Let's be honest—by the time you finish reading this, someone somewhere has probably already sent a fake bank alert to another person's phone. That's just how it is these days. The internet has become part of our daily life: we're buying data, sending money through Opay and Palmpay, checking results, applying for jobs, chatting on WhatsApp, and hustling online. But the same way we lock our doors at night is the same way we need to lock our digital lives.
And no, this is not about being paranoid. It's just about being street-smart—except this time, the street is online.
Why We Are the Main Target
Scammers today are not only going after big companies. They know that the average person is easier to reach and easier to fool. Think about it: one person's BVN, one person's bank details, one person's WhatsApp account—that's money. And with just a small amount of information, a fraudster can clean out an account, borrow money from your contacts in your name, or open accounts you know nothing about.
The truth is, most of these people are not genius hackers. They are just patient. They rely on one thing: that you will be in a hurry, or tired, or too trusting. Once you understand that, you're already ahead.
The Tricks You'll Likely See
Fake bank alerts and "I sent the money" messages. Someone buys something from you on Facebook Marketplace or Jiji, then sends you a fake credit alert screenshot. Next thing, they're asking you to release the goods or send back "the excess." By the time you check your real balance, nothing has entered.
Fake job and scholarship offers. "Congratulations! You have been selected for a job at NNPC. Pay ₦15,000 for registration." Or a fake scholarship link asking for your details. If you have to pay to get a job, it's a scam. Full stop.
Phishing links on WhatsApp and SMS. "Your BVN has been linked to fraud, click here to verify." Or "Your parcel is on hold, pay ₦500 to release it." These links take you to fake websites that look exactly like your bank's page. Once you type your details, you've handed them over.
Fake OTP calls. Someone calls you pretending to be from your bank, saying there's a problem with your account, and asks you to read out the OTP sent to your phone. That OTP is the key to your money. No bank will ever ask you for it. Never.
Romantic scams and "urgent" requests from friends. A "friend" or "partner" you met online suddenly needs money urgently. Or your actual friend's account has been hacked and the person is now asking your contacts for a loan in your name.
Fake investment schemes and "double your money" platforms. Ponzi schemes dressed up as crypto or forex. They pay small amounts at first to gain your trust, then disappear with the big money.
Fake apps and APKs. That "free" version of a paid app or a betting app from a random link can carry malware that steals your details or empties your account quietly.
The WhatsApp and Facebook Hacked Epidemic
If you've been on WhatsApp or Facebook lately, you've probably seen it: a friend's account suddenly messaging everyone on their contact list, asking for money, or sending a strange link with "Is this you in this photo?" That's not your friend. That's a hacker using their account.
This epidemic is real, and it's spreading fast across Nigeria. In the first quarter of 2026 alone, Nigeria recorded over 82,000 compromised social media accounts—a 46% increase from the previous quarter. Over 9 million Nigerian WhatsApp numbers have reportedly been leaked and sold on the dark web. WhatsApp and Facebook are the two most targeted platforms because that's where we live online.
But here's the good news: most of these hacks don't happen through some sophisticated Hollywood-style hacking. They happen because someone was tricked into handing over access. That means you can protect yourself.
How the Hackers Actually Get In
The "I sent you an OTP by mistake" trick. This is the number one method in Nigeria right now. You get a message from a friend (whose account is already hacked). They say something like, "Abeg, I mistakenly sent my verification code to your number. Send it to me." Or they claim they're having trouble with a "Zoom meeting code." That code they're asking for? It's YOUR WhatsApp verification code, triggered when the hacker tried to register your number on their device. The moment you send it, you're locked out of your own account.
Fake job and money-making offers on TikTok and Instagram. Scammers are using TikTok videos in Nigerian languages promising easy money on WhatsApp. They lure you into a WhatsApp "training group" and then ask you to share your verification code or scan a QR code as part of the "registration." Some even pay you small amounts—₦12,000 in one case—before they take over your account and use it to scam your contacts.
The "Is this you?" photo link. You receive a message with a link saying someone posted an embarrassing photo of you. The link takes you to a fake Facebook page that asks you to "verify" by entering your phone number. That's actually the WhatsApp device-linking page. Once you enter your number and the code, the hacker is in.
Fake free data and airtime promotions. NCC-CSIRT has warned about campaigns offering "10GB free data and ₦5,000 airtime" in exchange for your phone number and sharing the link to WhatsApp contacts. It's a phishing trap designed to harvest numbers and spread itself.
The "Urgent Money" Hack: How It Actually Unfolds
The Delta State Police Command recently warned about this exact pattern, and they described it in detail. Here's how it typically goes:
Step 1: The Familiar Greeting. You get a message from a friend or family member's WhatsApp. It starts normally: "Good morning, how was your night?" They chat casually for a bit to lower your guard. This is deliberate. The hacker has taken over the account and is now impersonating someone you trust.
Step 2: The Emergency Story. Then comes the request. The most common script is something like: "Please, I need your assistance. I'm trying to send money to someone but my network is bad. Can you help me send it to this account? I'll send it back to you once my network comes back."
Sometimes it's framed as a medical emergency, a stranded relative, or a business deal that needs urgent funding. The key ingredient is urgency. They don't want you to think. They want you to act.
