More than email scams: the evolution of Nigeria's cyber-crime threat

Nigerian authorities frequently team up with international law enforcement to fight criminal networks

An anti-corruption sign sponsored by Nigeria's Economic and Financial Crimes Commission in the capital Abuja.

Critics say anti-corruption campaign should be aimed at the Nigerian authorities, rather than ordinary people.

From left to right, attending an international anti-corruption summit in 2016; Jim Yong Kim, president of the World Bank Group at the time, Sarah Chayes, a senior associate in the Democracy and Rule of Law Program, US secretary of state John Kerry, UK prime minister David Cameron and Nigerian President Muhammadu Buhari.

Mohammed Adoke, Nigeria's former attorney general, arriving at the Federal High Court to face charges of financial crimes in January 2020.

A man stands in front of a human rights radio station in Abuja that offers people a chance to make their views on the authorities heard.

With more than 120 million internet users in Nigeria, the country’s anti-corruption agency, the Economic and Financial Crimes Commission (EFCC) is faced with an uphill struggle to contain an epidemic of cyber crime.

It is a challenge that persists despite the organisation’s partnership with the US Federal Bureau of Investigation, Microsoft and Africa’s giant telecoms company, MTN.

Cybercrime, known as “Yahoo Yahoo” in Nigeria, is one of the most common forms of international crime, with damage from the activity expected to cost the global economy $10.5 trillion a year by 2025, according to Cybersecurity Ventures, a company that provides research into the evolving threat.

For countries such as Nigeria, losses could be catastrophic, undermining already fragile foreign investor sentiment.

Paul Mashote, a lawyer in the city of Lagos, said the proliferation of internet-related scams has seriously hurt the country’s image and requires concerted efforts by all stakeholders to stem the trend.

“The level at which cybercrimes are being perpetrated among young Nigerians shows that the society has degenerated into a comatose state. Obviously, concerted efforts are needed in combating these crimes; the EFCC alone cannot achieve this. It requires the efforts of every citizen and relevant agencies,” Mr Mashote said.

Until recently, the perception of cyber crime in Nigeria was one of scammers targeting people outside the country’s borders, such as the infamous 419 scam.

The 419 scams, also called advance fee fraud, are still so common that the FBI carries a warning on its official website, cautioning against responding to “a letter or e-mail from Nigeria asking you to send personal or banking information”.

In recent years, an increasing number of Nigerians have fallen victim to this kind of fraud.

The EFCC’s chairman, Abdulrasheed Bawa, said this year that his organisation had arrested more than 400 young Nigerians for internet-related fraud in the first three months of 2021.

Suspects are often paraded on TV as evidence of the authorities' success.

“From January 2021 to date, we have arrested more than 400 Nigerians suspected of involvement in cybercrime or advanced fee fraud-related offences and that is to tell you how huge the problem is,” Mr Bawa said. “Less than 48 hours ago, we arrested 18 individuals in Abuja."

Mr Bawa also said the trend was giving the country a poor reputation and tarnishing the country’s image as a destination to invest.

In 2018, commercial banks in Nigeria lost a cumulative 15 billion naira ($39 million) to electronic fraud and cybercrime, a 537 per cent increase on the 2.37 billion naira loss the previous year, according to the Nigeria Economic Fraud Forum.

Nigeria was also ranked 16th globally among countries most affected by internet crime, according to an FBI report.

Criminals are adapting and Nigerian cyber criminals increasingly use methods such as website spoofing, a far more advanced technique than 419 scams.

But international law enforcement has taken note.

In 2019, 77 Nigerian citizens, including the high-profile entrepreneur Obinna Okeke, were arrested by the FBI for participating in a massive online financial fraud scheme involving almost $11 million.

Okeke was involved in a global network of money launderers and was found guilty of hacking into the computers of US construction machinery company Caterpillar.

Another high-profile arrest was Ramon Abbas, popularly known as Ray Hushpuppi who, from his Dubai apartment last year, flaunted a lavish lifestyle of private jets, designer clothes and luxury cars worth millions of dollars.

In Nigeria, the EFCC says there have been cases where the public has started petitions to prosecute suspected cyber scammers.

“We are seeing more homegrown cyber crimes in Nigeria, now anybody can be a victim of cyber crime, so it is important that cyber security awareness is improved and we have more forensic experts to investigate cyber crimes, said Avril Eyewu-Edero, a Nigeria-based expert on cyber security.

“If hackers get into the information system of an organisation, it can bring down the company because they can find information that can make all the stakeholders pull out.”

While parades of suspected fraudsters displayed on TV by the EFCC point to its achievements in fighting cybercrime, Mr Mashote said revealing the identity of suspects through media parades undermined he chances of a fair trial.

The “Nigerian Constitution presumes every person who is charged with a criminal offence as innocent until such person is convicted by a court of competent jurisdiction", he told The National.

Suspects must not be “paraded before the media even before they are found guilty by the court of law”, he said.

“Cyber security can help prevent crimes before they happen, but it requires a lot of awareness of tools that can be installed on devices to ensure that the wrong person doesn't have access into your system to commit fraud, including your bank account,” Ms Eyewu-Edero said.

“That’s why it's important everyone becomes cyber-security conscious by ensuring that they don't click on the wrong links. Cyber-security awareness is very important, when everybody knows that they are not supposed to click on certain links, when they know that they need to use their two-step verification on their WhatsApp.

“The woman in the market needs to know that if she receives a text message asking her to send a particular code to receive one million naira, she'd know that it's wrong and that it would probably pose a threat to her bank account,” she said.

Ms Eyewu-Edero said the investigation aspect of it requires the service of digital forensics experts that will investigate to find out who the fraudster is.

A national biometric database, which the government is in the process of developing and introducing, could help to ensure that the right people are brought to justice.

“These two things coming together help to protect people from being victims of cyber crimes, and to find the perpetrator if he actually gets successful committing the crime.”