Because of the rapid adoption of financial technology (FinTech), the Nigerian financial system is undergoing transformation. While FinTech has brought many benefits, it has also introduced new security risks. Cyberattacks on the Nigerian financial system have increased in recent years, with FinTech companies and traditional banks bearing the brunt of these nefarious operations.
Read also: Pipeline security must be tech-savvy to thwart cyberattacks, vandalism – Oilserv GCEO
The Alarming Rise of Fraudulent Activities:
Financial losses in Nigeria’s banking sector have been enormous as a result of fraudulent operations. The value of fraud in 2021 was put at N193.5 billion ($544 million), a significant increase from the N153.4 billion ($431 million) lost in 2020. This upward trend continued in 2022 when losses due to fraud topped N273 billion ($762 million). Even these troubling figures are expected to be exceeded by the end of 2023, with projections estimating potential losses of more than N300 billion ($833 million).
Mobile Money SIM Swap Fraud:
SIM switch fraud, a method used to hijack mobile money accounts, cost telecommunications consumers more than N20 billion ($55 million), according to a 2022 report by the Nigerian Communications Commission (NCC). This troubling trend highlights the vulnerability of mobile money platforms to unauthorized access, as well as the need for stronger security measures to protect consumer payments.
Phishing Attacks Targeting Bank Customers:
In Nigeria, phishing attacks, in which cybercriminals pose as legitimate institutions in order to trick unsuspecting individuals into disclosing sensitive information, have become more common. Nigerian banks were among the top targets for phishing attacks worldwide, according to a report published in 2023 by cybersecurity firm Check Point Research, with over 1.3 million phishing attempts detected in the first half of the year alone. This alarming data emphasizes the need for increased public awareness campaigns to educate customers about phishing scams and protect them from falling victim to these fraudulent schemes.
Data Breaches at FinTech Companies:
Unauthorized individuals gaining access to sensitive customer information through data breaches have also posed a significant threat to Nigeria’s FinTech industry. A major data breach at a leading Nigerian FinTech company in 2021 compromised the personal and financial information of over 10 million customers. This incident highlighted the critical importance of strong data protection practices and stringent regulatory oversight in order to protect customer privacy and prevent unauthorized access to sensitive information.
The Use of Social Engineering Tactics:
Cybercriminals are increasingly using social engineering techniques, such as impersonating bank officials or creating bogus websites, to trick unsuspecting people into disclosing sensitive information or engaging in unauthorized transactions. These strategies are especially effective in Nigeria, where cybercriminals take advantage of cultural norms and trust in authority figures to gain access to customer data and financial accounts.
Read also: Nigeria is Africa third most vulnerable country to cyber attacks
The Nigerian Financial System’s Vulnerability:
The Nigerian financial system is particularly vulnerable to cyberattacks due to a number of factors, including:
Limited cybersecurity awareness: Many FinTech firms and banks lack the cybersecurity awareness and expertise required to effectively protect their systems and customer data.
Outdated IT infrastructure: Many Nigerian financial institutions rely on outdated IT infrastructure, which is more vulnerable to cyberattacks.
Inadequate data protection practices: Inadequate data protection practices, as well as a lack of data encryption, expose customer information to unauthorized access.
Data Governance and Privacy Protection Are Critical:
Data is the lifeblood of the FinTech industry, and customer data collection, storage, and use must be handled with extreme caution. Data breaches can be disastrous for FinTech companies, resulting in financial losses, reputational damage, and a loss of customer trust.
Data Governance Frameworks: Fintech firms must develop strong data governance frameworks that define clear data management policies and procedures. Data classification, access controls, data retention policies, and incident response procedures should all be addressed in these frameworks.
Privacy Compliance: FinTech firms must follow all applicable data privacy regulations, including the General Data Protection Regulation (GDPR) and the Nigerian Data Protection Regulation (NDPR). These regulations require FinTech firms to obtain explicit consent for data collection.
