Help me, help me; they have taken all the money in my account! I didn’t make any withdrawal, I didn’t do any transaction, yet they kept debiting my account!’
Those were the words of Wini Akpan, a petty trader in her mid-50s.
Speaking with The Nation on a Monday morning, Wini said that although it had been two years since she lost her salary and proceeds of her petty trade to Internet fraudsters, memories of the incident remain fresh in her mind.
According to her, the unfortunate incident, which occurred on Saturday, May 26, 2023, will forever remain a dark day in her life. ‘They had just paid my salary on a Friday, and I felt like I could withdraw some amount because I had nothing on me, so that I would be able to go to church.’
That singular decision became her undoing, as it later led to a chain of reactions. She thanked her stars that there was no crowd at the bank where the ATM was located, and she would not have to stay for long to make her transaction. ‘It was in the process of withdrawing money that I discovered that the ATM had run out of cash.
‘I then decided to do a transfer. But before I knew it, the machine had swallowed my card.’
She expected the machine to return her card, but how wrong she was. A security personnel at the bank told her that it would not be possible because he had no authority to retrieve cards swallowed by the ATM.
‘I told him, sir, I don’t have one naira, and I want to go to church tomorrow. He told me to come back the following day to see whether they would be able to retrieve my card while loading cash into the machine,’ she said.
Less than 10 minutes after she left the bank, she started receiving some strange debit alerts on her phone. Out of panic, Wini ran back to the bank, but the security guard told her that he didn’t know anything about the incident.
‘That was how trouble began. Up until today, I have not been able to get my money from the bank, ‘ Wini said.
Rather than address her predicament, the banks made matters worse by accusing Wini of negligence.
Those she sought help from said she should have reported the incident to the bank and police station first.
‘How could I have gone to the bank? It was a Saturday,’ she told The Nation.
While many may regard the sum she lost as paltry, for a petty trader like Wini, N71,000 is huge.
Futile effort
After making a series of unsuccessful attempts to retrieve her money from the bank, she accepted her fate.
According to her, part of the money was withdrawn from the GTB ATM in Idi-Oro, Mushin, Lagos, while the balance was transferred to a POS machine.
She also approached the WEMA Bank branch whose ATM swallowed her card, but rather than get any assurance, they told her to go and bring the card number.
‘I asked the WEMA Bank woman how do I get the card number of a card that has been swallowed by your machine?’
Wini also sought the assistance of Sterling Bank, which was her bank. They managed to give her the card number to present to WEMA Bank. She did without something concrete coming out of this.
But out of fear and previous experiences, she is not ready to keep her money in any bank at the moment.
‘I am afraid of keeping my money in the bank now. Maybe I will dig a pit in my house and keep my money in it. Anytime I want to use it, I will go and remove it..
‘If you make a withdrawal, they will deduct money. If you make a deposit, they will deduct. Whatever you do in the bank, you lose money.
‘If you put your money in a bank now, within the next two months, the money will have reduced. So I am afraid of putting money in the bank.
‘I am going to return to the primitive system of keeping money,’ Wini said.
To those who have not lost their money to the fraudsters, Moses Anosike’s story would sound incredible. Moses, a journalist with one of the leading newspapers in Nigeria, held this view until he lost over N1,000,000 to the cyber fraud criminals.
Several attempts to get a reprieve had been unsuccessful, as he is currently being tossed here and there.
Unlike the case of Wini, those who took the money from his account were those he thought were trying to help him.
When our correspondent called him on the phone last week, he was at a police station to lodge a formal complaint about the incident. He had made several attempts to get a court order, without any success.
‘I went to the bank on Saturday, 15th August. The bank’s security personnel were not present. It was at the UBA that I wanted to make a transaction. The machine was unable to dispense. I tried another ATM, but it refused to respond. I pressed cancel, but neither the money nor the card came out.’
Moses decided to exercise little patience, hoping that the card would come out. It was then that he noticed two young men lurking, thinking they were bank officials since no security men were around.
In a friendly manner, one of the young men approached Moses, explaining to him that it could be a network problem.
