OPay and PalmPay accounts are being fraudulently opened using the identities of unsuspecting individuals. Recent incidents across Nigeria confirm that you can open OPay or PalmPay accounts with anybody’s name, and we may have found out how.
Firstly, let’s get some context.
I’ve been seeing glimpses of this issue but could not confirm until my elderly neighbour fell victim. Her phone was stolen and fraudsters hijacked her identity, siphoning over ₦100,000 from her friends using OPay accounts created with her full legal name.
Initially, we were confused. How could accounts bearing her full legal name be opened without her Bank Verification Number (BVN) or National Identity Number (NIN)? While OPay promptly blocked the fraudulent accounts when we notified them, they remained silent on how such a breach could occur in the first place.
OPay and PalmPay accounts are being fraudulently opened using the identities of unsuspecting individuals. Recent incidents across Nigeria confirm that you can open OPay or PalmPay accounts with anybody’s name, and we may have found out how.
Firstly, let’s get some context.
I’ve been seeing glimpses of this issue but could not confirm until my elderly neighbour fell victim. Her phone was stolen and fraudsters hijacked her identity, siphoning over ₦100,000 from her friends using OPay accounts created with her full legal name.
Initially, we were confused. How could accounts bearing her full legal name be opened without her Bank Verification Number (BVN) or National Identity Number (NIN)? While OPay promptly blocked the fraudulent accounts when we notified them, they remained silent on how such a breach could occur in the first place.
Advertisement
Things were about to get even weirder.
The scam escalated, targeting high-profile individuals like tech CEOs like Adewale Yusuf of AltSchool Africa and Techpoint Africa, Dr Neto Ikpeme of Wellahealth, and Abimbola Adebakin of Advantage Health Africa. I too received a fraudulent message, ostensibly from Adewale Yusuf, requesting urgent funds through OPay and PalmPay accounts.
How is this happening?
Our investigation unveiled a disturbing loophole in OPay’s account creation process.
Besides the standard NIN/BVN verification, OPay offers a third, laxer method — Verify with bank account. This backdoor permits fraudsters to easily manipulate the system using just a phone number, facial recognition, and any name and address, facilitating identity theft with alarming ease.
We saw a video circulating online of someone opening an OPay account with the name of popular actress, Bimbo Ademoye. We decided to test this, and I seamlessly opened an OPay account with a friend’s phone number and my commercial bank account details. Even though I already have an OPay account with my BVN details.
If you’ve dropped your account number anywhere on the Internet, for giveaways or a business transaction, you might already be at risk of this loophole.
PalmPay, also has this “verify with bank accounts” feature, but it didn’t work when we tried it. Surprisingly, you can open a PalmPay account with any name without any verification whatsoever. This allows you perform up to ₦50,000 in transactions.
Wider implications
These incidents are symptomatic of a growing financial fraud epidemic in Nigeria, with banks and individuals losing billions of Naira. The NIBSS has raised concerns over unlicensed financial services companies masquerading as deposit-taking institutions, reflecting increased regulatory scrutiny over fintech operations.
While the CBN has mandated the use of NIN for all tier 1 wallets and bank accounts, the effectiveness of these measures remains to be seen.
The rise of digital payments has unfortunately increased the potential for fraud, as highlighted by PalmPay. Late reporting of fraud has been cited as a key factor in the low recovery of stolen funds. In a separate incident, a man was charged for using someone else’s identity to open accounts with OPay, PalmPay, and other online banks, defrauding the victim of ₦771,000.
As this investigation into the fraudulent activities involving OPay and PalmPay unfolds, a crucial question lingers: Is the Central Bank of Nigeria (CBN) aware of these specific vulnerabilities, and if so, what actions are being taken?
TechPoint
