Nigerian motorists are being targeted by a text message scam that pretends to come from the Federal Road Safety Corps (FRSC). The message says a traffic offence has been recorded against your vehicle and asks you to tap a link to “review” or pay the fine. The link leads to a convincing fake website. Victims who enter card or bank details have reported losing hundreds of thousands, and in at least one case more than a million, naira.

The FRSC has publicly disowned the messages and called the website fraudulent. An investigation published by Public Enquirer on 16 October 2026 shows the scheme is still active, run on a network of look-alike domains that keep reappearing after takedowns.

How the fake FRSC fine scam works

The scam follows a familiar “smishing” (SMS phishing) pattern, but it has been polished to look official:

1. The text. You receive an SMS from an ordinary phone number saying a new traffic offence has been logged and needs your attention. It includes a link.
2. The fake portal. The link opens a page titled something like “Road Traffic Offences” that asks for your plate number. Whatever you type, it returns a “Pending Fines” screen.
3. The pressure. The page quotes the real FRSC Establishment Act, shows a violation code and offers to halve the fine if you pay within a short window. The legal language and deadline are there to rush you.
4. The theft. You are sent to a payment page and asked for card or account details. The “fine” is small, but what the criminals actually take is much larger.

Two public figures shared their experiences. Actress Eva Ibiam reported a single debit of about ₦364,574 to an unfamiliar foreign merchant, with a one-time password arriving minutes afterwards, a sign the fraudsters were using her details in real time. Comedian MC Monica reported a card charge of about ₦1.85 million to another unknown merchant, and received a second lure from a different web address within hours.

Why these fake sites keep coming back

Public Enquirer traced the operation to a cluster of cheap web addresses designed to look like government sites, including frscgov.top, which the FRSC itself flagged in September, and variants using endings such as .sbs and .cam. One fake domain was set up and hosted within about 82 seconds, which suggests the process is automated. The same infrastructure was also linked to a fake parking-payment site aimed at drivers in Poland, so this is an organised, international operation, not a lone fraudster.

Investigators also found a separate fake FRSC login page that collects email addresses and passwords. Only a handful of the domains have been permanently removed; others moved to new hosting and returned. That means you cannot rely on a site being blocked. You need to recognise the trick yourself.

Warning signs to look for

• The message comes from a regular mobile number rather than an official sender.
• The link does not point to frsc.gov.ng. Look-alikes such as “frscgov”, “frsc-gov” or unusual endings like .top, .sbs, .cam or .cc are red flags.
• It offers a discount for paying fast or threatens extra penalties if you delay.
• It asks for your full card number, expiry date, CVV, PIN or online banking password.
• You receive an OTP you did not request just after visiting the page.

How to check a traffic fine safely

The FRSC says alleged offences should be verified only through its official channels, not through links in unsolicited messages. Its official website is frsc.gov.ng, and its national toll-free line is 122. Type the web address yourself instead of tapping a link, or call the line and ask whether your plate number has any record against it.

The FRSC has also advised motorists not to share banking details, passwords, card details, driver’s licence or vehicle registration information in response to such messages, to keep the messages as evidence, and to stop engaging with the sender.

What you should do

• Do not tap links in texts about traffic fines, licence renewals or vehicle papers. Go to frsc.gov.ng directly or call 122.
• Never enter card details or OTPs on a page you reached from an SMS link.
• If you already paid, call your bank immediately using the number on the back of your card, ask them to block the card and dispute the transaction. Speed matters, because these debits can happen within minutes.
• Change any password you typed into a fake FRSC login page, and change it anywhere else you reuse it.
• Turn on transaction alerts and set daily card spending limits in your banking app, especially for online and foreign transactions.
• Keep the SMS as evidence and report it to your bank and to the FRSC.
• Warn family, drivers and staff, particularly anyone who manages company vehicles, because fleet managers are natural targets for this kind of message.

