 |
| SIM-swap Fraud image create with ChatGPT |
On May 25, 2026, a project manager living abroad logged into her Access Bank app to make a transfer and found roughly ₦100,000 already gone. Her MTN line inactive while she was overseas had quietly been reassigned to someone else. That new SIM holder didn't need her password.
They just needed her phone number, because in Nigeria's digital banking system, a phone number is your identity.
She isn't an isolated case. In Nigeria, where phone numbers unlock bank accounts, wallets, and personal apps, a simple SIM swap can hand a stranger everything. Here's exactly how the fraud works, why 2026 is a turning point in how it's being fought, and most importantly what actually protects you.
How SIM-Swap Fraud Actually Works
There are two distinct ways fraudsters take over a Nigerian phone number, and the difference matters.
1. The active takeover. A fraudster impersonates you at a Mobile Network Operator's retail outlet, sometimes with a fake ID or occasionally the help of a bribed or careless staff member, and gets your number transferred onto a SIM card they control.
As one cybersecurity expert put it plainly: once they've captured enough of your personal information often scraped from social media, where full names, dates of birth, and even partial account details sit publicly visible the swap itself takes minutes.
2. Silent number recycling. This one catches people off guard, especially Nigerians abroad. Under NCC rules, a SIM is considered inactive after 180 days with no calls, SMS, or data usage, and can be reassigned to a new subscriber after 365 days of dormancy (operators are required to send a warning 14 days before the line is cut). If that old number was ever linked to your bank account or used for password resets, whoever receives it next inherits a door into your financial life without ever "attacking" anyone.
Once a fraudster controls the number, the process is fast and mechanical: they receive your one-time passwords (OTPs), reset your banking app password, and in many documented cases, use the hijacked line to apply for instant micro-loans leaving victims fielding debt-collector calls for loans they never took.
The Numbers Behind the Crisis
- ₦25.85 billion - total digital payment fraud losses recorded by the Nigeria Inter-Bank Settlement System (NIBSS) in 2025, across 67,518 incidents. That's actually a 51% drop from the year before, driven largely by BVN–NIN integration but regulators have flagged a 34% fall in institutional fraud reporting in late 2025 that may be masking the true scale rather than reflecting a real improvement.
- 25.3 million mobile phone thefts recorded in Nigeria in a single year by the National Bureau of Statistics, making it the country's single most common crime. Every stolen phone is a potential SIM-swap entry point.
- SIM swap, phishing, and insider collusion at telecom outlets remain, in regulators' own words, the dominant threat vectors in Nigerian digital fraud, even as aggregate numbers improve.
What Nigeria Is Doing About It in 2026
This is genuinely one of the more active regulatory fronts in Nigerian fintech right now, with two major developments this year:
TIRMS - the Telecom Identity Risk Management System. On April 20, 2026, the Central Bank of Nigeria and the Nigerian Communications Commission signed a memorandum of understanding creating TIRMS, a shared platform letting banks and fintechs check, in real time, whether a phone number tied to a transaction has recently been swapped, reassigned, flagged for suspicious activity, or gone inactive.
In effect, it's designed to close the exact window fraudsters have exploited between a successful swap and a bank noticing something is wrong. As of mid-2026, a full technical rollout and live go-date are still pending the joint CBN–NCC committee has set itself a target of publishing implementation details before Q3 2026.
Mandatory device binding. A CBN directive taking effect July 1, 2026 requires financial institutions to bind customer accounts to specific registered devices, rather than treating a working phone number and OTP as sufficient proof of identity. This directly targets the exact scenario where a hijacked SIM, dropped into any device, was previously enough to authorize a transaction.
Both are meaningful steps but neither is a substitute for what you do on your own end today.
How to Actually Protect Yourself
1. Set a SIM PIN - and change the default. This is the single most concrete, immediate action you can take. A SIM PIN stops your SIM card from working if it's removed and placed in another device. Change it from the factory default (typically 0000 for MTN, Glo, and 9mobile, or 1111 for Airtel) through your phone's security settings.
2. Move off SMS-based two-factor authentication where you can. SMS OTPs are exactly what a swapped SIM intercepts. For banking, email, and any account that supports it, switch to a standalone authenticator app (like Google Authenticator) instead of SMS codes.
3. Don't let a Nigerian line go dormant if it's tied to your bank account especially if you're abroad. If you know you'll be away for an extended period, "park" the line through your carrier (Nigerian operators offer this, typically at low cost) rather than letting it lapse toward the 180-day inactivity threshold.
4. Tighten what's visible on your social media. Full name, date of birth, phone number, and address, sitting openly on a public profile, are the exact raw materials fraudsters piece together to impersonate you at a telecom outlet or to a bank's call center.
5. Treat a sudden loss of signal as a red flag, not an inconvenience. If your phone suddenly stops receiving calls or texts with no clear cause, don't assume it's a network issue check your bank app immediately and contact your bank and telecom provider without delay.
6. Watch for unauthorized USSD activity. Several documented Nigerian cases involved fraudulent withdrawals executed through USSD codes (like *901#) rather than the banking app itself a channel people often forget to monitor.
If It Happens to You
Speed is everything, since the entire attack window is often measured in minutes:
- Contact your bank immediately to freeze the account or block transactions don't wait to "confirm" first.
- Contact your telecom provider to report the unauthorized SIM swap and request your number be restored or secured.
- File a report with the Nigeria Police Force's National Cybercrime Centre (NPF-NCCC) e-reporting portal. https://nccc.npf.gov.ng/
- Change passwords on every account that used the compromised number for verification or recovery, once you've regained control.
Frequently Asked Questions
What is SIM-swap fraud? It's when a fraudster gains control of your phone number either by impersonating you at a telecom outlet or through a recycled, previously dormant number, and uses it to intercept OTPs and take over your bank accounts, wallets, and other linked services.
How do I set a SIM PIN in Nigeria?
Go to your phone's security settings, find the SIM card lock option, and change the PIN from the network default (0000 for MTN/Glo/9mobile, 1111 for Airtel) to a PIN only you know.
Is TIRMS live yet? As of mid-2026, TIRMS has been formally agreed between the CBN and NCC, but full technical rollout across all banks and telecom operators is still in progress, with implementation details expected before Q3 2026.
Why does my dormant Nigerian SIM put my bank account at risk? Under NCC rules, a SIM can be deactivated after 180 days of inactivity and reassigned to a new subscriber after 365 days. If that number was ever linked to your bank account, whoever receives it next may be able to trigger password resets or intercept OTPs tied to your accounts.
What should I do first if I suspect a SIM swap? Contact your bank immediately to freeze your account, then contact your telecom provider to secure your line in that order, since financial exposure is the more time-sensitive risk.
Sources: Central Bank of Nigeria (cbn.gov.ng), Nigerian Communications Commission (ncc.gov.ng), Nigeria Inter-Bank Settlement System (NIBSS), National Bureau of Statistics.
Related reading:
Presidency Wants Verydarkman Prosecuted Over Fake Tinubu Audio
NPF-NCCC Reaffirms Commitment To Digital Policing
NDPC Warns Of Coordinated Cyber Threats Targeting Nigeria's Financial Systems
More on Cyber Watch