Nigeria Data Protection Commission (NDPC) has launched investigation into the activities of so-called ‘sharp sharp’ loan operators over alleged violations of customers’ data privacy.

‘Sharp sharp’ loan operators, also known as loan sharks are illegal, unlicensed moneylenders who operate outside of government regulation.

They typically target individuals who cannot access traditional bank loans due to low income or poor credit history.

Vincent Olatunji, national commissioner of the Nigeria Data Protection Commission, told the News Agency of Nigeria, that some of the violations include accessing borrowers’ phone contact lists and using them to reach their family members and friends, as well as sharing images without consent and sending defamatory or threatening messages.

Olatunji, who spoke on the sidelines of a training for Data Protection Officers in Abuja, said the federal government was aware of some lenders breaching customers’ data privacy in their desperate bid to recover loans.

He emphasised the need for increased public awareness, urging Nigerians to understand their rights and carefully review loan agreements before accepting offers.

Olatunji, however, said unethical data practices by loan operators remained a global concern.

“Many borrowers unknowingly expose their personal data due to failure to read loan agreements. This is not peculiar to Nigeria; it is common in every part of the world.

“Unfortunately, most of the information are from those who obtained loans without going through the agreement they signed before accessing the loans.

“Many operators function solely online, without physical offices. This makes regulations more complex. However, compliance with data protection laws remains mandatory.

“Before any digital loan giver operates in Nigeria, it is mandatory to look at the areas of privacy,” he said.

Olatunji said that Nigeria had several consumer protection entities such as the Federal Competition and Consumer Protection Commission, which takes the lead on consumer protection.

The NDPC boss listed other key agencies involved in regulating the space to include the National Information Technology Development Agency (NITDA), the Nigerian Communications Commission (NCC), the Central Bank of Nigeria (CBN), and the Nigeria Police.

He said that any digital lender must obtain approval and licensing from the FCCPC, with strict requirements to uphold user privacy.

“Part of the requirements is to ensure provisions around privacy are complied with so that they do not infringe on the rights of their customers.

“Any unauthorised access to people’s contacts is an offence and we will come after them,” he warned.

Ola Olukoyede, executive chairman, Economic and Financial Crimes Commission (EFCC), has cautioned Nigerian banks against granting loans without credible collateral, warning that such practices often lead to insider abuse and non-performing loans.

Olukoyede issued the warning recently when he received Mufutau Olawale Abiola, chief audit executive, First Bank Plc, who led a delegation on a courtesy visit to the Lagos Zonal Directorate 2 of the Commission in Ikoyi.

Speaking through  Bawa Usman Kaltungo, acting zonal director, Lagos Zonal Directorate 2, Ikoyi,  Olukoyede expressed grave concerns over how banks in the country grant loans, noting that loans backed only by personal guarantees, including those of top executives, are inadequate and put depositors’ funds at risk.

He said: “We have issues with banks’ mode of giving loans. The process often shows insider abuse.”

While emphasizing that banks should desist from issuing loans without visible or credible collateral, he added that “Top-down loans are not secured. You cannot give a loan based solely on the personal guarantee of the Chief Executive.

This is not security. Banks must not issue loans without verifiable collateral. If there is proper collateral for loans obtained by bank customers, this will reduce the rate of non-performing loans.”

He further warned that a bank is only a custodian, and that giving loans without adequate collateral “amounts to tampering with depositors’ funds.”

He also urged banks to implement measures, including thorough due diligence on its customers, to prevent loan defaults.

According to him, “Even in situations where you outsource due diligence, there must be a clause of liability,” he said.

Reaffirming the Commission’s commitment to continued cooperation with the bank in tackling financial crimes, he urged the bank to release its staff promptly when invited during investigations of alleged financial crimes.

“When we invite your staff, especially where insider connivance is suspected, you must release them so we can jointly fight economic and financial crimes. We must work together to stay ahead of criminals. Let me add that where money is, that is where people’s hearts are. Most of the time, we escalate issues to foreign security agencies as may be necessary,” he added.

Earlier, Abiola expressed gratitude to the EFCC leadership for the engagement, noting that the visit was intended to strengthen the existing collaboration between the bank and the Commission.

While urging the EFCC to expedite investigations into cases involving its staff and others, Abiola also disclosed that a designated team in his bank handles requests from the EFCC.

More than one million online banking accounts were compromised by infostealers last year, as financial cyberthreats shifted toward credential theft and data reuse.

Pic credit…cybelangel.com

Attackers are moving away from traditional PC banking malware and increasingly relying on social engineering and dark web marketplaces, while mobile financial malware continues to grow.

Detailed information on current financial cyberthreat trends is available in Kaspersky’s new report.

These digital “pickpockets” often exfiltrate data and remove themselves within seconds, making them difficult to detect.

They are a primary source of initial access for ransomware and identity theft

Traditional financial phishing has not gone away. Pages that mimicked e-shops dominated the financial phishing landscape (48.5% in 2025, up 10.3% from 2024), followed by banks (26.1% in 2025, down by 16.5% from 2024) and payment systems (25.5% in 2025, up by 6.2% from 2024). The decline in bank phishing may suggest that these services are becoming increasingly difficult to successfully impersonate, and fraudsters are turning to easier ways to access users’ finances.

Attackers are adapting campaigns to regional digital habits. In the Middle East, financial phishing is overwhelmingly concentrated on e-commerce (85.8%), indicating a heavy reliance on online retail lures, whereas in Africa bank-related phishing leads (53.75%), which may indicate that user account security there is still insufficient. Latin America shows a more balanced distribution but with a higher share of e-commerce and bank targeting, while APAC and Europe display a more even spread across all three categories, pointing to diversified attack strategies.

In 2025, the decline in users affected by financial PC malware continued as users increasingly rely on mobile devices to manage their finances. Contrary to PC banking malware, mobile banker attacks grew by 1.5 times in 2025 compared to the previous year.

Complementing traditional financial malware, infostealers played a significant role in enabling financial crime both on PCs and mobile devices by harvesting login credentials, cookies, bank card numbers, crypto wallet seed phrases, and autofill data from browsers and applications, which attackers then used for account takeovers or direct banking fraud. Kaspersky data pointed to a surge in infostealer detections (up by 59% globally, 53% in Africa and 26% in the Middle East, on PCs from 2024 to 2025), fueling credential-based attacks.

According to Kaspersky Digital Footprint Intelligence (DFI), in 2025 over one million online banking accounts served by the world’s 100 largest banks fell victim to infostealers: credentials for these accounts were being freely shared on the dark web. The countries with the highest median number of compromised accounts per bank were India, Spain, and Brazil.

74% of payment cards that were compromised by infostealer malware, published on dark web resources and identified by Kaspersky DFI team in 2025, remained valid as of March 2026. This means that attackers could still use cards that had been stolen months or even years prior.

“The dark web has become a central hub for financial cybercrime. Stolen credentials and bank cards that have been harvested by infostealers are aggregated, repackaged, and sold there, while phishing kits targeted at users of financial products are offered as ready-to-use services.

This creates a self-sustaining ecosystem where data theft and fraud operations reinforce each other, making attacks scalable and easy to carry out by fraudsters with minimal experience. Breaking this cycle requires proactive threat intelligence on the part of organisations, and increased awareness and scrutiny from individual users,” comments Polina Tretyak, Kaspersky Digital Footprint Intelligence analyst.