‘He followed me to the ATM, and said I could put my pin, and send, already, my card was in the ATM, I did as instructed. Yet, neither the money nor the card came out. Within a space of three minutes, I started receiving debt alerts, before I knew it, a million naira plus was removed from my account through a POS account.
‘After this happened, a security man surfaced from the back of the bank. I said ‘look at what has just happened to me; my card is still in the machine. His response was ‘ man wey come here wey dey do press press don deceive you collect your card. I asked him how that was possible?’
Ever since the incident happened, he had been making frantic efforts to get his money returned to him.
At the time of writing this report, he had contacted both the UBA and the MoniePoint where the account was transferred to all to no avail.
Moses is angry and frustrated. He is still in shock that even though the UBA knows where the money was moved to, they have refused to do something about it.
At one point, UBA was in constant contact with him, but subsequently, they would find one excuse or the other to postpone the resolution of the problem.
Moses is confused. ‘ With the advent of the National Identification Card, BVN, no money is lost in banks these days. The man at the UBA headquarters said the fraudster transferred the money to a POS account. I asked for details of that account, but he refused to disclose it. ‘
Moses’ contact rather asked him to meet the manager of the UBA branch where the transaction took place; he did, but ever since, it has been moving back and forth without anything concrete coming out of the efforts.
Moses contacted Moniepoint, where he was assured that the person who stole his money would be traced. ‘With the technology in banks today, it is difficult for money to get lost. Even if they share the money in four or five places, the technology will still detect it.’
When Moses contacted UBA again, the bank told him that they had sent three letters to Moniepoint, thinking that it was Moniepoint that was delaying the resolution of the matter, he went back, and what he got was a pushback. ‘Moniepoint told me that every document that the UBA needed on this fraud had been sent to them, and that the UBA was in a position to track this money.’
Up till the time of writing this report, Moses is still making efforts to retrieve his money.
‘Bank is pestering me to pay debt’
Another customer, Mide Otitoju, whose account was also hacked by some fraudsters, relived his unpalatable experience with his bank, which insisted he must pay a certain sum standing against his name as debt for using his ATM card for an online transaction.
He said: ‘The bank is still pestering me to pay the debit accruing from using my ATM card to buy some goods online.
‘I have told them several times that I did not use my card to transact any business online or buy any product, but they insisted that I did.
‘I am sick and tired of this,’ said Otitoju.
He said it was constant pestering from the bank that led him to abandon the account, even when the bank was aware that he had lost money via hacking.
According to him, trouble began when his phone was stolen during a service in a Lagos church.
‘Before I could block my line, all the money in my account had been cleared. Aside from clearing the account, they also used it to buy some goods online and borrow money..
‘Why would they tell me to pay the money I did not borrow?’ Otitoju wondered.
While many Nigerians are worried that the incidence of hacking ATM cards has continued to surge, findings revealed that ATM users grew from 11,000 in 2011 to 16,000 around 2016 and 21,000 in 2019. It grew to 22,600 in 2021, where it has remained as of December 2023, an indication that investment in the ATM market has stalled.
Account hacking surges
But hacking into bank customers’ accounts by different means remains on the rise, with fraudsters becoming more daring and sophisticated.
Most of the victims who spoke to our correspondent believe that most security personnel around ATMs in banks are culpable, as they allegedly work hand-in-hand with the fraudsters.
That much was corroborated by Bus’la Odugbesan, who lost N180,000 via FCMB ATM and the UBA bank’s debit card. She believes that the security personnel at the ATM centre worked in cahoots with some criminals who pose as if they are assisting customers who have difficulty operating the machines.
Still emotionally frozen, Odugbesan, another bank customer, narrated her ugly experience, saying: ‘I went to the ATM to do some transactions, but I didn’t understand some things about the machine. So I sought the assistance of the securityman at the bank.
‘He advised me to use *184*. Meanwhile, someone was still using the machine while the conversation was ongoing.’
To her surprise, the machine kept rejecting her card as she tried to insert it. One of the bank customers who had earlier used the machine insisted that the machine was working and offered to help Odugbesan; a decision that became her greatest undoing.
‘The transaction could not be completed, so I removed the card and tried another machine without success.’
