Malik Lawal’s father was travelling to Akure with his phone in his pocket when N25 million vanished from his Wema Bank account in under ten minutes. No OTP. No confirmation. No warning. Just a string of debit alerts pushing funds in tranches of ₦4.5m, ₦4.2m, and more into a single account labeled “Gumel Provision Store” in Kano. By the time the 51-year-old contractor realized what was happening, the money meant for an Ekiti building project was gone, and Wema Bank’s response had shifted from acknowledgment to silence.
This is not an isolated incident. It is the latest evidence of a systemic porosity that has turned Wema Bank’s digital channels into an open gate for cybercriminals. The pattern is disturbingly familiar: funds drained in rapid succession, sent to a single beneficiary account, without the customer’s authorization or device compromise. Aremu insists he never shared his phone or card details beyond a petrol station transaction two days earlier. That means either his card data was harvested and reused, or the bank’s transaction authorization system failed to enforce basic security protocols. Either way, the bank’s controls collapsed at the point where they matter most.
What makes the case more damning is the speed and structure of the theft. The debits came through as transfers, not card payments, suggesting that whoever accessed the account bypassed two-factor authentication entirely. In a properly secured system, multiple high-value transfers within minutes should trigger real-time fraud alerts, transaction holds, or at minimum, an OTP challenge. None of that happened. Instead, the money flowed uninterrupted until the balance was emptied, and the victim was left to discover the breach himself while on the road. The fact that the recipient account remains traceable to a physical store in Kano also raises questions about Wema Bank’s onboarding and KYC checks. How does an account receive ₦25m in minutes without raising red flags?
Wema Bank’s institutional response has been equally porous. After being tagged on X, the bank’s customer care representative reached out via DM and asked for details, which FIJ provided at 12:07 pm. At press time, there had been no substantive follow-up or refund commitment. This silence echoes another case cited in the same report: a graphic designer who lost ₦61,000 a year ago and is still waiting for resolution. It mirrors a comment from another user whose funds have been missing since November 2025. The pattern is not just technical failure, but procedural abandonment. The bank’s first reaction is engagement; its last is muteness.
The implications go beyond one customer’s loss. Wema Bank markets itself as ALAT, Nigeria’s pioneer digital bank — a brand built on speed, convenience, and tech-forward banking. But speed without security is a liability, and convenience without accountability becomes a trap. When customers cannot trust that high-value transfers will be flagged or that their funds are protected without OTP verification, the entire digital banking proposition collapses. For a contractor like Aremu, whose ₦25m was not personal savings but contract money for workers, suppliers, and materials, the breach threatens livelihoods far beyond his own. He now faces the prospect of explaining to clients why their project funds disappeared, through no fault of his own.
There is also a regulatory dimension that Wema Bank cannot ignore. The Central Bank of Nigeria’s Consumer Protection Framework places responsibility on banks to ensure robust fraud detection and timely restitution for unauthorized transactions. If a bank allows multiple large transfers without OTP or verification, it is not just a cybersecurity lapse but a compliance failure. Yet the recurrence of similar complaints against Wema Bank suggests that enforcement and internal remediation are either slow or ineffective.
The case of “Gumel Provision Store” further exposes the weakness in interbank fraud tracing. Despite the beneficiary account being identifiable and located in Kano, the money was gone within minutes. That points to a broader problem in Nigeria’s banking ecosystem: real-time transfers happen instantly, but real-time freezes do not. Once funds leave the account, recovery depends on the cooperation of the recipient bank and the speed of the victim’s report — both of which are often too slow to matter.
For customers, the lesson is stark: your money is only as safe as the weakest link in the bank’s security chain. For Wema Bank, the lesson should be more urgent. Digital banking is not just about sleek apps and onboarding convenience. It is about building a system that can detect anomalies, halt suspicious transactions, and respond transparently when breaches occur. Right now, Wema Bank is failing on all three.
Until the bank addresses these vulnerabilities with more than customer care DMs and holding statements, it will continue to be perceived not as a fintech innovator but as a porous vault where cyberthieves can withdraw millions with minimal friction. In that scenario, the real risk is not just to individual account holders but to public trust in Nigeria’s entire digital banking infrastructure.
