Hackers have hit the database of Zenith Bank, one of Nigeria’s largest financial institutions, stealing customers’ information.

Zenith confirmed the attack in an email to customers on Tuesday.

The bank said the hackers accessed limited customer information, “including email addresses and phone numbers, during a cyberattack that forms part of a broader global attack on organisations across different sectors”.

The lender stressed that the incident involved only limited customer information, adding that its banking services and digital channels remain secure and fully operational.

The bank said it is investigating the attack, noting that its incident response protocols and other cybersecurity measures were immediately activated after the breach was discovered.

Advertisement

“As a precaution, we encourage our customers to remain vigilant against phishing emails, text messages, or phone calls, and to never disclose their password, PIN, One-Time Password (OTP), or other security credentials to anyone,” the bank said.

Zenith Bank said it remains committed to protecting customers’ information and thanked them for their continued trust, adding that investigations into the incident are ongoing.

In August 2024, Guaranty Trust Bank (GTB) reported experiencing a similar incident.

The commercial bank said there were attempts to compromise its website domain, but customers’ data was not affected.

The latest attack comes months after the Central Bank of Nigeria (CBN) warned the public of cyber hack attempts to gain access to personal accounts of Nigerians.

Advertisement

The CBN said the hackers were circulating fraudulent messages and emails falsely claiming to originate from the bank.

According to the financial regulator, there were misleading messages circulating, designed to deceive Nigerians and compromise their personal information.

The regulator said the fake communications, which include emails and online messages, often prompt recipients to click suspicious links while spreading false claims about the bank’s leadership, licensing activities, and policy decisions.

Nigerians lost N25.85 billion to digital payment fraud in 2025, according to Central Bank of Nigeria (CBN).

Though the figure represents a significant decline from the N52.26 billion recorded in 2024, CBN, said the losses remained substantial for payment service providers (PSPs).

According to the report, although the value of digital payment fraud declined significantly year-on-year, when compared to the N52.26 billion recorded in the previous year, the losses remained substantial for Payment Service Providers (PSPs), underscoring the need for stronger fraud prevention measures across the industry.

In the report, the CBN, also identified systemic risks, cyber threats, the dominance of a few systemically important payment service providers, and the activities of unlicensed payment companies as major concerns confronting the financial sector.

According to the report, although the value of digital payment fraud declined significantly year-on-year, the losses remained substantial for Payment Service Providers (PSPs), underscoring the need for stronger fraud prevention measures across the industry.

Advertisement

“Digital payment fraud in Nigeria stood at N25.85 billion in 2025,” the apex bank said.

It noted that while this represented a considerable improvement from the N52.26 billion lost in 2024, the amount remained significant.

“Though this was lower than N52.26 billion in the preceding year, it represented a substantial loss for PSPs,” the report stated.

The CBN attributed the reduction in fraud losses to enhanced security measures implemented across the financial sector.

It said, “The lower losses in 2025 reflected improvements in monitoring, BVN-NIN integration, and tighter controls.”

Advertisement

Beyond fraud, the report warned that Nigeria’s rapidly expanding digital payments landscape faces increasing systemic vulnerabilities as banks and fintech companies become more interconnected through shared payment infrastructure.

According to the report, a major operational failure involving a single payment service provider could quickly spread across the financial system because of the growing dependence on integrated payment platforms.

The CBN observed that despite ongoing efforts to strengthen payment system integration, interoperability remains a significant challenge.

It disclosed that about half of fintech stakeholders continued to express dissatisfaction with the current level of system-wide interoperability.

The report stated that “about 50.00 per cent of fintech stakeholders continued to rate system-wide interoperability as poor, primarily due to the lack of universal APIs and data-sharing standards.”

Advertisement

The apex bank also expressed concern over the concentration of payment activities among a few Systemically Important Payment Service (SIPS) providers, warning that operational failures involving any of them could have widespread consequences.

It explained that the failure of such providers could trigger a “domino effect”, where insolvency or operational glitches in one payment service provider spread rapidly to others, disrupting the smooth functioning of the financial system.

Cybersecurity also featured prominently among the risks identified in the report.

The CBN warned that payment service providers remain vulnerable to ransomware attacks, data breaches and credential theft, noting that cybercriminals are becoming increasingly sophisticated in targeting financial institutions.

According to the report, “Banking and fintech institutions remained prime targets for ransomware, data leaks, and credential theft.”

