Fraudsters target 63.7m banks accounts, e-payment channels

Fraudsters have continued to get unauthorised access to bank accounts and other electronic payments platforms .

Statistics from the Nigeria Inter Bank Settlement Scheme (NIBSS) indicate there are 93 million bank accounts in the country with 63.7 million of them being active. As at September 2016, operators of current accounts in the country stood at 25.4 million, with savings account having 65.4 million holders while there were 2.48 million other accounts users in the country.

The Guardian learnt that the introduction of the Bank Verification Number (BVN) by the Central Bank of Nigeria (CBN) in collaboration with the banks in 2015 showed that there are about 28 million unique identity accounts in the country.

With cybercriminals on the prowl, The Guardian checks showed that customers of some top commercial banks in the country are currently being bombarded with suspicious phishing mails targeted at their daily Internet banking transactions.

It was learnt through a cyber security expert, who preferred anonymity, that some of these attackers (fraudsters) are based in the United States, United Kingdom, UAE, Russia and South Africa among others, trying to break into accounts in Nigeria because of the open Internet gateway.

A 2014 NIBSS report showed that there were 1, 461 cases of fraud in 2013 involving N7.7 billion-attempted value, but that about N6.2 billion was actually lost to e-fraud.

The fraud is projected to come through several scam mails, technically called phishing, which are being received on a daily basis by customers of some of the banks. Phishing emails try to trick the user into revealing some personal information. The emails look like they are from a legitimate source, such as a bank, Google or Yahoo, but they’re not. They attempt to lure unsuspecting bank customers by asking them to open a link to either update their online banking profile or change their Personal Identification Numbers (PINs).

The President of Cyber Security Experts Association of Nigeria (CSEAN), Remi Afon, who revealed that 89 per cent of breaches had a financial or espionage motive, noted that phishing accounted for 83 per cent of cybercrimes. According to him, it usually takes 146 days before a successful breach is detected, while 84 per cent of breaches are against the application layer.

Some of the phishing emails, compiled by The Guardian, which were purportedly sent by a bank, through an online medium reads: “Dear customer, we got a request to reset your password and if you did not make this request, kindly follow the below link (provided in the email) to cancel the password request on your online account.” Also, the customers receiving the scam emails are told: “If you made this request, kindly follow the below link to proceed with the password request on your online account.”

Another email purportedly sent by the bank reads: “Dear customer, this is a confirmation that the password for your online account has just been changed. If you didn’t request or make this password change, kindly follow the secured link https://ibank…bankplc.com/RetailBank/ for security purpose.

“If you made this password change kindly follow this link to review your account information https://ibank…bankplc.com/RetailBank/.”

In an email from another bank’s online platform, customers were told that a beneficiary had been added to their online account and that they should click a link if they had not authorised such a beneficiary.

The scammers will thus provide a Universal Resource Locator (URL) link, which the unsuspecting customers are implored to click to go and ‘de-activate the beneficiary.’

A similar phishing email will ask bank customers to update their online banking profiles. Another scam message sent to a customer via a mobile phone, reads: “Dear customer, due to system upgrade and BVN link your ATM card has been deactivated. To activate, call customer care line on 0810…”

A senior official of a bank, who preferred anonymity, told The Guardian that the bank was not the one sending such emails, but online scammers, with the intent to defraud their unsuspecting targets.

She said the bank, like the other ones, would not advise the customers to change their PIN online or reveal some vital information in the cloud.

The Google West Africa’s Communications and Public Affairs Manager, Taiwo Kola-Ogunlade, in an interview with The Guardian, said phishing emails tried to trick people into revealing personal information.

Ogunlade said through phishing, the type of information targeted from customers include the demographics and those that are personally identifiable (those that can be used to identify, contact, or locate a person or can be used with other sources to uniquely identify a single individual, including name, address, phone number, social security, birthday, birthplace, credit card information, account numbers).Others relate to behaviour (purchasing habits, websites visited, credit card transactions).