What makes NIP transfers attractive to fraud rings
NIP transfers settle in near real-time. Once funds leave an account and reach the destination, recovery requires the cooperation of the receiving institution and a formal recall process that takes days at minimum and frequently fails. This settlement finality is a feature for legitimate payments and an asset for fraud rings who move money through multiple account hops before any freeze request can catch up.
The APP scam does not exploit a technical vulnerability in the NIP system. It exploits the user's authorisation of a legitimate transaction. This is why it is called "authorised" push payment fraud. The attacker's job is to get the victim to initiate the transfer themselves. The social engineering component is the attack.
The three most common APP scam patterns in Nigeria
1. Investment fraud via WhatsApp and Instagram
The attacker builds a convincing investment opportunity, often with fake screenshots of returns, a website, and a WhatsApp group. The victim transfers funds to what they believe is an investment account. The funds are immediately moved through multiple accounts. The investment platform goes dark. This category represents the largest volume of APP fraud by case count in Nigeria.
2. Impersonation of financial institutions
The attacker calls the victim posing as a staff member from their bank, fintech, or NIBSS. The caller claims there is a suspicious transaction on the account and instructs the victim to transfer their funds to a "secure account" to protect them. The NIBSS brand is particularly effective because few users know that NIBSS does not contact individual account holders directly.
3. Romance fraud leading to investment transfer
An online relationship is cultivated over weeks or months, then leveraged to get the victim to transfer funds for an investment opportunity, an emergency, or a business venture. The victim initiates the NIP transfer voluntarily. The social engineering is not detectable by payment systems.
What your platform is expected to detect and prevent
You cannot stop a user who has been socially engineered into wanting to send money. But you can create friction and detection at moments that give fraud prevention systems a chance to intervene.
First-time beneficiary transfers
A transfer to an account the user has never paid before, especially for a large amount, is a higher-risk event. Adding a confirmation step with a short delay (30 to 60 seconds to "process") gives the user time to reconsider and gives your fraud system time to flag velocity patterns:
// Risk scoring for a new beneficiary transfer
async function scoreTransferRisk(transfer, userId) {
const [
isNewBeneficiary,
unusualAmount,
outsideNormalHours,
newDevice,
recentPasswordChange
] = await Promise.all([
beneficiaryHistory.isNew(userId, transfer.destinationAccount),
riskModel.isAmountAnomalous(userId, transfer.amount),
riskModel.isOutsideNormalHours(userId),
deviceFingerprint.isNew(userId, transfer.deviceId),
authHistory.recentPasswordChange(userId, hoursAgo = 24)
]);
let riskScore = 0;
if (isNewBeneficiary) riskScore += 30;
if (unusualAmount) riskScore += 25;
if (outsideNormalHours) riskScore += 15;
if (newDevice) riskScore += 20;
if (recentPasswordChange) riskScore += 10;
// Score >= 60: require additional confirmation
// Score >= 80: flag for manual review or block
return riskScore;
}Beneficiary name match verification
NIBSS Name Enquiry returns the registered account name. Displaying this name prominently before the user confirms the transfer is the single highest-impact intervention for APP fraud. A victim who sees "BRIGHT AGBOR TRADING COMPANY" instead of "Stanbic IBTC Secure Account" as the beneficiary name has been given information they can act on.
The attack against this control is account name spoofing: a fraud ring opens a business account with a name designed to look legitimate. Your obligation is to display the name accurately, not to validate whether it is a legitimate business. But accuracy matters. We test that the name displayed to the user is the verified NIBSS-returned name, not client-submitted text.
Cooling-off periods for high-value transfers
For transfers above a threshold (say, NGN 500,000 to a new beneficiary), a 10-minute delay before execution gives the user time to verify independently and gives your fraud team time to review. This pattern is used by several major Nigerian banks. The cost is friction on legitimate large transfers. The benefit is a meaningful reduction in APP scam completion rates.
Velocity controls on destination accounts
A destination account receiving many transfers from different senders in a short window is a money mule account signature. This check requires sharing data across users, which most platforms can do with their own account holders. If you see the same destination account receiving transfers from 20 different users in a 24-hour window, that destination account should be flagged.
CBN Consumer Protection Circular on Payment Fraud
The CBN's consumer protection framework places obligations on financial institutions to implement fraud detection controls, maintain a dispute resolution mechanism, and report fraud statistics. Institutions that cannot demonstrate they implemented reasonable controls face both financial penalties and reputational consequences in dispute adjudications. The specific controls expected include real-time transaction monitoring, velocity checking, and beneficiary verification. Documenting your fraud controls is as important as having them.
Want us to test your platform's fraud detection controls against realistic APP scam scenarios?
Talk to Our TeamFrequently asked questions
What is an Authorised Push Payment (APP) scam?
An APP scam is fraud where the victim is manipulated into initiating a legitimate bank transfer to an attacker-controlled account. Because the victim authorises the transfer, the NIP system processes it normally. The fraud is in the social engineering that preceded it, not in a technical exploit of the payment rails themselves.
Are NIP transfers reversible in Nigeria?
NIP transfers are largely irreversible once settled, typically within seconds. NIBSS can in some cases freeze destination accounts flagged for fraud, but recovery depends on the receiving institution holding the funds and cooperating with a recall request. The practical recovery rate for APP scam victims in Nigeria is low.
What can a fintech platform do to reduce APP fraud exposure?
Velocity checks that flag unusual transfer patterns (first transfer to new beneficiary, large amount, outside normal hours), beneficiary validation that goes beyond account name match, confirmation friction for high-risk transfers, and device/session anomaly detection. None of these prevent a determined attacker but they reduce the success rate and create detection opportunities.
Is an APP scam a platform vulnerability or a user problem?
Regulators and courts are increasingly treating it as a shared liability. The CBN's consumer protection framework places duties on financial institutions to implement fraud controls. Platforms that can demonstrate they had reasonable controls in place are better positioned in dispute resolution. Platforms that cannot demonstrate controls face both regulatory and reputational consequences.
Related reading
Blog: Bypassing name match algorithms in P2P transfers · NIBSS name enquiry exploits · Anatomy of a Nigerian mobile money fraud ring
Blog: Rate limiting for payment APIs · SIM swap fraud defence
Services: Penetration testing · Live fintech security review