The Changing Threat Landscape: Adapting to Cybercriminals’ Ever-Changing Tactics:
Cybercriminals are constantly developing new and sophisticated tactics to exploit vulnerabilities and gain access to sensitive information, so the cybersecurity landscape is constantly changing. Because of the vast amount of personal and financial data held by digital financial services in Nigeria, the FinTech industry is particularly vulnerable to these evolving threats.
Read also: EFCC wants tertiary institutions to tackle internet fraud
Threats that are Emerging: With the rise of artificial intelligence (AI) and machine learning (ML), cybercriminals are able to automate their attacks and create more targeted and personalized phishing campaigns. Also, the growing use of mobile devices and the expanding Internet of Things (IoT) are spawning new attack vectors that FinTech firms must be aware of.
Adapting to Change: FinTech firms must take a proactive approach to cybersecurity, constantly monitoring for new threats and adapting their security measures as needed. Staying current on the latest cybersecurity trends, conducting regular security assessments, and employing a team of skilled cybersecurity professionals are all part of this.
The Need for a Security Culture:
Cybersecurity is a cultural issue as well as a technical one. Financial institutions in Nigeria must foster a security culture that emphasizes the importance of safeguarding sensitive information and preventing cyberattacks. This necessitates buy-ins from all levels of the organization, from the CEO to the frontline workers.
Security Awareness Training: All employees should receive regular security awareness training on topics such as cyber threats, phishing scams, social engineering tactics, and best practices for protecting their accounts and devices.
Security Champions: Appointing security champions within teams and departments can help promote a culture of security awareness and encourage employees to report suspicious activity as soon as possible.
Executive Leadership: Senior management must demonstrate their commitment to cybersecurity by allocating adequate resources and clearly supporting security initiatives.
Inadequate Cybersecurity Infrastructure:
Many Nigerian FinTech firms operate with limited cybersecurity infrastructure, making them more vulnerable to cyberattacks. According to a 2022 report by cybersecurity firm Kaspersky Lab, over 40% of Nigerian FinTech companies lacked adequate cybersecurity measures, leaving them vulnerable to malware, ransomware, and other types of cyberattacks. This highlights the importance of FinTech companies investing in robust cybersecurity measures and implementing industry-standard practices to protect their systems and customer data.
Read also: FITC, IT experts advocate AI adoption against cyberthreats
The Regulatory Gap: A Breeding Ground for Cybercrime
The alarming rise in fraud in Nigeria can be attributed in part to the lack of a comprehensive and robust regulatory framework for FinTechs. While the Central Bank of Nigeria (CBN) has made strides in regulating the sector, cybercriminals continue to exploit significant gaps. Many FinTech companies are vulnerable to attacks due to a lack of clear guidelines on data protection, identity verification, and cybersecurity measures.
The Regulatory Landscape: A Path to Safer Shores
A more comprehensive and stringent regulatory framework is required to effectively address the security challenges faced by FinTechs and traditional banks. This framework should include the following key elements:
Data Protection: Establish clear guidelines on data collection, storage, and usage to safeguard customer information.
The Impact of Technology on Cybersecurity: By automating tasks, providing real-time monitoring, and enabling advanced threat detection capabilities, technology can play a critical role in enhancing cybersecurity. Nigerian financial institutions should use technology to supplement their security measures and stay ahead of evolving cyber threats.
Automated tools for security can be used to automate routine tasks such as identity verification, fraud detection, and incident response. This allows security professionals to focus on more strategic initiatives while also lowering the risk of human error.
Continuous monitoring solutions can provide visibility into network activity, user behaviour, and potential threats in real time. This enables security teams to quickly identify and address problems, preventing them from escalating into major breaches.
Identity Verification: Implement robust identity verification procedures to prevent fraudulent account creation and transactions.
Cybersecurity Measures: Mandate regular security audits and penetration testing to identify and address vulnerabilities promptly.
Consumer Awareness: Educate consumers on cyber threats and best practices to protect their financial information.
Read also: FBI arrests and extradites wanted Nigerian cybercriminal to America
Nigeria can create a safer and more secure environment for both FinTech companies and traditional banks to operate in, fostering innovation and financial inclusion without jeopardizing the security of its citizens’ financial assets by implementing these measures.