Sources

• Public Enquirer: How scammers built, deployed a fake version of Nigeria's traffic agency
• TheCable: FRSC disowns viral traffic violation messages, warns motorists against fake website
• Leadership: FRSC Warns Motorists Against Fake Traffic Offence SMS, Website

Nigerian authorities have issued a string of warnings this month about sextortion, a form of online blackmail that is now being boosted by artificial intelligence. The Nigeria Police Force National Cybercrime Centre (NPF-NCCC) raised the alarm at its October cybersecurity awareness events in Abuja, and NITDA’s computer emergency response team issued an advisory about criminals using AI to create fake explicit images. This alert is for everyone who uses social media, dating apps or messaging apps, and especially for parents, teachers and employers who look out for young people and staff.

Key takeaways

• Sextortion is blackmail: criminals threaten to release intimate images or videos unless the victim pays money, sends more images or meets other demands.
• NITDA warns that criminals can now use AI to create convincing fake explicit images, so you can be targeted even if you never shared anything.
• Paying does not make it stop. Blackmailers usually come back for more.
• Save evidence, stop responding, report the account to the platform and report the crime to the police cybercrime centre.
• Sharing someone’s intimate images without consent is an offence in Nigeria, and the police say cases involving children are treated as particularly serious.

What the authorities are saying

On 17 October 2026, at the World Cyber Security Awareness Walkathon in Abuja, AIG Akaninyene Ezima, who heads the NPF-NCCC, warned Nigerians about romance scams and sexual extortion, in which fraudsters build online relationships to obtain intimate photos and later threaten to publish them. He also flagged investment fraud that shows victims fake profit dashboards before blocking withdrawals, and noted that some Nigerians have lost hundreds of millions of naira, with others losing billions, to such schemes.

Days earlier, the Inspector-General of Police used the centre’s 2026 awareness campaign to list common online offences, including sharing someone’s nude or private photos or videos without consent. He urged victims of sextortion, fraud and cyberbullying to come forward and report.

In early October, NITDA’s CERRT advisory warned of rising sextortion threats and the growing use of AI-generated explicit images. It stressed that children, teenagers and adults can all be targeted.

How the scam works, step by step

1. First contact

According to NITDA, the approach often starts on social media, messaging apps, dating platforms or even online games. The account may look like an attractive stranger, a fellow student or a new business contact. NITDA notes that it may be impossible to verify who is really behind such an account.

2. Building trust

The criminal invests time in friendly or romantic chat. Police say fraudsters use these online relationships to gain trust, with the aim of getting the victim to share private photos or videos.

3. The trap closes

Once they have images, or have created fake ones with AI, the tone changes. The victim is threatened that the material will be published or sent to people they know unless they pay or comply.

4. Escalating demands

The first payment is rarely the last. NITDA warns that complying does not guarantee the threats stop, and blackmailers may keep asking for more money or more images.

The AI twist: fakes made from ordinary photos

The newest danger is that a criminal no longer needs a real intimate image. NITDA’s advisory explains that AI tools can be used to create convincing fake explicit images. In practice that means a normal profile picture, graduation photo or work headshot could be misused. Victims may feel they have no defence because “it looks real”. Remember: the shame belongs to the criminal, not to you, and a fake image is still evidence of a crime.

Warning signs

• A new online contact who moves very quickly to flirting or romantic talk.
• Pressure to switch from a public platform to a private messaging app or video call.
• Requests for photos, or attempts to steer a video call towards undressing.
• A profile with few real connections, recently created, or using photos that look too polished.
• Sudden threats, a countdown or a list of your contacts appearing in a message.
• Any demand for money or more images in exchange for “deleting” content.

How to protect yourself and your family

• Do not send intimate images or videos online, even to people you know or trust. This is NITDA’s first recommendation.
• Lock down your profiles. Police urge caution about sharing personal information and photos online, so limit who can see your friends list, photos and workplace.
• Be careful with strangers on dating apps, social media and gaming platforms, and treat unverified accounts with caution.
• Talk to children and teenagers. NITDA notes that young victims often stay silent out of fear or shame. Make it clear they can come to you without being punished.
• Employers: include sextortion in staff security awareness sessions, so employees know it is safe to ask for help if they are targeted.

