_AY @devAyoooo

@zillionokoye @mar_leeq send boss

Weak KYC isn’t just a fintech problem. Imagine creating a completely fake restaurant on Glovo & Chowdeck using random tax ID, stolen photos and fake address and started receiving orders in days. This is the same “move fast, verify later” energy that gets platforms cut off when real money or safety is involved. Your jollof rice might be coming from a random guy’s kitchen with zero hygiene checks. Food safety?...Customer trust? all gone Platforms collecting millions in fees have no excuse for this level of verification failure. We saw what happened when neobanks had weak onboarding. History will repeat if they don’t fix this.

Techpoint Africa @TechpointAfrica

2 months ago

We created a fake restaurant on Glovo and Chowdeck using a made-up tax ID, a false address, and photos stolen from a real Lagos restaurant. Within a few weeks, we had a device, completed onboarding training, and made a sale. techpoint.africa/insight/invest…

171 1K 2K 2.2M 1K

If you're building a Nigerian fintech, these are the laws that govern you: • NDPA 2023 (data protection) • Cybercrimes Act 2015 (fraud, hacking, impersonation) • CBN Cybersecurity Framework (banking-specific controls) • NDPC regulations (breach reporting, consent) • PCI-DSS (if you touch card data) Most founders learn this after something goes wrong. Save this before that happens.

Good morning Techies

Things Nigerian universities should stop in CS departments. 1. Stop teaching FORTRAN, COBOL, and Pascal. It’s 98% useless. 2. Stop selling coding handbooks that’s for coding on paper. 3. Programming exams that involves coding shouldn’t be done on papers. 4. Expand JAVA

Techie to techie: Drop an advice for someone thinking of starting tech in 2026.

Traditional bank fraud response: – Freeze the account – Ask you to visit a branch – Give you a reference number – Call back in 5-7 working days Fintech fraud response: – Instant lock via app – Dispute raised in 2 taps – Funds reversed within 24 hours Same Nigeria. Completely different philosophy.

they don't know

DAMI FOREIGN🥶 @TheDamiForeign

2 months ago

Most of you don’t even know the main key to getting high payout on this app. No be by impression o😂

428 235 3K 77K 64

last last na everybody go chop breakfast

Developers who say "I don't do frontend" or "I don't do backend" are limiting themselves before the market even gets a chance to. The job doesn't care what you prefer. It cares what needs to get done.

If you’re in tech you should not concern yourself with anything romantic relationship. Distractions are bad for you.

The best backend engineers in Nigeria aren't at the big fintechs. They're at the telcos. MTN's USSD infrastructure handles concurrency that would crash most fintech backends on their best day. Nobody talks about this because telcos aren't sexy.

Moniepoint CEO: we need global standard engineers Also Moniepoint's job listing salary: "attractive and competitive" Attractive and competitive: ₦280k competitive to what ??

🙂‍↕️

This actually happened. The EFCC published an official statement. July 2025. Over 12,000 young Nigerians were caught running an organised identity fraud operation. They called themselves "Account Suppliers" and "KYC Group." Here is how the operation worked: They would approach ordinary Nigerians students, market traders, anyone and offer them between ₦1,500 and ₦2,000. In exchange, the person had to hand over their NIN slip, BVN, passport photograph, and address details. The canvassers then sold that complete identity package to fintech companies for ₦5,000 per person. Those identities were used to open accounts. Those accounts were used for investment scams, money laundering, and crypto purchases to clean the trail. 12,000 people. Nationwide operation. The EFCC called it a threat to national security. Now think about what this means for you as a developer building a fintech product. Your KYC passed. BVN verified. NIN verified. Face match passed. But the face on the BVN database was sold for ₦2,000 to a canvasser who sold it for ₦5,000 to someone opening a fraud account. Your system did everything right. And still let a fraudster in. This is why the strongest fintechs are moving beyond static document verification toward behavioral signals device fingerprinting, transaction velocity, network analysis, anomaly detection on new accounts. A stolen BVN passes a KYC check. It does not pass a system watching how the account actually behaves. Build for the reality of the market you are operating in.

This actually happened. It happens every day in Nigeria. NIBSS confirmed it accounts for 25% of all digital fraud attacks. Someone calls your network provider. They have your name. Your date of birth. Maybe your NIN bought from a data broker for as little as ₦5,000. They tell the customer care agent they lost their SIM. The agent processes the swap. Your phone goes silent. No signal. You assume it is a network issue. While you are waiting for bars to return they are resetting your banking passwords using OTPs sent to the number that is now theirs. By the time you realise what happened, the account is empty. This is SIM swap fraud. And Nigerian banks reported a 300% increase in cases between 2022 and 2024 according to NIBSS data. The reason it works so well here: Most Nigerian banking apps still use SMS OTP as the primary second factor. Which means control of your phone number equals control of your account. What you can do as a developer building financial products: • Never rely on SMS OTP alone for high-value transactions • Implement in-app authenticators as an alternative • Add device binding that flag logins from new devices immediately • Set transaction limits that require additional verification beyond OTP • Build anomaly detection.... a login from a new device immediately followed by a large transfer should never go through silently And as a user: • Set a SIM swap PIN with your network provider • Use an authenticator app where available • Never share your NIN, BVN, or date of birth in public giveaway forms The fraudster did not hack a server. All they did was to call a customer care line. That is how most of this actually works.

