Nigeria's Fraud Losses Keep Climbing Even as Reported Incidents Fall
Fewer fraud cases are being recorded in Nigeria, but each one costs more. A new cybersecurity framework is coming; whether enforcement will follow is the real question.
Key points
- Nigerian organisations faced an average of 4,361 attempted cyberattacks per week in June 2026, more than double the global weekly average of 2,270, according to Check Point Software.
- Digital-payment fraud losses in Nigeria rose from roughly US $12.8 million in 2023 to US $18.7 million in 2025, even as the total number of fraud incidents fell.
- Reported incidents dropped 34% in the final quarter of 2025, which regulators say reflects a reporting problem rather than a safety improvement.
- Nigeria's 2023 Data Protection Act requires organisations to notify the Nigeria Data Protection Commission (NDPC) of a breach within 72 hours, but enforcement is inconsistent.
- A forthcoming national cybersecurity framework will set minimum security spending levels and require incident reporting, though no launch date has been confirmed.
The headline numbers look encouraging. Fraud incidents reported in Nigeria fell from roughly 124,000 in 2021 to around 68,000 in 2025, a drop of nearly 46%. Then you look at the money.
In 2025, digital-payment fraud cost Nigerians approximately US $18.7 million (₦25.85 billion), up from US $12.8 million (₦17.67 billion) in 2023. Fewer incidents, bigger losses. The Nigeria Inter-Bank Settlement System (NIBSS), which processes payments between the country's banks and tracks fraud, put it plainly: criminals are becoming more precise, and insiders are partly to blame.
"Insider involvement is high, and recent investigations have confirmed this," said Premier Oiwoh, the NIBSS managing director and chief executive, earlier this year. He named SIM-swap fraud (where a criminal convinces a mobile network to transfer your phone number to their SIM card, letting them intercept your verification codes), phishing (fake messages designed to trick people into handing over passwords), and account takeover as the schemes doing the most damage.
How are criminals getting into Nigerian accounts?
They are mostly stealing credentials rather than forcing their way into systems. Hendrik de Bruin, Check Point Software's head of security consulting in Africa, put it this way: "Attackers aren't smashing windows; they're quietly collecting keys to unlock the front door with." Those keys reach customer accounts, payment systems and, eventually, wire transfers.
Nigeria's scale makes it worth targeting. With a GDP of around US $377 billion it is West Africa's largest economy. Rapid growth in mobile payments and digital banking draws criminals toward wherever money moves fastest.
Check Point tracks at least 50 active criminal groups operating in Nigeria. Attack volumes have stayed stubbornly high throughout the past year, placing the country second only to Angola for attack intensity across Africa.
Smaller businesses are especially exposed. Anna Collard, a security adviser for KnowBe4, a firm that helps organisations train staff to recognise scams, noted that small businesses are hit at more than double the rate of larger companies, largely because they have fewer trained staff and thinner security budgets.
Should you worry about the gap between the law and its enforcement?
The 2023 Data Protection Act already mandates that organisations report breaches to the NDPC within 72 hours. The problem, Collard says, is not the law. It is the regulator's capacity to apply it consistently and a weak compliance culture among businesses. Because enforcement has been patchy, many incidents have reached the public through researchers or the media rather than through official channels.
Our first report on NIBSS, published 15 July 2026, flagged the same reporting gap that regulators are still working to close.
The government's planned cybersecurity framework, expected later in 2026, aims to set minimum security spending levels, mandatory reporting timelines and closer cooperation between government and industry. Whether it moves from policy document to real-world practice will determine whether the losses curve finally bends downward.
What ordinary Nigerians and their employers should do now
Set up login alerts on any mobile or internet banking account so you know immediately when it is accessed. If you receive an unexpected call asking you to confirm SIM or account details, end the call and contact your bank directly on a number from their official website. Businesses should require staff to complete regular fraud-awareness training: deceived or compromised employees remain the most common entry point.