What to do if you are a victim

1. Do not pay and do not send more images. Paying rarely ends the threats.
2. Save evidence before blocking. Take screenshots of messages, usernames, profile details, phone numbers, payment requests and account details. Do not delete the chat.
3. Stop all contact once you recognise the threat.
4. Report the account and the content to the platform where it happened.
5. Use StopNCII.org. This free service creates a digital fingerprint of an image on your own device, without uploading it, so that participating platforms such as Facebook, Instagram, TikTok and Snapchat can block it from being posted.
6. Report to the police. The NPF-NCCC accepts reports through its e-reporting portal at nccc.npf.gov.ng/ereport and by email at nationalcybercrimecenter@nccc.npf.gov.ng.
7. Get support. NAPTIP’s cybersecurity response team handles online exploitation, and organisations such as WARIF, the Mirabel Centre and, for minors, the Cece Yara Foundation offer counselling and legal support. If you have already paid money, you can also report to the EFCC.

What you should do

Share this alert with family members, students and staff, and agree a simple rule at home and at work: if anyone is ever threatened with intimate images, real or fake, they should tell someone they trust, keep the evidence and report it, without paying a single naira. Sextortion depends on fear and silence; speaking up early takes away the criminal’s power.

Sources

• Nairametrics: NITDA warns Nigerians over rising sextortion threats
• Gazette: Police warn Nigerians against online scams
• Vanguard: IGP warns Nigerians against seven online offences
• Zikoko: What to do if someone threatens to leak your nudes in Nigeria

Big public share offers bring out ordinary investors, and they also bring out people hoping to take advantage of them. The public offer of shares in Dangote Petroleum Refinery and Petrochemicals, one of the most talked-about listings in Nigeria’s history, is the latest example. Nigeria’s Securities and Exchange Commission (SEC) has issued warnings about unauthorised platforms, and in early October it publicly named one.

If you, your family or your staff were interested in the offer, or are being approached about any share or investment deal, this is the moment to slow down and verify.

What happened

The refinery’s public offer opened on the Nigerian Exchange (NGX) on 14 September 2026. According to reports at the time, it offered 4.1 billion new ordinary shares at N525 each, with a minimum subscription of 10 shares, and was expected to run until 13 October 2026, subject to the prospectus. On the day the offer opened, the SEC warned the public to ignore “unauthorised and fraudulent platforms” and to subscribe only through approved channels such as NGX Invest, designated banks and authorised investment platforms.

Then, in a notice dated 9 October and posted on its website the next day, the SEC said a platform called WayvePay, which had promoted the offer through a newspaper advertisement, is not registered by the Commission to solicit investments from the public or operate in Nigeria’s capital market. The SEC warned that dealing with unregistered entities exposes investors to fraud and potential loss, and that anyone dealing with the platform on capital market matters does so at their own risk.

The SEC’s notice concerns registration status. It does not, by itself, describe what the platform did with any money received. But the principle is the same for every investor: if a platform is not registered to take your investment, your money has no regulatory protection.

How fake share offers usually work

Scams built around popular listings follow familiar patterns. Watch for:

• “Guaranteed allotment” promises. Real public offers allocate shares according to the prospectus. No one can legitimately guarantee you a bigger allocation for a fee.
• Late or “special window” offers. Messages claiming you can still buy at the offer price after it closes, or ahead of other investors, are a red flag.
• Discounted “pre-listing” shares. Offers to sell shares below the official price through a private arrangement are almost always fraudulent.
• Payments to personal accounts. Legitimate subscriptions go through banks, stockbrokers and approved platforms, not into an individual’s account or a wallet number sent on WhatsApp.
• Pressure and secrecy. The SEC lists unrealistic profit promises, pressure to decide quickly and demands for upfront payment through suspicious channels as classic warning signs.
• Look-alike adverts and pages. Social media adverts, fake websites and Telegram groups may borrow real company names, logos and photos to look official.

