Because digital banks and mobile money platforms like OPay and PalmPay have simplified onboarding, millions of Nigerians now operate accounts where their phone numbers double as account numbers. It is simple, familiar and gives these banks a competitive edge over traditional banks.
For instance, OPay alone has reported roughly 50 million users in Nigeria, while PalmPay has around 40 million. These fintech companies only recently got their licences in 2018 and 2019 respectively. By comparison, traditional institutions like Union Bank of Nigeria have about 7.3 million customers. First Bank of Nigeria is estimated at about 43 million customers.
That scale explains why it has become normal to see Nigerians posting their OPay or PalmPay-linked phone numbers in comment sections to receive money.
But in Nigeria’s current cybersecurity environment and identity management ecosystem, that behaviour is irresponsible and, even worse, dangerous to the data subjects.
A PHONE NUMBER IS NOT JUST A NUMBER
Under the Nigeria Data Protection Act 2023, a phone number is classified as personal data. The law defines personal data as any information that can identify an individual directly or indirectly through identifiers such as names, identification numbers or online identifiers. Phone numbers fit that description easily.
What this means in practice is that when a person submits their phone or account number in a comment section, they are sharing more than a payment detail. It means they are sharing a piece of their own identity.
And once that data is exposed in an open environment, control is lost. It can be copied, stored, scraped and reused without the individual’s knowledge.
The law is built around principles like lawful processing and purpose limitation. But those protections weaken the moment individuals voluntarily release their identifiers into uncontrolled spaces.
THE NUMBER IS LINKED TO YOUR NATIONAL IDENTITY
Since 2021, Nigeria has enforced the linkage of SIM cards to the National Identity Number (NIN), following directives by the Nigerian Communications Commission. The NCC NIN-SIM linkage effectively transformed phone numbers into anchors for Nigerian identities.
Today, a phone number is not just a contact point. It is tied, within government and telecom systems, to a verified identity profile. This linkage was designed to improve national security and traceability, but it also means that exposing a phone number publicly is no longer a low-risk act.
As a result, the more visible your phone number is, the easier it becomes to connect it to a broader identity footprint.
PHONE NUMBERS NOW SIT AT THE HEART OF FINANCIAL SECURITY
Under frameworks developed by the Central Bank of Nigeria, phone numbers are a core part of digital financial authentication. They are used for one-time passwords (OTPs), transaction approvals and identity verification across banking and fintech platforms. One of those frameworks for instance is Operational Guidelines for Open Banking in Nigeria.
Regulators explicitly require authentication to occur through pre-authorised channels such as phone numbers, with verification steps like OTPs forming part of the process. This makes the phone number one of the first layers of financial access.
Once that layer is publicly available, it lowers the effort required for fraudulent attempts. It does not give immediate access to an account, but it gives attackers a verified starting point. In fraud ecosystems, that starting point is often the hardest part to obtain.
DATA MARKETS FEED ON PUBLICLY EXPOSED NUMBERS
Nigeria’s underground data market is not a speculation. FIJ has documented this, consistently too, since 2024. It has been documented.
Since 2024, FIJ has exposed and written about a network of illegal platforms openly selling Nigerians’ personal data, often using nothing more than a phone number as the search key.
In one of the earliest exposures, FIJ reported how a platform known as XpressVerify monetised access to NIN data, allowing users to retrieve identity records tied to phone numbers for a fee. That investigation triggered reactions from the regulators, but it did not phase the ecosystem.
FIJ later exposed NINPrint, a platform that sold Nigerians’ NIN records for as low as N180 per request. Reporters tested the system and successfully obtained identity records of multiple individuals who had consented to the experiment. In another case, nimcverify.ng offered similar services, allowing anyone with a phone number to retrieve NIN data for about N150.
The scale of the breach goes beyond isolated platforms. FIJ also documented how websites with no affiliation to the National Identity Management Commission were providing access to highly sensitive data, including NIN, BVN and even facial images.
In one test, reporters were able to purchase both NIN and BVN records of Nigerians — including journalists — for just N560 using only phone numbers.
Phone numbers are not peripheral in this ecosystem. They are used to query databases, match identities and cross-match information. And this is why publishing them can be dangerous.
A phone number posted in a giveaway thread is visible to others, scrapping tools, data brokers and actors already operating in a system where that number can be used to retrieve identity records. Once scraped, it can be stored, resold or cross-referenced with other datasets.
This is how aggregation works in practice. A single data point becomes a gateway. Over time, it accumulates context — names, identity numbers, financial links — until it becomes a usable profile. And once it reaches that stage, it is no longer yours to control.
REAL-WORLD FRAUD DOES NOT START WITH HACKING
Fraud in Nigeria rarely begins with sophisticated system breaches. Simple phone numbers exposure sits at the centre of that process.
The current data environment creates the perfect conditions for identity-based fraud. Once attackers have partial data — a phone number, an email, a name — they do not need to break into systems from scratch. They build on what is already available.
If a phone number can be used to retrieve NIN or BVN records for a few hundred naira, then identity theft is no longer a high-skill operation. It becomes transactional. This is the foundation that SIM swap fraud uses.
The fraud does not start at the telecom level. It starts earlier with the collection of identity data. Once enough information is gathered, fraudsters impersonate victims, request SIM replacements or resets, and take control of the number. From there, they intercept OTPs, reset banking credentials and access financial accounts.
Of course, there are examples of this.
One of those comes from FIJ’s 2026 story about recycled SIM cards. In that report, Lagos resident Mayokun Ilori bought what she believed was a brand-new MTN SIM card.
Within hours, she began to receive debit alerts from a bank account she did not own. The alerts were real transactions — carried out by the previous owner of the phone number — but they were now being delivered to a stranger.
In 2025 FIJ interviewed a digital rights advocate who warned that impersonators were using stolen or exposed personal data to obtain loans in other people’s names. The fraud does not require physical access to the victim.
Similarly, in 2019, the EFCC in Markurdi apprehended fraudsters who executed a SIM swap on a victim’s MTN line, took control of the number and proceeded to move over N7 million from the victim’s bank account. The victim only realised something was wrong when his phone lost service connection and his account balance had already been drained.
Source: FIJ
