Central Bank of Nigeria (CBN)and the Nigerian Communications Commission (NCC) have proposed that customers must receive refunds within 30 seconds for failed airtime and data purchases to curb persistent billing complaints in the telecommunications sector.

This was indicated in the Exposure Draft of the Joint CBN–NCC Framework for Resolution of Failed Airtime and Data Purchase Transactions, which was published on the website of the CBN on Monday.

The landmark exposure draft, dated 5 February 2026, seeks to “institutionalise clear accountability” and establish a “coordinated approach to consumer redress” across the financial and telecommunications sectors.

The most significant shift in the proposed framework is the introduction of standardised, automated timelines for resolving failed transactions.

Currently, Nigerians often face long delays when airtime purchases fail at the bank, aggregator, or Mobile Network Operator level.

To solve this, the regulators have proposed a 30-second window for automated reversals. Section 6.0 (ii) of the draft exposure, which dwelt on failed transactions, especially as it relates to unfulfilled airtime/data delivery, proposes a time to refund the purchaser of 30 seconds “if the transaction failed at the bank level… Failed transaction delivery from NCC Authorised Licensees… Failed transaction delivery from MNO to the NCC Authorised Licensee.”

The draft emphasised that stakeholders must “automate reversal processes across all stakeholders” to ensure that refunds require no human intervention from the customer.

The draft exposure also stated that “all parties involved in airtime and data transactions shall take the following actions to ease usage and facilitate consumer satisfaction: a. Stakeholders must immediately connect ONLY to relevant authorised licensees of the NCC and CBN. b. MNOs and banks must only connect to NCC Authorised Licensees/MNO digital channel partners for airtime and data vending… Notifications of failure create final settlement obligations between MNO and NCC-authorised licensees… The NCC and CBN will audit stakeholder compliance jointly or individually at quarterly or other intervals as may be determined.”

From a business and oversight perspective, the regulators are proposing a Central Monitoring Dashboard to be hosted jointly by the CBN and NCC, which will track reversals, Service Level Agreement breaches, and customer complaints in real-time.

“There shall be a Central Monitoring Dashboard hosted by CBN/NCC for tracking reversals, SLA breaches, and customer complaints. This will facilitate the establishment of a real-time national ‘Failed Transactions Dashboard’ with a uniform error code with end-to-end visibility across the value chain’, read the draft exposure.

This is designed to eliminate the “unclear ownership of liability” that often occurs when banks and telcos blame each other for failed recharges. To support this, banks and MNOs will be required to maintain and share daily reports of successful and failed cases.

The proposed framework also addresses the common problem of “lost” money when customers recharge ported phone numbers. The draft mandates that MNOs must validate a phone number against the ported number database before processing any recharge. If the system identifies a number as ported out or invalid, it must “proactively stop recharges” and send a failure code back to the bank to ensure the customer is not debited.

For erroneous recharges sent to the wrong person, the framework sets clear protocols: below N20,000, MNOs will request the recipient’s consent before a reversal, and when it is above N20,000, an affidavit of indemnity or notarised letter is required to process the recovery.

The CBN and NCC in the exposure draft signalled they will take a firm stance on compliance. Both agencies will conduct joint quarterly audits of all stakeholders, including banks, payment service providers, and MNOs, to verify compliance with the new rules. The regulators have warned they will “impose penalties for any breach” of the framework’s provisions.

Banks and other financial institutions have until 10 February 2026 to submit their inputs on the draft before it is finalised. Once implemented, the framework is expected to significantly restore “subscriber trust” in Nigeria’s digital financial ecosystem.

Sophos, a leading provider of innovative cybersecurity solutions, shared practical advice to help internet users safeguard their credentials and maintain continuous protection online.

Sophos

According to the upcoming Sophos Active Adversary Report, compromised credentials were the leading cause of attacks (42.06%) in 2025.

This is a strong trend that continues to dominate the scene, with cyber attackers demonstrating ever-increasing ingenuity and relying on new tools to compromise the security and privacy of internet users.

John Shier, Field CISO Threat Intelligence at Sophos, said: “The way attackers are using automation and generative AI to massively increase the speed and volume of their attacks suggests that attacks will become faster and more sophisticated. The best approach to protecting our identities and digital data is to take a proactive stance on defense.”

“Criminals are increasingly targeting people rather than devices, and this trend is expected to continue and even accelerate. Once again, AI is being used as a weapon to create highly detailed phishing lures to entice people to disclose passwords or financial information through well-designed emails, text messages, and WhatsApp messages.”

1. Keep your devices up to date: the most important and simplest measure you can take to protect yourself in the long term.

Cybercriminals are constantly on the lookout for computers that don’t have all the latest security patches, making them easy targets for compromise. This includes computers, laptops, smartphones, tablets, and home Internet/Wi-Fi routers. In most cases, you just need to click “Check for Updates” or “Update Now” and allow the device to restart.

2. Use a password management tool, whether it is built into an operating system or a third-party tool.

Password uniqueness and complexity are then managed automatically, greatly facilitating account isolation and protection.

3. Enhance protection with phishing resistant (MFA).

Many websites offer the option of using an “authentication app,” a smartphone app that displays a unique code for a short period of time, which must be entered after the password, making it much more secure than simply using a password.

Better still, there is a new solution called “passkeys,” which generally uses biometric authentication on your smartphone (face scan, fingerprint) to log in without any password. This is the best choice when available.

John Shier concludes: “Criminals will never stop trying to steal from us, so we must remain vigilant. We know that they are constantly improving and becoming more skilled at deceiving us, so it’s up to us to move forward and improve our protections to stay safe.”

For more information, please visit: https://www.sophos.com

European Union has launched a formal challenge against Meta Platforms over a new policy restricting third-party artificial intelligence tools on WhatsApp.

Meta

Regulators accuse the U.S. tech giant of abusing its dominant position in the messaging market to favor its own AI assistant.

On January 15, Meta implemented changes to the WhatsApp Business API, allowing only its proprietary Meta AI to operate while blocking rival chatbots.

The European Commission quickly responded with a statement of objections and announced plans for interim measures to prevent “serious and irreparable harm” to competitors during the ongoing investigation.

EU antitrust chief Teresa Ribera stressed the need to safeguard competition in the booming AI sector. “We cannot allow dominant tech companies to illegally leverage their dominance for an unfair advantage,” she said.

Interim steps could force Meta to restore access for third-party AI tools on WhatsApp pending the probe’s outcome.

Meta defended the policy, insisting the WhatsApp Business API serves business-to-customer needs, not general AI distribution.

A spokesperson highlighted alternatives like app stores, devices, and websites for other AI options, rejecting claims that the API is essential for chatbots.

This dispute echoes actions elsewhere: Italy restricted Meta similarly last December, while Brazil recently lifted a comparable court order.

As AI integrates deeper into daily apps, the EU’s moves signal heightened scrutiny on tech gatekeepers.