How to verify before you invest

1. Check registration. Visit the SEC’s official website at sec.gov.ng and confirm the platform or broker is registered. Type the address yourself rather than clicking links in messages.
2. Use known channels. Subscribe to public offers only through licensed stockbrokers, your own bank’s official channels or platforms named in the official prospectus.
3. Read the prospectus. It sets out the offer price, dates, receiving agents and how shares are allotted. Anything that contradicts it is suspect.
4. Confirm your CSCS account. Shares bought on the Nigerian market are held through the Central Securities Clearing System. Ask your stockbroker how to confirm your holdings independently.
5. Call to confirm. If someone claims to represent a bank or broker, end the conversation and call the institution using a number from its official website.

If you have already paid

Act quickly. Contact your bank immediately to report the transfer and ask whether it can be traced or stopped. Keep every receipt, message, phone number and account detail. Report the platform to the SEC through its official channels and to the police. Be careful of anyone who later contacts you offering to “recover” your money for a fee; recovery scams often target people who have just lost money.

What you should do

• Never invest through a platform you have not verified on the SEC website.
• Ignore offers of guaranteed allocations, discounts or late access to any share offer.
• Pay only through licensed brokers, banks or channels named in the official prospectus.
• Warn your staff and family, especially those new to investing, and share the SEC’s official website.
• Report suspicious offers to the SEC so others can be warned.

A genuine opportunity will still be genuine after you take ten minutes to check. A scam depends on you not checking at all.

Sources

• SEC Exposes Unapproved Platform Offering Dangote Refinery IPO Shares to Nigerians – Legit.ng
• Nigeria: Dangote Refinery IPO – SEC Warns Investors Against Fraudulent Platforms – AllAfrica
• Run From Any Unregistered Online Investment Platform, SEC Warns Nigerians – Business Post

Featured image: Photo: “Analyzing Stock Market” by ota_photos, CC BY-SA 2.0, via Openverse — source

“Abeg, can I use your account to receive some money? I’ll send you something small for your trouble.” It sounds like a harmless favour between friends, or an easy way to earn extra cash. But Nigeria’s police leadership has just made it clear that it can also make you part of a fraud investigation.

Speaking in Abuja on 15 October 2026 at the 2026 Cybersecurity Awareness Campaign of the Nigeria Police Force National Cybercrime Centre (NPF-NCCC), Inspector-General of Police Olatunji Disu warned that account holders who allow others to receive money through their accounts may be investigated if those accounts are tied to fraud. The campaign’s theme was “Towards a Resilient Cyberspace: Think Before You Click.”

What the police said

According to reports by Vanguard and Blueprint, the IGP listed online activities that can attract prosecution under Nigeria’s Cybercrimes (Prohibition, Prevention, etc.) Act. They include:

• Letting others use your bank account or SIM card to receive money when you do not know the source or purpose of the funds.
• Dealing in fake payment alerts or receipts, or trading in other people’s BVNs, NINs or card details.
• Gaining unauthorised access to someone else’s phone, WhatsApp, email or social media account.
• Creating fake accounts using another person’s name or photo.
• Cyberbullying, spreading false information that could cause panic, and sharing private images without consent.

He stressed that ignorance of the law is no excuse, and that penalties include imprisonment and heavy fines. The Director of the National Cybercrime Centre, AIG Akaninyene Ezima, also urged young people to reject quick-money schemes and online criminal recruitment, and warned that criminals are increasingly using AI for deepfakes, synthetic identities and impersonation.

