The B2B KYC attack surface
Map each required record before testing: company record, company status, director identity, authority to act, beneficial owners, tax record, address, and product approval. Give each record its own state, source, timestamp, and expiry rule.
The final activation rule must check the full set on the server. Completing one check cannot mark the whole business as verified.
1. CAC registration number substitution in KYC request
Change the registration number after the company lookup and before account activation. Repeat with a lookup ID from another onboarding attempt.
Pass: the verified company, application, and final account use one server-owned registration record.
Company details can be public or shared. A name, address, or incorporation date cannot verify authority. Verify the person and their authority through an approved process.
2. Director identity verification binding
Verify the person acting for the business and bind that authority record to the company application. Test a person from another company and an expired authority record.
Pass: the server confirms the required authority for the same company before activation.
3. Unauthorized CAC data lookups via the fintech API
Call company search and director endpoints as a normal user and a lower staff role. Test rate limits and purpose logging.
Pass: approved roles receive the minimum fields needed for their task. Each lookup has a purpose and audit record.
4. TIN verification and tax compliance bypass
If the product requires a tax record, bind the verified record to the same company application. Test a record from another company and call activation without completing the check.
Pass: a missing, mismatched, or expired tax check cannot activate the account.
5. Beneficial ownership disclosure bypass
Use the ownership rule that applies to the product and customer. Test values around the configured threshold, split ownership, indirect ownership, and missing controllers.
Pass: the server applies the approved rule and blocks activation until each required owner is verified.
Evidence and pass rules
- Company binding: change the registration number after company lookup. Pass when the application rejects the mismatch and clears stale company data.
- Authority: verify a person who is not linked to the company record. Pass when onboarding stops before account activation.
- Cross-company reuse: reuse a director, TIN, address result, or lookup ID from another application. Pass when every record stays bound to one company and attempt.
- Step bypass: call approval and activation endpoints with missing or pending checks. Pass when the server rejects the request with no product access.
- Lookup access: use a normal user to query company and director data. Pass when role, purpose, rate limits, and audit logs control the lookup.
Keep the onboarding state map, redacted lookup responses, authority record, verification timestamps, activation logs, and database before-and-after values. Remove director identifiers and addresses from the final report.
Test the full business onboarding path before it opens an account or credit line.
Book a B2B KYC Security AuditFrequently asked questions
What data does the CAC company verification API return?
The exact fields depend on the approved data source and product. Treat company records and director data as sensitive. Keep only what the onboarding rule needs, restrict staff access, and redact personal data from test evidence.
What is business identity fraud using CAC data?
Business identity fraud using CAC data involves registering a company with a name closely resembling a legitimate company, using the legitimate company's CAC registration number in a verification API call, and then using the returned successful verification to open financial accounts or obtain credit in the name of the legitimate business. The attacker uses a real CAC number - belonging to a real company they do not own - to pass business KYC on a B2B fintech platform.
What compliance checks belong in a business KYC review?
Confirm the company’s legal existence, the person’s authority to act, required beneficial owners, source records, data retention, staff access, audit logs, and approval rule. The compliance team should map these checks to the current rules and licence conditions for the product.
Related reading
Blog: KYC and BVN data security · Business banking security audit · NIN verification API security
Services: Penetration testing · API security