This actually happened. The EFCC published an official statement. July 2025. Over 12,000 young Nigerians were caught running an organised identity fraud operation. They called themselves "Account Suppliers" and "KYC Group." Here is how the operation worked: They would approach ordinary Nigerians students, market traders, anyone and offer them between ₦1,500 and ₦2,000. In exchange, the person had to hand over their NIN slip, BVN, passport photograph, and address details. The canvassers then sold that complete identity package to fintech companies for ₦5,000 per person. Those identities were used to open accounts. Those accounts were used for investment scams, money laundering, and crypto purchases to clean the trail. 12,000 people. Nationwide operation. The EFCC called it a threat to national security. Now think about what this means for you as a developer building a fintech product. Your KYC passed. BVN verified. NIN verified. Face match passed. But the face on the BVN database was sold for ₦2,000 to a canvasser who sold it for ₦5,000 to someone opening a fraud account. Your system did everything right. And still let a fraudster in. This is why the strongest fintechs are moving beyond static document verification toward behavioral signals device fingerprinting, transaction velocity, network analysis, anomaly detection on new accounts. A stolen BVN passes a KYC check. It does not pass a system watching how the account actually behaves. Build for the reality of the market you are operating in.

Interswitch, one of Africa's most established payment infrastructure companies lost ₦30 billion to chargeback fraud. Not from external hackers breaking through firewalls. From a system glitch that allowed merchants to file chargebacks and receive payouts they were not owed. Some of those merchants knew exactly what they were doing. The fraud was traced back to current and former Interswitch employees who understood the vulnerability in the system and exploited it quietly over several years. By the time it surfaced, Interswitch had to go to court, restrict accounts across 54 banks, report to the EFCC, and chase down hundreds of suspected accounts to recover what they could. They recovered roughly ₦10 billion but ₦20 billion gone. The lesson here is not about external threats. It is about insider access. Your most dangerous vulnerability is often not a hacker. It is someone inside your system who understands it better than your security does. Audit your access controls. Log everything. Nobody should have unchecked ability to trigger financial reversals without a second layer of authorization. Interswitch learned that lesson for ₦20 billion.

A Nigerian startup launched their app. Built a clean OTP flow. No rate limiting on the SMS endpoint. Shipped it. Within 48 hours, their Termii balance went from ₦150,000 to zero. They woke up to failed OTP delivery complaints from real users. Checked their logs. Someone had been hitting their /send-otp endpoint in a loop with thousands of requests sending SMS to sequential phone numbers that were not even their users. This is called SMS pumping fraud. Here is how it works: • Fraudsters find your open OTP endpoint • They send requests to thousands of phone numbers, sometimes numbers they control on premium routes • Every successful SMS costs you money • They get a cut from the carrier. You get the bill. It is automated. It runs while you sleep. The fixes that would have stopped it entirely: • Rate limit by IP: max 3 OTP requests per IP per hour • Rate limit by phone number: max 3 requests per number per 10 minutes • Add a minimum delay between requests • Implement CAPTCHA or device fingerprinting on the frontend • Alert yourself when SMS spend spikes above a threshold None of this is complicated. All of it takes less than a day to implement. That startup lost ₦150,000 in two days and had to shut down OTP entirely while they fixed it. Their users thought the app was broken. Some never came back. The breach was not dramatic. No hacker. No sophisticated attack. Just an open endpoint and a bot. Secure your OTP flow before you launch. Not after you've learned the hard way.

This actually happened. TechCabal. Techpoint. October 2023. Fidelity Bank woke up one morning and blocked transfers to OPay, PalmPay, Moniepoint, and Kuda. Just like that. Millions of Nigerians who depended on those platforms for daily transactions — blocked. No prior announcement. Their bank simply refused to send money to their neobank accounts. Fidelity's reason: the neobanks' KYC processes were too weak. Fraudsters were using neobank wallets to receive and move stolen funds because the onboarding checks were not tight enough. Wema Bank had already done the same thing earlier...in which they removed seven fintechs from its payment gateway entirely. This is what happens when your compliance is not taken seriously. It is not just the regulators who come for you. Other financial institutions stop trusting your platform. They cut you off from their customers. And their customers who also happen to be your users suffer in the middle. The CBN eventually responded. December 2023: mandatory BVN or NIN for every Tier 1 account. No exceptions. But between the loopholes being exploited and the regulation arriving, billions moved through accounts that should never have been opened. In fintech, your KYC is not just a compliance checkbox. It is your reputation with every bank in the ecosystem. Weak KYC does not just expose your users. It gets you cut off from the rails you depend on to function.