How money mule recruitment works

Fraudsters who steal money need somewhere to send it that cannot be traced back to them. So they recruit “money mules”: ordinary people whose accounts or SIM cards are used to receive and move stolen funds. The approach usually looks innocent:

• The friendly favour: a friend, neighbour or online contact says their own account is “restricted” and asks to use yours for a payment.
• The fake job: an online “payment processing agent” or “remote finance assistant” role that pays commission for receiving transfers and forwarding them.
• Account or SIM rental: offers of cash to open a new bank account, wallet or SIM registered in your name and hand it over.
• The romance or investment link: someone you met online asks you to receive money for them and send it on, sometimes in crypto.

When the stolen money is traced, it leads to your name, your BVN and your SIM registration, not the fraudster’s. Victims of the original scam see your account as the one that took their money. Your bank may freeze your account, and you may have to explain yourself to investigators.

Insider risks at banks and fintechs

The police also turned their attention to the institutions themselves. The IGP urged banks, fintechs and telecom operators to guard against insider threats, including compromised staff and misuse of privileged access, by screening employees, restricting access to sensitive systems, monitoring transactions and running regular audits. He said the warning was not a judgement on employees’ integrity. A representative of the Nigeria Data Protection Commission (NDPC) added that the Commission is working with law enforcement under the Nigeria Data Protection Act, 2023, to tackle the misuse of personal data. The IGP also warned digital lenders against using customers’ personal data to harass or blackmail borrowers.

How to protect yourself

1. Never lend your account. Do not let anyone, including friends and relatives, receive money through your bank account, wallet or POS terminal if you do not know exactly where it came from.
2. Never hand over a SIM. A SIM registered with your NIN is linked to you. Do not sell, rent or give one to someone else.
3. Reject “receive and forward” jobs. No legitimate employer asks you to receive money in your personal account and send it on.
4. Guard your identifiers. Keep your BVN, NIN, card details, PINs and one-time passwords private. Banks will not ask for your PIN or OTP.
5. Check your statements. Review your account regularly and report any transfer you do not recognise to your bank immediately.
6. Talk to young people. Students and job seekers are prime targets for mule recruitment. Explain the risks plainly.

If you have already been used

Stop all transfers immediately, do not forward any more money, and contact your bank. Keep records of messages and transactions and report the matter to the police. Coming forward early is far better than being discovered later.

What you should do

• Say no to any request to use your account, wallet, POS or SIM for someone else’s money.
• Businesses: limit staff access to customer data and payment systems to what each role needs, and review access regularly.
• Report recruitment attempts and fraud to your bank and the police.
• Share this warning with family members, staff and students who may not know the risks.

Your account is tied to your identity. Protect it like you would your name.

Sources

• Cybercrime: IGP warns Nigerians against seven online offences – Vanguard
• Police, NDPC warn banks, fintechs against insider cybercrime risks – Blueprint

Featured image: Photo: “Sadness – 2011-04-20” by 4nitsirk, CC BY-SA 2.0, via Openverse — source

A customer picks out goods, says the transfer has gone through, and shows you a phone screen or forwards an SMS that looks exactly like a bank credit alert. You hand over the goods. Hours later you check your account and the money never arrived. Fake bank alerts remain one of the most common frauds hitting traders, restaurants, POS agents and online sellers, and they work because they exploit speed and trust, not technology.

How fake alert scams work

Most fake alerts fall into a few patterns:

• Spoofed SMS messages. Fraudsters use bulk-SMS tools that let them set any sender name, so the message appears to come from your bank and is formatted like a genuine credit alert.
• Fake receipt screenshots. Edited images or “fake transfer” apps generate convincing receipts showing your account name, the amount and a reference number.
• Pending or reversed transfers. Some scammers start a real transfer that later fails or is reversed, then show the “processing” screen as proof.
• Pressure and distraction. The scam usually comes with urgency: a busy shop, a customer in a hurry, or a story about network problems.

The golden rule: trust your balance, not their screen

An SMS, an email, a screenshot or the customer’s phone is never proof of payment. The only reliable proof is your own account balance or transaction history, checked by you, on your own device, through your bank’s official app, internet banking or USSD service.