Another person who was probably working with the fraudster again offered to help. Unknown to her, the said customer had manipulated the process. It was later that Odugbesan got to know that her card was either cloned or compromised.
‘After trying to do a transfer, and it kept declining, I cancelled the transaction. In the effort to cancel the transaction, the machine swallowed my card.’
Like many others whose cards were swallowed, attempts by Odugbesan to retrieve her card were abortive as the security at the bank told her that she could only get the card at the bank where her account was domiciled.
It was double jeopardy for Odugbesan as the bank debit card that was with her belonged to her colleague. ‘My colleague just called me and said he had started receiving debit alerts, and that was even before I left the bank’s premises.
‘When we reported the case at the bank, we were told that the person who pretended to be assisting me could have either swapped or cloned the card,’ Odugbesan said.
While the bank revealed the identity of the perpetrator to Odugbesan, it refused to print out the details and image of the fraudster. The bank explained that they were constrained to release the information of the fraudster because it was not from their ATM that the fraudster withdrew the money.
Right now, Odugbesan is afraid to use an ATM or bank debit card. ‘I can’t go to any ATM to collect money; I can only do a transfer.
‘I still don’t know what went wrong after cancelling the transaction; I don’t know how those people were able to access my account.
‘Personally, I believe those banks’ ATMs are not safe. Banks’ debit cards are not safe. I think I will prefer using a transfer to going to the ATM.’
‘The securityman at the bank cannot tell me he was not aware of what happened.’
While reporting the matter at the police station, Odugbesan was made to understand that what happened to her was a common occurrence.
Before her death recently, Mrs Rebeca Olowo was a victim of ATM fraud. Her son, Yinka, still remembers vividly how his mother lost her money to the fraudsters.
According to him, the incident occurred two years ago, and he still keeps all the documents retrieved from the bank while investigating the fraud.
He said: ‘I don’t use my card in any POS (Point of Sale) machine. I would rather do a transfer to the POS in exchange for cash or enter the banking hall to do my transaction.
‘I can’t forget what my mummy went through in an attempt to retrieve her money.’
Narrating how the 63-year-old woman was duped of her money, Yinka said: ‘My mum called me to say that she saw a debit alert. Someone had called her earlier to say that he wanted to send money to her, so she should send the last six digits on the back of her bank’s debit card.
‘She obliged. But instead of being credited, her account was debited. Before she realised what was going on, the money in her account had been cleared (stolen).’
Yinka went to the bank to make a complaint. He saw where the funds were moved to: It was in one of the accounts being managed by mobile money operators.
The matter was reported to the police, but they insisted that he had to pay for them to track the payment.
‘That was when we knew we could not make any headway. We left the matter and closed the account. My mum lost more than N200,000,’ Yinka said
Slide in use of ATMs
While many Nigerians are worried that the incidences of ATM card hacking have continued to surge, findings revealed that ATM users grew from 11,000 in 2011 to 16,000 around 2016 and 21,000 in 2019. It grew to 22,600 in 2021, where it has remained as of December 2023, an indication that investment in the market has stalled.
The Nigerian Payments Report 2024 notes that online transfers are increasingly dominating digital payments over ATM transactions.
Explaining the surge in cyber fraud in banks, a cybersecurity professional, Dr Seyi Akindeinde of Digital Encode, Lagos, said the digital adoption without adequate security education and weak regulatory enforcement makes it easy for criminal elements in society to exploit the situation.
He said sophisticated fraud techniques (SIM swapping, social engineering), poor customer security habits, and inadequate investment in cybersecurity infrastructure are other factors that make it easy for fraudsters to perpetrate this fraud.
Our findings revealed that most times, the stolen funds are transferred to accounts managed by mobile money operators, and Akindeinde said this is made possible by ‘cash-out convenience – immediate access to physical cash; lower scrutiny compared to traditional bank accounts; fragmented oversight across multiple POS operators; quick account closure to avoid detection and rural/informal network accessibility.’
How cyber fraudsters steal money from accounts
The Nation findings revealed that the simplest way criminal elements get card data is to steal someone’s card, thereafter, get the Personal Identification Number (PIN) by shoulder surfing or guess a weak password, such as a birth date or make use of the last six-digit number at the back of the debit card.
