Fraudsters evolve daily, but so does Nigeria’s legal framework. Banks, payment providers, and even telecommunication (telecoms) operators have affirmative legal duties to prevent and respond to electronic fraud. When they fall short, you’re not powerless.
Below is the legal landscape—what financial institutions and telecoms must do; what regulators require; and the practical steps we take to recover your funds and hold parties accountable.
1) The Core Statute: Nigeria’s Cybercrimes Act
A. Duties of Banks & Other Financial Institutions
Part IV of the Cybercrimes (Prohibition, Prevention, etc.) Act 2015 imposes specific obligations on financial institutions, including to implement counter-fraud measures and properly authenticate electronic instructions. Two high-impact rules stand out:
-Unauthorized debits must be reversed within 72 hours of your written complaint unless the bank produces clear legal authorization for the debit. Failure is an offence and attracts fines and restitution.
-Banks have a statutory duty to put in place effective counter-fraud controls before executing electronic instructions.
B. Duties of Telecoms & Other Service Providers
Fraud often exploits SIM swaps or weak KYC at the telecom layer. The Cybercrimes Act requires service providers to:
-Retain traffic and subscriber data for two years and assist law enforcement when requested. Non-compliance attracts fines and, for officers, potential imprisonment.
-Comply with court-authorized interception orders in criminal investigations.
-Avoid breaches of confidence: using customers’ access credentials or data to defraud is an offence with steep corporate and personal liabilities.
2) Data Security and Breach Duties Under the Nigeria Data Protection Act, 2023 (NDPA)
Banks, fintechs, and telcoms process enormous volumes of personal data. Under the NDPA 2023 they must:
-Implement appropriate technical and organizational measures to ensure the security, integrity and confidentiality of personal data (NDPA s.39).
-Notify the Nigeria Data Protection Commission (NDPC) within 72 hours of a notifiable personal-data breach and, where there’s high risk, promptly inform affected individuals (NDPA s.40).
These are hard obligations. In fraud cases involving data leaks or sloppy security, we pursue parallel data-protection enforcement alongside banking remedies.
3) Central Bank of Nigeria (CBN) Consumer-Protection & Cybersecurity Rules
A. Consumer Protection Regulations & Complaint Handling
CBN’s Consumer Protection Regulations (2019) require banks and payment providers to maintain robust complaints-handling frameworks, including 24/7 emergency channels and defined timelines for acknowledgment and resolution.
If your bank fails to resolve your complaint within the stipulated timelines (commonly two weeks for many ATM/Electronic Fund (EF) channels), you may escalate to CBN’s Consumer Protection Department via [email protected] or letter to the Director, CPD, CBN, Abuja.
B. Cybersecurity Governance for Deposit Money Banks (DMBs) & Payment Services Banks (PSPs)
CBN’s Risk-Based Cybersecurity Framework and Guidelines for DMBs & PSPs mandate board-level oversight, a designated Chief Information Security Officer (CISO), incident reporting to CBN (often within 24 hours for material incidents), Security Operation Centre (SOC) capabilities, and continuous monitoring. These rules create a measurable standard of care that we test in investigations.
C. Instant (Inter-Bank) Electronic Funds Transfer (EFT) Rules
CBN’s Regulation on Instant (Inter-Bank) EFT sets operational and redress standards for instant transfers, which we invoke to compel swift trace/reversal where feasible.
4) Practical Enforcement Pathways We Use for Victims
a. Immediate bank notification & retrieval window
– We file a written complaint (time-stamped) demanding either proof of authorization or 72-hour reversal (Cybercrimes Act).
– In parallel we trigger the receiving bank’s fraud desk under the Instant EFT rules to place post-no-debit (PND)/lien where operationally allowed while investigations run.
b. Telecoms angle (SIM swap/USSD compromise)
– We lodge a tracked complaint with your service provider, and if unresolved, escalate to the (Nigerian Communications Commission) NCC’s 622 toll-free second-level complaint centre.
-bWe demand subscriber/traffic-data preservation under the Cybercrimes Act for chain-of-custody.
c. Regulatory escalations
– CBN (CPD)—when bank responses breach CPR timelines or are unsatisfactory.
– NDPC—where a data breach or security-failures under the NDPA are implicated.
– Law enforcement—we coordinate petitions to the appropriate cybercrime units (including requests for preservation/disclosure orders) leveraging the duties on service providers in the Cybercrimes Act.
d. Litigation & structured settlements
– Civil claims for negligence, breach of statutory duty (Cybercrimes Act / NDPA / CBN frameworks), and breach of contract (banker–customer duty).
– We prepare electronic-evidence foundations compliant with Section 84 of the Evidence Act to ensure admissibility of screenshots, logs, and device records.
5) What Counts as a Breach of Duty (with examples)
– Failure to reverse an unauthorized debit within 72 hours after written notice—actionable under the Cybercrimes Act, with criminal and restitution consequences.
– Weak authentication (e.g., processing high-risk transactions without step-up verification) contrary to the bank’s duty to deploy counter-fraud controls before executing electronic instructions.
– Lax incident response (no timely incident reporting, no SOC/monitoring) in breach of CBN’s cybersecurity framework.
– Data-security failures (no risk-based controls, no breach notification) under NDPA ss.39–40.
– Telecom lapses enabling SIM-swap fraud, and refusal to retain or release mandated traffic/subscriber data for investigations.
6) Your Action Checklist (What We Advise Clients to Do Immediately)
– Freeze and document: Contact your bank’s 24/7 channel; demand a fraud freeze and written acknowledgment; keep SMS/email alerts and screenshots. (CBN CPR requires emergency channels.)
– Write a formal complaint the same day; demand 72-hour reversal or proof of authorization (cite Cybercrimes Act s.37 obligation).
– Alert your telecom provider if SIM/USSD is involved; insist on audit logs and KYC review; escalate unresolved issues to NCC 622.
– Escalate to CBN (CPD) if your bank fails to resolve within required timelines: [email protected]
/ letter to the Director, CPD, CBN, Abuja.
– Preserve digital evidence for Section 84 compliance (device, app logs, call records).
– Consult counsel early so statutory duties (CBN/NDPA/Cybercrimes Act) are invoked before funds dissipate.
7) How Evergreen Legal Solutions Prosecutes These Matters
– Rapid Response: Same-day statutory notices to the bank, receiving bank(s), and the telecom operator demanding 72-hour reversal, data preservation, and PND/lien requests as appropriate.
– Regulatory Pressure: Concurrent petitions to CBN CPD, NCC (where telecom failures exist), and NDPC for breach of ss.39–40 NDPA.
– Forensic Build-Out: Evidence packs prepared to meet Evidence Act s.84 standards, ensuring your case is litigation-ready.
– Civil & (Where Necessary) Criminal Proceedings: Claims for restitution, damages, and compliance orders; liaison with cybercrime units relying on the service-provider co-operation duties under the Cybercrimes Act.
Conclusion
Banks and telecoms in Nigeria must prevent, detect and respond to e-fraud. When they don’t, the Cybercrimes Act, NDPA, and CBN/NCC frameworks give you enforceable rights—deadlines, duties, and sanctions. At Evergreen Legal Solutions, we use these levers—fast—to protect your money and your data, and to hold institutions accountable.
TAIWO SHAKIRAH ISHOLA-AFOLABI ESQ.
Evergreen Legal Solutions [email protected] 07087743356
