“Good afternoon, this is your bank. Your BVN has been blocked. To reactivate it, please read out the OTP we just sent you.” It sounds official. The caller even knows your name and the last four digits of your card. Many Nigerians lose hard-earned money to calls and messages like this. Here’s how to spot them, and what to do if it happens to you.
The best protection against online scams is a few simple rules: never share your PIN, OTP, password or full card details with anyone; verify requests independently using official contact details; turn on two-factor authentication; and be suspicious of urgency, pressure or offers that seem too good to be true. Most scams rely on tricking you, not on hacking technology.
Key takeaways
- Your bank will never ask for your PIN, OTP, password or full card details by phone, SMS, email or WhatsApp.
- Urgency and secrecy are major red flags.
- Use strong, unique passwords and two-factor authentication on email, banking and social media.
- If you are scammed, contact your bank immediately and report it.
Common online scams in Nigeria
1. Impersonation and OTP scams
Scammers pose as bank staff, telecom agents or officials and claim your account or BVN needs “updating” or has been “blocked”. They then ask for your OTP, PIN or card details.
2. Fake bank alerts
A “buyer” sends a fake credit SMS or screenshot and rushes you to release goods. Always confirm in your banking app or statement, not through SMS alone.
3. Investment and Ponzi schemes
These promise high, “guaranteed” returns, often in crypto, forex or “agric”, and pay early investors with new investors’ money until they collapse. Check whether any investment platform is registered with the SEC Nigeria.
4. Job and scholarship scams
Fake recruiters ask for “processing”, “training” or visa fees. Legitimate employers don’t charge candidates to get hired.
5. Phishing links
Messages that look like they come from banks, delivery companies or social media platforms lead to fake login pages that steal your password.
6. Social media account takeover
Hackers take over accounts and message your contacts asking for urgent money, or “verification codes” that let them hijack the next account.
7. Romance scams
Fraudsters build online relationships over weeks, then ask for money for emergencies, travel or investments.
Red flags to watch for
- Pressure to act immediately.
- Requests to keep things secret.
- Offers that are too good to be true.
- Spelling errors, odd email addresses or links that don’t match the official website.
- Requests for payment via gift cards, crypto or personal accounts.
10 steps to protect yourself
- Never share your PIN, OTP, password or CVV.
- Enable two-factor authentication (2FA) on email, WhatsApp, social media and banking.
- Use strong, unique passwords, ideally with a password manager.
- Verify requests by calling official numbers from the bank’s website or card, not numbers in the message.
- Type website addresses yourself rather than clicking links.
- Set transaction limits and alerts in your banking app.
- Keep your phone and apps updated.
- Be careful on public Wi-Fi. Avoid banking on unknown networks.
- Protect your SIM. Contact your network provider immediately if your line suddenly stops working, as this could be a SIM swap.
- Talk to older relatives about common scams. They are often targeted.
What to do if you’ve been scammed
- Contact your bank immediately to block cards or accounts and try to stop or trace transactions.
- Change your passwords and secure your email first.
- Report the incident to the police and to the Economic and Financial Crimes Commission (EFCC).
- Warn your contacts if your social media was compromised.
- Keep evidence: screenshots, account numbers and messages.
Try this this week
Today, turn on two-factor authentication for your email, WhatsApp and main social media accounts, and set transaction limits in your banking app. Then send the red-flags list above to your parents or an older relative. Scammers often target them first.
Frequently asked questions
Can my bank refund money lost to scams?
It depends on the circumstances and how quickly you report it. Contact your bank immediately. Delays reduce the chance of recovery.
Is two-factor authentication really necessary?
Yes. It is one of the most effective ways to prevent account takeovers, even if your password is stolen.
Related reading
- Online privacy and your rights under the NDPA
- How to build an emergency fund
- AI scams in Nigeria: cloned voices and deepfakes
- How to spot fake job offers in Nigeria
Sources
- Economic and Financial Crimes Commission. Official website.
- Securities and Exchange Commission Nigeria. Official website.
- Central Bank of Nigeria. Official website.
Written and fact-checked by the Mindset.ng Editorial Team in line with our Editorial Policy. Last updated: 23 September 2026.