Shoulder surfing is a social engineering technique where an attacker observes your screen or keyboard to steal sensitive information like passwords, PINs, or card details. This threat is prevalent in public spaces and involves physically watching or using devices like cameras to gather information, often exploiting moments when people are distracted or let their guard down. To prevent this, use privacy screens, position yourself to limit views, shield your keyboard when typing, and enable two-factor authentication on your accounts.
Just like Odugbesan confirmed, a cyber fraudster can get a hold of a card for a few seconds, then they can swipe it through a reader and get its data. Those who are careless with their mailboxes are prone to having their bank account cleared.
Investigations revealed that cyber fraudsters, when they get hold of their victim’s e-mail, change the victim’s mailing address with the bank, order a new card, and activate it. But this may be difficult if the bank has good processes in place that are adhered to.
For those using POS machines, the criminal elements place a card reader over the machine’s intrinsic reader. They might also attach a video camera or a pin-pad overlay to capture the PIN, which is why so many people have been complaining of losing money after doing transactions on a POS machine.
Criminals have been known to place fake, modified terminals in public spaces where victims will use their cards but receive communication error messages. In reality, the terminal has captured card data and PIN, and stored it for later retrieval.
Taming fraudsters
Akindeinde revealed that to beat the fraudsters at their game, banks should strengthen their cybersecurity by putting up 24/7 Security Operations Centres (SOC) with real-time monitoring.
He also recommended AI-powered fraud detection systems that never sleep; multi-factor authentication for all transactions; regular security audits and penetration testing; immediate transaction alerts and spending limits.
While many have accused some bank staff and fraudsters of collaborating to dupe customers, he said banks should endeavour to do mandatory background checks and regular re-screening.
‘Banks should embark on segregation of duties – no single person controls entire processes; audit trails for all staff actions; embark on whistleblower protection programmes, and severe penalties including criminal prosecution for those caught in perpetrating the crime,’ he said.
He also recommended customer education campaigns on security practices, real-time transaction monitoring and blocking; inter-bank information sharing on fraud patterns; stronger penalties and faster prosecution; and improved KYC/verification processes.
While so many banks tend to push back on the ATM card retention liability, he said banks are primarily liable for mechanical failures, but customers are liable if they shared a PIN or acted negligently. Joint liability when both parties are at fault.’
To mitigate liability, Akindeinde recommends ‘Insurance coverage which is expected to protect legitimate losses.
While many aggrieved customers like Odugbesan and Wini are not happy that banks are reluctant to release the identity of fraudsters, Akindeinde said this is necessary because of the customer privacy laws and data protection.
He also explained that when an investigation is ongoing, it is always necessary to do this; otherwise, ‘it could be compromised.’
The cyber expert also believes that factors such as legal liability concerns, incomplete evidence for definitive identification, and regulatory restrictions on information sharing could be other reasons why banks prefer to withhold customers’ information.
Banks, customers, who is to blame?
Akindeinde told our correspondent that banks avoid responsibility for stolen funds because the burden of proof often falls on customers.
He added ‘terms of service that shift liability; high compensation costs affecting profitability; difficulty proving bank negligence vs. customer error and regulatory ambiguity on liability frameworks,’ as some of the reasons why banks reject liability.
Unknown to many customers, when there is proof of PIN/password sharing or writing down credentials, delayed reporting of suspicious activity, ignoring security warnings from the bank;-using unsecured networks for banking, and falling for obvious phishing attempts despite warnings, banks will not be liable to any loss.
A Lagos-based lawyer, Principal Partner, Law House Partners, Bayo Bello, advised aggrieved customers that after waiting for 14 days, if the bank fails to address their complaints, they should send an email to [email protected], the Consumer Protection Department of the Central Bank of Nigeria (CBN). It can also conduct its own independent investigation and deliver an appropriate verdict. If it finds the bank culpable, it would compel it to make restitution to the customer.
‘However, the customer can also institute a legal action against the bank if he has strong evidence that the bank is culpable for the missing funds,’ Bello added.