The greatest danger to Nigeria’s banking system is not sitting in a darkened room halfway across the world with a laptop. It is sitting in an air-conditioned office with a staff ID card, a salary account, and authorised access to systems that move billions of naira every day.
That is the sobering conclusion emerging from a pattern of high-value financial fraud cases that have rocked Nigeria’s banking and financial technology sectors in recent years cases in which the perpetrators were not external hackers, but trusted insiders.
In 2023, First Bank of Nigeria experienced insider fraud in which an employee-led ring siphoned N40 billion by creating proxy accounts and routing funds through shadow beneficiaries. The suspect was a manager on the bank’s electronic products team, authorised to process transaction reversals for customers, a routine function that he weaponised to credit merchant accounts under his control.
The First Bank case, however troubling, is not an isolated incident. It follows a recognisable pattern that has now repeated itself across the Nigerian financial services sector.
Kippa, the Nigerian bookkeeping and finance startup, lost N30 million to internal fraud connected to its agency banking product, Kippa Pay. The fraud occurred for at least four months before it was discovered in November 2023, one month after the company shut down Kippa Pay and laid off 40 employees. A senior manager whose identity was withheld for legal reasons was discovered to have been making large withdrawals without a POS terminal. An internal investigation uncovered N30 million in his account. He was arrested but subsequently released.
The mechanics in both cases follow an almost identical script: an insider with elevated system access, transactions structured deliberately below alert thresholds, activity sustained across a long period, and reconciliation blind spots that mask the bleeding until the damage is catastrophic.
Industry data confirms the trend is worsening. Nigerian banks lost N52.26 billion to fraud in 2024 alone, representing a 350 per cent increase in losses over five years. Yet this headline figure masks a more disturbing reality while fraud incidents decreased in volume, the sophistication and severity of individual attacks intensified. The perpetrators, data shows, are increasingly employees with staff IDs, names on payroll, and authorised access to the core of banking infrastructure.
The Financial Institutions Training Centre Q1 2025 report reveals that banks lost N3.3 billion in just the first quarter of 2025, a 137 per cent increase from the previous quarter, despite 33.8 per cent fewer reported cases. Fraud through bank branches, a channel that by definition requires insider access spiked to nearly N8 billion.
The Nigeria Inter-Bank Settlement System (NIBSS) has since confirmed what these cases have long suggested. NIBSS Managing Director, Premier Oiwoh, disclosed at an industry event that insider abuse poses the greatest threat to the banking sector, adding that investigations carried out by NIBSS and partner institutions have consistently shown a high level of internal participation in fraud incidents, either through direct involvement or weak internal controls that are deliberately exploited.
Analysts say the financial sector’s response has so far been reactive rather than preventive. As financial analyst Chukwudi Izuchukwu observed, “If your system allows any single person to trigger financial transactions without a second approval layer, which is your vulnerability. Segregation of duties is not bureaucracy.”
The EFCC’s recovery of N9.7 billion, N6.7 billion, and N3.7 billion in separate operations demonstrates enforcement capacity, but recovery is not prevention. By the time funds are traced to cryptocurrency conversions or real estate acquisitions, the original victims remain uncompensated.
Experts and regulators are now calling for a fundamental rethink of how Nigerian financial institutions manage internal risk. Mandatory dual-authorisation for high-risk transactions, AI-driven anomaly detection, rotating access protocols, and robust insider threat programmes are no longer optional configurations, they are baseline requirements for institutional survival.
Oiwoh urged financial institutions to prioritise internal controls, closely monitor staff activities, and sustain joint industry action, stressing that trust and collaboration among institutions are essential to keeping fraud losses on a downward trend.
The message from data, investigators and regulators is now unambiguous: the vaults are not being breached from the outside. The threat is already inside and it knows exactly which transactions nobody checks.
.