Step 3: The Wrong Account Name. Here's where the red flag should scream. When they send you the account details, the name on that account is not your friend's name. It's a stranger's account—often an Opay, Palmpay, or Moniepoint account opened specifically for fraud. When you question it, they'll make excuses: "Oh, that's my cousin's account" or "My own account is having issues." Sometimes, if you push too hard, they'll get aggressive or just delete the messages.
The One Rule That Protects You
Never send money to an account that doesn't bear the name of the person you believe you're chatting with. Not even if it's an Opay or Palmpay bearing their name—we advise sticking to conventional bank accounts where the name is clearly visible and verifiable.
But even more important: Call the person directly. Not on WhatsApp. Use their actual phone number. If they don't pick up, call someone close to them. This is the only way to be absolutely sure you're not talking to a hacker.
Simple Things That Will Save You
1. Slow down. No rush. Scammers survive on urgency. The moment someone is pressuring you to act now, that's your sign to pause. Real banks, real employers, real customers—none of them will force you to act within five minutes.
2. Check your actual bank app or USSD, not screenshots. Never trust an alert screenshot. Open your banking app or dial your bank's USSD code and confirm with your own eyes. If the money no dey, the money no dey.
3. Verify with a phone call, not a reply. If your "friend" asks for money on WhatsApp, call them. If a "bank" sends a message, call the number on the back of your card. Don't reply to the message or use the number inside it.
4. Guard your OTP and PIN like your life. No bank official, no customer care, no "agent" should ever ask for your OTP, PIN, or CVV. If they do, it's a scam. End the call.
5. Use different passwords for different accounts. I know it's stressful to remember plenty passwords. That's why password managers exist. Or use a pattern only you understand. But never use the same password for your bank and your social media.
6. Turn on two-factor authentication (2FA). That extra code or fingerprint check can be the difference between someone trying and someone succeeding. Use an authenticator app where possible instead of SMS.
7. Enable Two-Step Verification on WhatsApp immediately. This is the single most important thing you can do. It adds a PIN that only you know. Even if a hacker gets your verification code, they can't register your number without that PIN. Go to Settings > Account > Two-Step Verification > Enable. Choose a PIN you'll remember, and add a recovery email so you're not locked out if you forget it. The NCC has specifically recommended this to all Nigerian WhatsApp users.
8. Check your Linked Devices regularly. Hackers can add your account to their device through WhatsApp Web without you even knowing. Go to Settings > Linked Devices and look for anything you don't recognize. If you see a device you didn't link, log it out immediately.
9. Secure your Facebook with more than just a password. Passwords get stolen. Turn on two-factor authentication using an authenticator app like Google Authenticator instead of SMS (SMS can be intercepted through SIM swap fraud). Also check Settings > Security and Login > Where You're Logged In and remove any unfamiliar sessions. While you're at it, review which third-party apps have access to your Facebook and remove anything you don't use anymore.
10. Don't do serious banking on public Wi-Fi. Free Wi-Fi for browsing is fine. But logging into your bank account in a crowded café or at the airport? Better to use your data.
11. Be careful what you post online. Your date of birth, your mother's maiden name, your pet's name, your school—these are the answers to your security questions. Don't scatter them for free on Facebook and Instagram.
12. Update your phone and apps. Yes, those updates can be annoying, especially with our data prices. But they fix security holes. Try to do them when you're on Wi-Fi.
13. Back up your important files. Ransomware is real. If your phone or laptop gets locked, at least you won't lose everything.
14. Talk to your people. Warn your parents, your younger siblings, your aunties who just joined Facebook. A lot of older people are falling for these scams because nobody explained it to them in a way they understand.
What to Do If You've Already Sent Money
If you've transferred money before realizing it was a scam:
1. Report to your bank immediately. Ask them to flag the receiving account and initiate a recall if possible.
2. Report the receiving account to your mobile money provider (Opay, Palmpay, Moniepoint, etc.). They can freeze or investigate the account.
3. Warn your contacts. If the hacker is using a friend's account, tell everyone you know not to send money to that account.
4. Report to the police. The Nigeria Police Force's National Cybercrime Centre has been actively dismantling these syndicates and recovering funds. A formal report helps them track the network.
It's a Mindset, Not Just a List
At the end of the day, staying safe online is not about being a tech guru. It's about carrying the same sense of caution you use in real life onto the internet. In the same way you wouldn't follow a stranger into an unlit street at night, don't follow strange links, don't send money to strangers, and don't hand over your details just because someone sounded convincing.
The hacker is counting on your kindness and your trust. They're betting that you'll be too polite to question a friend, or too panicked by the "emergency" to think clearly. The simple act of calling to verify breaks the entire scam.
Ask yourself: Who is really asking? Why now? Wetin dem want? Most scams collapse the moment you ask those three questions before you act.
The internet is a good place—it's where we hustle, learn, connect, and grow. But like every market, there are pickpockets. Stay alert, stay skeptical, and protect yourself and your people. Because in this digital Lagos—sorry, digital world—the person who is careful is the person who keeps their money.
No rush. Verify. Confirm. Stay safe.