A five-step check before releasing goods

1. Open your banking app yourself. Don’t tap links or numbers in the message you received.
2. Confirm the new balance, not just a line in the transaction list, and make sure the amount matches.
3. Check the sender’s name in your transaction details against the name the customer gave.
4. If the transfer shows as pending, wait. Politely tell the customer goods are released once funds reflect. Genuine customers understand.
5. For large amounts, call your bank using the number on its official website or the back of your card to confirm.

Make it a business process, not a personal judgement

Fraudsters target the busiest moment and the newest staff member. Protect your team by making verification a written rule:

• Only designated staff can confirm transfers, using the business’s own banking app or a dedicated notification phone.
• Display a simple notice: “Goods are released when payment reflects in our account.”
• Turn on push notifications in your official banking app, which are harder to fake than SMS.
• Keep a log of transfers confirmed, with time and staff initials, so disputes are easy to resolve.

What to do if you’ve been caught

Act quickly. Save the screenshots, phone numbers and any CCTV footage, report the incident to your bank immediately, and file a report with the police. Warn other traders in your area; fake alert fraudsters often hit several shops in the same market on the same day.

The bottom line

A few seconds spent checking your own balance is the cheapest fraud protection a business can have. Make “confirm before you release” a habit for everyone who handles payments, and fake alerts lose their power.

Featured image: Photo: “Mobile Phone with Money in Kenya” by whiteafrican, CC BY 2.0, via Openverse — source

Fake invoice fraud is simple and effective. A criminal sends a convincing bill, or a message that appears to come from a real supplier, asking you to pay into a new bank account. By the time the real supplier asks where their money is, the funds are gone.

How the scam works

Attackers either register a lookalike domain, such as one with an extra letter, or break into a real mailbox and reply inside an existing conversation. The message often mentions a genuine project, which makes it believable.

Warning signs

• A change of bank details, especially with a request for urgency
• Slight differences in the sender address or company name
• Pressure to pay today or to keep the change confidential
• A new payee with no history in your records

How to protect your business

Confirm every change of bank details by phoning a number you already hold, never one in the email. Require two people to approve new payees and large payments, and train accounts staff to expect this scam. If you have paid a fraudster, call your bank immediately, because early action can sometimes recover funds, and report the fraud to the authorities.

Key takeaway: verify bank detail changes by phone, using a number you already trust.

A page suddenly fills your screen with alarms, a loud warning and a phone number to call. It looks serious, but it is almost always a scam. Real companies do not alert you this way.

How it unfolds

The pop-up claims your device is infected and urges you to call support. The caller then asks to connect remotely, fixes nothing, and charges a fee or installs software that gives them continuing access to your files and accounts.

What to do instead

• Do not call the number or click anything in the pop-up
• Close the browser, or force quit it if the page will not close
• Never give a stranger remote access to your device
• Run a scan with security software you already trust

If you already called

Disconnect the device from the internet, change passwords from a different clean device, remove any remote access software and check your bank statements. If you paid by card, contact your bank to dispute the charge. Tell family members, because victims are often targeted again.

Key takeaway: a genuine warning will never ask you to phone a stranger and hand over control of your computer.

QR codes make life convenient, from menus to parking. Because you cannot read where a code leads before you scan it, criminals use them to send people to fake pages.

Where the risk appears

Common tricks include stickers placed over genuine codes on posters or parking meters, codes in unexpected emails or letters, and messages claiming a delivery or payment problem. The linked page copies a real login or payment form and captures what you type.

Scan with care

• Check the link preview your phone shows before opening it
• Look for stickers placed on top of printed codes
• Do not scan codes from unexpected messages
• Type the address yourself for banking or account pages

When in doubt

Never enter card details or passwords on a page you reached from an unknown code. Businesses can help customers by displaying codes in tamper-resistant places and showing the web address in plain text beside them. If you entered details by mistake, contact your bank and change the password at once.

Key takeaway: treat a QR code like an unknown link and check where it leads.