N6 billion is not an IT budget line. It is a trust budget
When FirstBank's chief executive said the bank spends more than N6 billion every year on cybersecurity and operates 24-hour surveillance, the figure offered a rare glimpse into the hidden cost of keeping modern banking available.
Customers see a mobile app, a transfer button, a card terminal and an alert. Behind those conveniences are identity systems, security operations centres, fraud engines, network monitoring, encryption, incident-response teams and constant attempts to detect abnormal behaviour before money disappears.
Nigeria's shift towards electronic payments has made finance faster and more inclusive. It has also expanded the surface that criminals can attack. The real question is therefore not whether cyber threats can be eliminated. They cannot. It is whether the financial system can reduce successful fraud quickly enough to preserve confidence as digital transactions keep growing.
The fraud numbers are large, even after an improvement in 2025
A January 2026 data brief from the National Institute for Legislative and Democratic Studies, drawing on NIBSS data presented at the Nigeria Electronic Fraud Forum, said banks and financial institutions lost about N25.85 billion to electronic-payment fraud in 2025. That was a significant fall from N52.26 billion in 2024, while reported fraud cases fell to about 67,515.
The decline is encouraging, but it should not be mistaken for a solved problem. The Central Bank's Payments System Vision 2028 was launched around six principles that include security and trust, reflecting how central fraud prevention has become to financial stability and consumer confidence.
The important distinction is between transaction growth and risk growth. Nigeria wants more people and businesses using digital payments. Success therefore cannot mean reducing fraud by making digital finance inconvenient. The system has to become both easier to use and harder to exploit.
Cybercrime is only one part of digital fraud
People often imagine a cyberattack as a hacker breaking through a bank's firewall. That happens, but many successful frauds start with the customer rather than the core banking system.
Criminals impersonate bank staff, create fake websites, send malicious links, manipulate victims into revealing one-time passwords, take over SIMs, compromise email accounts or persuade people to authorise transfers themselves. Stolen identities and mule accounts then help move money through the system.
This is why a bank can spend billions protecting its infrastructure and still face losses caused by social engineering outside its network. Cybersecurity is partly a technology problem, but digital fraud is also a behavioural, identity, process and law-enforcement problem.
Artificial intelligence raises both sides of the contest
Banks can use machine learning to identify unusual transactions, compare behaviour across accounts and flag activity that would be difficult for a human analyst to detect at scale. Criminals can also use AI to improve phishing messages, generate convincing impersonation material and automate reconnaissance.
The result is not a simple race between good AI and bad AI. Security still depends on data quality, access controls, staff discipline, customer verification and how quickly institutions respond when something goes wrong.
The strongest fraud systems combine technology with clear escalation procedures. A highly accurate warning is useless if an institution cannot freeze a suspicious transaction, contact the customer or coordinate recovery quickly enough.
Regulation is moving towards more customer control
CBN reforms announced in 2026 include stronger real-time fraud monitoring, tighter identity verification and new controls around instant payments. Customers can voluntarily disable instant transfers or set lower personal limits, while mobile banking activation on a new device is subject to additional restrictions.
The logic is important. Most customers do not need the maximum possible transaction limit every hour of every day. Giving people the option to reduce their exposure can make a stolen credential less valuable.
The next challenge is usability. Security measures that are too difficult encourage customers to bypass them or overwhelm support channels. Good security design should make safe behaviour the easiest default rather than forcing users to become cybersecurity experts.
Banks need to compete on recovery, not only prevention
No security system will stop every fraudulent transfer. What customers experience after an incident therefore matters almost as much as prevention.
A consumer who reports an unauthorised transaction needs a clear process: acknowledgement, rapid investigation, communication, temporary protective steps and a decision within a defined period. Institutions also need stronger interbank cooperation because stolen funds can move through several accounts within minutes.
Nigeria's digital-payments market is interconnected. Fraud prevention cannot remain a collection of isolated bank defences. Shared intelligence, common technical standards and rapid cross-institution response are essential when criminals exploit the weakest link in the network.
Businesses face a different layer of risk
Small companies increasingly receive payments digitally, store customer data online and use cloud software, email and mobile devices for daily operations. Many do not have dedicated security teams.
For these firms, basic controls can prevent a disproportionate share of losses: separate approval for large payments, multi-factor authentication, verified changes to supplier bank details, restricted administrator access, reliable backups and staff training against impersonation scams.
The objective is not to turn every SME into a bank-grade security operation. It is to recognise that cybersecurity has become part of ordinary financial management. A company that protects inventory but not access to its bank account has left a critical asset unguarded.
The national target should be trusted digital finance
Nigeria has built one of Africa's largest digital-payment markets. That scale is an economic asset only if people trust the infrastructure enough to keep using it.
The N6 billion spent by one bank should therefore be read as evidence of the size of the responsibility, not merely the size of the threat. Financial institutions must keep investing. Regulators must improve standards and dispute resolution. Law-enforcement agencies need stronger digital-investigation capacity. Customers and businesses need simpler security habits.
The useful measure is not whether attacks stop. They will not. It is whether attempted fraud is detected earlier, successful losses decline, stolen funds are recovered faster and customers can use digital finance without feeling that convenience has made them permanently vulnerable.
A. Joshua Adedeji
A. Joshua Adedeji is a leadership strategist, organisational development consultant, author, teacher and values-driven transformation leader. He writes on leadership, strategy, governance, organisational effectiveness, business, personal development and Nigeria’s social and economic transformation, connecting ideas and current realities to practical implications for leaders, institutions, entrepreneurs and citizens. His work is shaped by a commitment to clear thinking, responsible leadership, stronger institutions and the development of people and systems capable of producing lasting impact.
Reader conversation
0 approved comments