catastrophic losses.
Professor Obadare Peter Adewale, Professor of Practice in Cybersecurity, Chief Visionary Officer of Digital Encode Ltd stated although the present menace and rising assaults aren’t peculiar to Nigeria, operators within the nation’s financial sector should outsmart the criminals.
Prof Obadare, who warned that synthetic intelligence would amplify current vulnerabilities, urged financial institutions to handle basic safety gaps.
“If you don’t spend the money on cybersecurity, you invariably will still spend the money. Before a breach, everybody will be calculating and arguing. Still, when there is a single attack, everybody starts to throw money at cybersecurity,” Obadare acknowledged.
The cybersecurity knowledgeable criticised what he described as a persistent reactive mindset of the various organizations within the nation.
Drawing consideration to often-overlooked vulnerabilities, Obadare revealed that inside threats pose higher dangers than exterior actors.
“Careless employees and malicious employees are even more than external factors,” he stated, urging organisations to handle human elements alongside technological defences.
He stated know-how doesn’t create vulnerability — individuals do. True defence lies in steady consciousness, moral intelligence, and institutional self-discipline.
The professor cited latest high-profile breaches at world know-how giants as an example that even essentially the most subtle organisations should not immune.
He referenced a leak at NVIDIA, the world’s largest AI infrastructure supplier, attributable to improper patch administration, and a Microsoft Co-Pilot echo leak, in addition to safety failures at DeepSeek and ChatGPT.
“On the very day DeepSeek was launched, their entire database was exposed on the internet – chat histories, API keys, backend operational details, system logs, user prompts, everything,” Obadare disclosed, including that ChatGPT suffered an information breach affecting over 1.2 million subscribers resulting from vulnerabilities in open-source parts.
He additionally criticised what he noticed as non-functional Security Operations Centres throughout the sector.
The knowledgeable emphasised that efficient cybersecurity requires balancing safety actions with sustainable operations. “Resilience is about balancing between protection activities and sustainable activities. When one cheats the other, there will be a problem,” he stated.
Olalekan Otufowora, one other knowledgeable, stated strong regulatory measures must be carried out by the CBN to strengthen the financial sector’s cyber defences.
Otufowora known as on the CBN to restructure its oversight strategy and consolidate supervision of cybersecurity, information safety, and third-party administration inside a single supervisory construction to make sure consistency throughout all regulated entities.
UPDATE NEWS:
Nigerians can now make investments ₦2.5 million on premium domains and revenue about ₦17-₦25 million. All earnings paid in US Dollars. Rather than surprise,
click on right here to learn the way it really works.