Advertisement

It added that, “Cyber threats in Nigeria are no longer random cybercrimes, but increasingly targeted, organised, and identity-driven campaigns.”

The report further cautioned Nigerians against transacting with unlicensed payment companies, stressing that such entities operate outside regulatory oversight and expose users to significant financial risks.

It warned that customers using unlicensed PSPs are not protected by existing regulatory safeguards and that such operators could facilitate illicit financial activities.

“Users of unlicensed PSPs are not covered by regulatory protection that comes with effective oversight and supervision,” the CBN said.

It further warned that, “Unlicenced payment companies are gateways for money laundering which could undermine regulatory efforts and corrode public trust.”

Advertisement

The report underscores the growing importance of strengthening fraud detection systems, improving payment infrastructure interoperability, enhancing cybersecurity resilience, and intensifying regulatory oversight as Nigeria continues to expand its digital payments ecosystem.

Nigeria Revenue Service (NRS) yesterday announced that medium and large companies in Nigeria that earn income from cryptocurrency and other virtual asset transactions will now be subject to a 30 per cent corporate income tax.

NRS stated this in its new guidelines setting out a tax framework for cryptocurrency and other digital asset transactions.

The guidelines cover registration, record-keeping, valuation, and tax treatment for VASPs, P2P operators, and individuals in the virtual asset space.

NRS said the move is aimed at encouraging voluntary compliance and improving transparency as Nigeria’s digital asset sector grows.

The Guidelines on the Taxation of Virtual Assets, provide a comprehensive framework for the taxation of virtual asset transactions and businesses operating within Nigeria’s digital economy.

Advertisement

The guidelines apply to companies, individual taxpayers, Virtual Asset Service Providers (VASPs), peer-to-peer (P2P) marketplace operators and other participants in the virtual asset ecosystem

The latest framework follows the signing of the Presidential Executive Order on Virtual Assets Coordination, 2026 by President Bola Tinubu, which established a coordinated regulatory structure for cryptocurrencies, stablecoins, tokenised assets and other digital assets across government agencies.

According to the NRS, companies that derive profits from virtual asset activities will be taxed under the provisions of the Nigeria Tax Act (NTA), 2025. While small companies will continue to enjoy applicable tax exemptions under the law, medium and large companies will be liable to the standard 30 per cent corporate income tax rate.

The agency stated that taxable income under the guidelines covers a broad range of virtual asset-related activities, including cryptocurrency trading, the operation of virtual asset exchanges, transaction fees, brokerage commissions, custody and wallet services, token issuance, mining, staking, decentralised finance (DeFi) activities, investment gains and other virtual asset business operations.

According to the guidelines, “Applicable rates under the NTA include progressive rates for individuals, and 30 per cent for companies other than small companies.”

Advertisement

The NRS said the guidelines were introduced to provide clarity, certainty and consistency in the administration of Nigeria’s tax laws as they apply to virtual assets, adding that the framework is intended to improve transparency, encourage voluntary tax compliance and support the development of an efficient tax regime for the digital asset sector.

The agency also clarified that merely holding cryptocurrencies or other virtual assets does not constitute a taxable event.

Any appreciation in the value of a digital asset while it remains in a taxpayer’s possession will not attract income tax until the asset is sold, exchanged or otherwise disposed of through a taxable transaction.

Similarly, transfers of cryptocurrencies or other virtual assets between wallets owned and controlled by the same individual are exempt from income tax, provided there is no change in beneficial ownership.

This means that moving digital assets such as Bitcoin or Ether between personal wallets will not trigger a tax liability.

Advertisement

However, the exemption does not extend to transfers involving companies, partnerships, trusts, unincorporated associations or other legal entities, where different tax rules may apply.

The NRS further explained that although these non-taxable transactions do not attract immediate tax, they establish the acquisition cost for future disposals.

Consequently, taxpayers are required to maintain adequate records of acquisitions, transfers and disposals to facilitate accurate tax computations when taxable events occur.

The guidelines also reaffirm that unrealised gains on cryptocurrencies and other virtual assets are not subject to income tax. Instead, tax liability arises only when a taxable disposal takes place, aligning Nigeria’s approach with internationally recognised principles for the taxation of digital assets.

The issuance of the guidelines is expected to provide greater regulatory certainty for investors, businesses and digital asset service providers, while strengthening the government’s efforts to expand the tax base and improve compliance in Nigeria’s growing virtual asset ecosystem.

Advertisement