A SIM swap does not require a fraudster to “hack” OPay, Moniepoint, PalmPay, or Kuda. In many cases, they take control of the phone number linked to your account, receive your OTP, reset your PIN or password, and move your money before you realise that your SIM has stopped working. 

Why your phone number matters

Nigerian digital financial accounts are commonly linked to identity and contact details, including your BVN and registered phone number.  That phone number is often used for transaction alerts, password or PIN recovery, and one-time passwords (OTPs), making it a high-value target for fraudsters. 

This is why a strong app password or biometric login, such as Face ID, alone is not enough. If someone controls your SIM, they may be able to intercept the OTP that unlocks account recovery even without knowing your original transaction PIN.

How a SIM-swap attack works

1.      They collect your personal details. Fraudsters may obtain your name, phone number, partial BVN details, address, or other identifying information through phishing links, fake customer-care messages, social-media exposure, or compromised records. 

2.     They impersonate you to the telecom provider. They may report your SIM as lost or damaged and request a replacement SIM that carries your number. If identity checks fail or are bypassed, the telecom provider may activate the fraudster’s blank SIM with your number.

3.      Your phone loses network service. A sudden “No Service” message, inability to make calls, or failure to receive SMS can be an early warning that your number has been moved to another SIM. 

4.     They intercept your OTP. With your number active on their phone, they may open your fintech app, select “Forgot PIN” or “Reset password,” and receive the OTP by SMS. 

5.      They reset access and withdraw funds. After resetting the PIN or password, they may attempt transfers quickly, before the victim contacts the bank, fintech provider, or telecom operator. 

What the fraud data shows

The Financial Institutions Training Centre (FITC) reported that Nigerian deposit money banks lost about ₦42.6 billion to fraud and forgeries in Q2 2024, up from ₦468.49 million in Q1 2024.   FITC’s report also found that “miscellaneous and other fraud” accounted for ₦41.14 billion, or 96.46%, of the Q2 losses, while fraudulent withdrawals and computer/web fraud were much smaller reported categories, at about ₦781.2 million and ₦400.7 million respectively. 

That does not mean that every loss was caused by a SIM swap; FITC’s figures cover reported fraud and forgery cases across deposit money institutions and do not identify SIM swaps as the cause.  However, it shows why banks, regulators, and fintechs treat phone-number takeover, social engineering, and unauthorised account access as serious systemic risks. 

How CBN rules respond

The Central Bank of Nigeria’s Guidelines on Instant Payment Functionalities, issued on 12 March 2026 and effective from 1 July 2026, require stronger controls for mobile banking and payment applications. 

●   Device binding: A mobile banking app may be active on only one device at a time; moving to a new device deactivates the previous device and triggers reactivation and fresh authentication. 

●   New-device limits: For newly opened accounts, both inflows and outflows are capped at ₦20,000 during the first 24 hours after mobile-app activation; for existing customers activating the app on a new device, outflows are capped at ₦20,000 during that period. 

●   Stronger authentication: A first-time internet-banking login on a new device requires enhanced multi-factor authentication. 

●   Stricter identity checks: Digital account opening and reactivation must include liveness checks and real-time verification against BVN or NIN databases. 

●   BVN phone-number restriction: Under CBN’s BVN rules, operative from 1 May 2026, each BVN holder is limited to one phone-number change, a measure intended to reduce SIM-swap abuse. 

In practical terms, these rules make it harder for a fraudster who has only your OTP to immediately drain an account from an unfamiliar phone. 

How to protect yourself

Lock your SIM

Enable your phone’s SIM lock and change the carrier-default SIM PIN immediately. A SIM PIN must be entered after the phone restarts or when the SIM is moved to another device, helping prevent a thief or fraudster from simply using the SIM elsewhere. 

●   On Android: go to Settings → Security → Set up SIM card lock (wording varies by phone).

●   On iPhone: go to Settings → Cellular → SIM PIN. 

●   Change the carrier-default PIN to a private code; do not guess it if you do not know it. Contact your mobile network operator for the correct default PIN or PUK code. 

●   Do not guess the PUK code after repeated wrong PIN entries; too many incorrect PUK attempts can permanently disable the SIM. 

Reduce what fraudsters can learn

●   Never share OTPs, PINs, passwords, BVN, NIN, or card details—even with someone claiming to be from your bank, telecom provider, or a delivery company.

●   Avoid posting your phone number, BVN, address, identity documents, or transaction receipts publicly. 

●   Treat unexpected links, “account verification” messages, and prize notifications as suspicious.

●   Use different passwords for email, fintech apps, and social media.

Watch for warning signs

Contact your telecom provider and financial institution immediately if: 

●   Your phone shows “No Service” while others around you have signal. 

●   Calls and SMS stop working unexpectedly.

●   You receive an OTP you did not request.

●   Your banking app asks you to reactivate on a device you do not recognise.

●   You see a login or transfer alert from an unfamiliar device.

If you suspect a SIM swap

1.      Contact your telecom provider immediately from another phone and ask it to block or suspend the SIM and regain control of your number. 

2.     Contact your bank or fintech provider immediately and request a freeze, transaction restriction, or other fraud-protection measure on the account. 

3.      Change your email and financial-app passwords from a secure, trusted device. 

4.     Report the incident through the provider’s official fraud channel and preserve screenshots, transaction references, timestamps, and any related messages. 

5.      Do not wait for the SIM to “come back” on its own. A sudden loss of network service after a replacement-SIM request can be a sign that the attack is already underway. 

 Your fintech account is only as secure as its weakest recovery path. In Nigeria, that weak point is often the SIM-linked phone number. Lock your SIM, guard your personal data, treat OTPs as private keys, and respond quickly if your line suddenly loses service.