We wish to state that the allegations are dated and have been resolved in collaboration with all relevant stakeholders,” the company noted.
In many of the fraud cases, hackers connected to banks through an insider who showed them where the loopholes were. The hackers also exploited the financial institution’s interbank services and moved money out. Some stakeholders also told BusinessDay that while the hackers routed funds through a couple of funds, a large portion of the funds allegedly went to platforms such as OPay and from there they moved the money out via agents as cash across hundreds of touch-points.
BusinessDay asked OPay why the delays in addressing the complaints from the affected institutions. In a statement, the company said there is a CBN-prescribed procedure for recovering funds backed by different regulations and judicial authorities. It is in the bid to follow the process that the delays occur. The process of funds recovery is not automatic and many industry players have found themselves on the wrong side of the law for either extending a restriction beyond the period required by law or proceeding to deduct funds without due process.
Adekunle Adeyemi, head of marketing at OPay Digital Services Limited, said as soon the company gets a fraud report, mostly from another bank or financial institution, the first action it takes is to restrict the account (or lien the amount involved – depending on the circumstances of the case).
“Although not straight cut, we maintain the restriction while the bank/FI or customer obtains a court order. This court order empowers us to do any of the following: maintain the restriction, extend the restriction for a longer period, perform deductions/reversals, or other similar actions. A common occurrence is that these complainants do not come back to us within the allowable period, or sometimes attempt to mount pressure on us to reverse funds to them outside of the laid-down procedure. Insisting on due process or averting their minds to the proper procedure may sometimes seem like we are uncooperative. But as you would understand, with great power comes great responsibility,” Adeyemi said.
OPay will not immediately perform reversals based on a report from a third party on an account. Also, the company contacts the account owner to obtain proof of the legitimacy of the transaction or a court order to lift the restriction.
“There are also instances where different law enforcement agencies investigate a single account, or there are numerous reports. We currently have the largest customer base in the industry; therefore, you will understand that we receive a higher volume of reports and deal with a higher volume than others. It is therefore not always a walk in the park, and this process requires sensitively and carefully navigating the circumstances of each case, whilst preventing fraud or stopping fraudsters from benefiting from the proceeds of fraud, and also keeping to the legal provisions which govern our operations,” Adeyemi said.
Simon Aderinlola, an agent network specialist and one of the drivers of antifraud governance in Nigeria, told BusinessDay that for financial fraud to happen, there is usually either collusion by negligence or by intent.
“There are user experience and positively far-reaching inclusion benefits in simplifying digital onboarding as some digital banks and fast-growing fintechs have done. The lower the barriers to entry, the stronger the KYC filters need to be, lest our product design becomes a foot in the door for bad actors,” said Aderinlola.
Hackers are also on the lookout for operators under pressure to meet shareholder expectations. According to Aderinlola, aggressive shareholder expectations may also push some providers to prioritise profits over necessary guardrails, at times silencing recommendations of their risk and compliance professionals.
Experts say the operators are likely to report fraud cases more should the CBN consider a different approach instead of sanctions. The apex bank has different sanctions for erring banks and payment service providers for infringements of extant guidelines, circulars, rules, and regulations. For example, card fraud that exceeds the limit set on the card by the cardholder will see the bank paying the full amount involved.
Tiwalola Osazuwa, partner in the corporate and commercial, intellectual property and mergers and acquisition practice groups at Aelex, told BusinessDay that the CBN needs to explore collaboration in resolving issues of fraud except in cases where the banks involved did not deliberately neglect to follow the guidelines.
An industry stakeholder who pleaded anonymity told BusinessDay that regulators are trying to resolve the fraud problem, but they are also being careful because of policy and customer rights.
“It’s not working because everyone is not collaborating or working together. Someone wants to take the shine or media limelight and the fraudsters are capitalising on this,” the stakeholder said.
A way out, he said, could be by establishing a strong dispute system where banks and financial institutions can refund stolen funds received when they cannot show evidence of CBN-level KYC for customers who receive funds. Banks can also pause or put ‘Post No Debit’ on accounts that receive sudden inflows until the owners can prove legitimacy. This is part of customer due diligence and KYC requirements that Nigerian and global banks are expected to provide
