Cybercrime

For individuals, the most common encounters are fraud and impersonation.

A cloned social media account soliciting money from friends. A phishing message imitating a bank. Unauthorised transfers from an account. A business email compromise, where an invoice is intercepted and account details changed. Sextortion and blackmail using intimate images.

Reporting routes exist. The Economic and Financial Crimes Commission handles financial cybercrime, the Nigeria Police Force has cybercrime units, and banks have their own fraud desks that must be contacted immediately when money has moved, because speed determines whether funds can be recalled.

For businesses, the Act creates obligations rather than only protections. Financial institutions carry duties around verifying customers and reporting. Service providers have duties around retaining traffic data and assisting law enforcement on lawful request. Businesses handling payment card data have specific obligations.

Evidence matters enormously and degrades quickly. Screenshots with visible timestamps, transaction references, headers of suspicious emails, and the account details used should be preserved immediately.

Section 24, the cyberstalking provision, is the part of the Act that generated the most controversy.

As originally drafted it was broad enough to capture messages that were merely offensive or annoying, and it was used against journalists, critics and people posting complaints online. Courts and civil society challenged it, and the 2024 amendment narrowed its scope. Anyone facing a complaint under it should take advice on the current wording rather than the version they may have read about.

The other Nigerian reality is business email compromise, which has become the most damaging category for companies. An email account is accessed, an invoice is intercepted, bank details are altered, and payment goes to the fraudster. The protections are procedural rather than legal: verify any change of bank details by telephone using a number you already hold, require dual authorisation on payments above a threshold, and enable multi factor authentication on email.

Data protection sits alongside all of this. A cyber incident involving personal data is also a personal data breach under the Nigeria Data Protection Act, which requires notification to the Commission within seventy two hours. Businesses frequently handle the security incident and forget the regulatory obligation.

One incident often produces three separate processes, and businesses tend to run only one.

A cybercrime is prosecuted by the state. You report it to the EFCC or the police, and the outcome is punishment of the offender rather than compensation to you.

A personal data breach is a regulatory matter. Where personal data was compromised, the Nigeria Data Protection Act requires notification to the Commission within seventy two hours and, where the risk is high, to the individuals affected. That obligation exists whether or not anybody is prosecuted.

A civil claim is yours to bring. Against the fraudster if identifiable and worth suing, or against a party whose negligence enabled the loss, such as a service provider that failed to apply agreed controls.

After an incident, handle all three: report it, notify if personal data was involved, and take advice on recovery.

Recovery is the hardest part. Money moved through several accounts and withdrawn quickly is very difficult to trace, and speed of reporting to the bank is usually the only thing that matters.

Cross border offences complicate matters further. Where the offender is outside Nigeria, prosecution depends on cooperation that may not be forthcoming.

Enforcement capacity is finite relative to the volume of reports, so individual cases involving modest sums may receive limited attention.

And the law does not prevent anything. The practical protections for a business are operational: multi factor authentication, verified payment procedures, staff awareness, and controls on who can change bank details.