Public advisory: recognising and avoiding online banking fraud

This advisory sets out the online banking fraud patterns most frequently reported by members of the public, and the practical checks that defeat almost all of them.

The pattern to recognise

Nearly every reported case follows the same shape. The victim receives a message — by SMS, email, WhatsApp or a phone call — that creates urgency. The account is said to be suspended, a transfer is said to be pending, a BVN is said to require revalidation. The message then supplies the remedy: a link to follow, a number to call, or a code to read out.

The urgency is the attack. It exists to stop you from making the one check that would end the matter.

The checks that work

• Never act on the contact details in the message. Reach your bank using the number printed on your card or in the bank's own mobile application.
• Never read out a one-time password. No bank, and no police officer, will ever ask for one. A caller who asks for an OTP is committing fraud, whatever name they give.
• Check the sender's address in full. Fraudulent domains differ from genuine ones by a character or two.
• Treat unexpected links as hostile. Type your bank's address yourself, or use its app.

If you have already responded

Contact your bank immediately and ask for the account to be restricted. Preserve the messages, the number that contacted you and any transaction references — these materially assist investigation. Then report the matter at your nearest police division or to the appropriate specialist unit.

Acting quickly matters. The window in which a transfer can be stopped is measured in hours, not days.