In early October, a wave of cyberattacks, leading to fraud losses, hit several Nigerian banks and financial institutions, potentially costing billions of naira in customer funds, according to several sources with direct knowledge of the matter.
The attacks, the sources noted, affected institutions that rely on external technology providers to run critical financial services, including core banking infrastructure. In one incident, a vendor providing core banking services to financial institutions was reportedly compromised at the system level on October 1. The vendor is one of Africa’s biggest fintech companies.
TechCabal could not immediately establish how many attacks happened, how much money was lost, or whether the incidents were connected. But according to their respective financial reports, three of the country’s biggest banks, Access Holdings Plc, Guaranty Trust Holding Company Plc (GTCO), and Zenith Bank collectively reported ₦2.74 billion ($2.03 million) in fraud losses for the first six months of 2026. GTCO recorded the sharpest year-on-year increase, with fraud losses up by 450.24%.
The Concentration of Bank Fraud
Three top-tier banks absorbed ₦2.74 billion in fraud losses in just six months, driven by an unprecedented surge at GTCO.
Source: NIBSS (2025) & H1 2026 Financial Reports
TechCabal Data
The Financial Institutions Training Centre (FITC) reported 19,719 fraud cases in the fourth quarter of 2025, a 34.2% increase from the previous quarter.
The attacks reflect the growing scale of security risks facing Nigeria’s financial services industry, where rising cyber threats and fraud incidents expose weaknesses in how institutions protect customer funds and critical infrastructure. In Q4, 2025, reported fraud loss surged by 575.7% to ₦5.26 billion ($3.89 million), according to FITC.
These risks are amplified by the industry’s reliance on shared technology providers to process transactions, manage customer accounts and provide lending infrastructure. A breach at one provider could expose multiple financial institutions connected to its systems.
“The Bank maintains ongoing supervisory oversight of cybersecurity incidents affecting regulated financial institutions,” a Central Bank of Nigeria spokesperson told TechCabal in an emailed response on Tuesday. “The Nigerian financial system remains resilient, and the Bank’s supervisory and cybersecurity frameworks remain in force.”
A top executive at one of the country’s payment gateways, who asked not to be named to discuss sensitive matters, described October as “Black October,” saying the attacks affected businesses across the financial services industry. Another source at an investment bank told TechCabal that staff were warned not to open external emails amid heightened cyber threats during the month.
“It eventually ends up at your door,” the payments gateway executive said.
A major microfinance bank was also among the affected institutions, according to a source familiar with the incident. The bank reportedly suffered financial losses and a system disruption that forced it to seek temporary alternatives to keep its services running. It has since hired a chief security officer, the source added.
Nigeria Inter-Bank Settlement System (NIBSS), the country’s payments switch, did not respond to a request for comments.
“Everyone has been attacked. People have lost money,” Adedeji Olowe, founder and chief executive officer of Lendsqr, a Nigerian lending technology company, told TechCabal.
In a LinkedIn post on November 4, Olowe said security testing of Lendsqr’s platform uncovered about 800 vulnerabilities and that they “spent three weeks fixing them.” He did not disclose the vulnerabilities’ severity, how many were fixed, or whether any were exploited.
Nigerian banks’ growing fraud losses
The reported attacks come against a backdrop of persistent fraud losses across Nigeria’s financial system.
Financial institutions recorded ₦25.85 billion ($19.16 million) in actual fraud losses in 2025, according to data from the Nigeria Inter-Bank Settlement System (NIBSS). This reflects a 50.55% decline from 2024, but in 2024, 60.53% of attempted frauds eventually became losses. That number jumped to 68.81% in 2025.
The Central Bank of Nigeria (CBN) has also warned about rising fraud and money-laundering risks as more financial services move online.
“The payments ecosystem faces rising SIM swap incidents, account takeover fraud, insider collusion, and social engineering,” the CBN said in its Nigeria Payments System Vision 2028.
The apex bank has introduced measures to strengthen fraud prevention and make financial institutions more accountable. In its 2024 Risk-Based Cybersecurity Framework, the CBN asked banks and payment service banks to assess the security of third-party providers through due diligence, routine audits, and ongoing monitoring.
In March 2026, it formally recognised artificial intelligence as a tool for fighting financial crime. But the effectiveness of those measures depends partly on whether institutions report incidents promptly and share information that could help others identify similar threats.
Gaps in industry reporting
Despite the scale of fraud in Nigeria’s financial system, financial institutions have historically been reluctant to publicly disclose security breaches and fraud incidents. For an industry built on interconnected payment rails and shared technology providers, silence can become a security risk in itself.
NIBSS’s 2023 Annual Fraud Landscape found that only 60 of the 163 financial institutions it profiled reported fraud incidents that year, a 37% compliance rate. The remaining 103 institutions did not report cases. NIBSS said failure to report fraud incidents violated the CBN’s circular establishing industry fraud desks.
The CBN’s 2024 cybersecurity framework requires supervised financial institutions to report detected cyber incidents to the regulator within 24 hours. It also requires them to submit intelligence on cyber threats through a designated reporting channel by the fifth day of the following month. These requirements are intended to give the regulator visibility into emerging threats and help institutions respond to incidents across the financial system.
The reporting gap highlights a weakness in how Nigeria’s financial system coordinates its response to fraud and its missed opportunity to identify and contain attacks before they spread.
The CBN’s Payment System Vision 2028 proposes the establishment of a national Security Operations Centre (SOC) and a fraud intelligence-sharing platform. The initiative is part of a broader ambition to reduce fraud losses by 70% by 2028.
In January, the CBN directed NIBSS to debit the settlement accounts of commercial banks that receive fraud proceeds, making financial institutions tighten their fraud detection measures. The new rule was part of the regulator’s efforts to hold banks and fintechs accountable for lapses in their transaction monitoring systems.
In December 2024, TechCabal reported that First Bank, Nigeria’s oldest bank, suffered a massive fraud incident that led to the theft of ₦7 billion ($5.19 million) from customer accounts. The incident came several months after an employee fraudulently diverted ₦60 billion ($44.47 million) over two years, undetected, resulting in the dismissal of over 100 employees and reportedly connected to the bank’s CEO’s abrupt exit eight months before the end of his tenure.