Connect with us

E-Financial

Revealed: mPoS Devices at Risk from Hackers

Published

on

POS-Terminal.jpg
Kindly share this post

Researchers have found that most popular mobile point of sale (mPoS) devices which accept chip-and-pin cards contain several vulnerabilities,

Jon Butler, head of research at MWR InfoSecurity, and a researcher named Nils, studied six of the most popular mPoS, according to their presentation at the annual Black Hat security conference recently.

A patch has been available since April but hasn’t been widely applied, leaving many devices vulnerable.

They uncovered vulnerabilities in the device’s firmware update process.

Butler and Nils were able to look at the USB interface and gain access to the device’s command line to execute commands.

A stack-based buffer overflow bug in the EMV parsing library also opened up the devices to be fully compromised and under the attacker’s control.

They found hints that mPoS could also be compromised via a smartphone infected with malware.

These vulnerabilities, according to the researchers, would not allow attackers to clone the chip on EMV cards.

Attackers can take the available information and the captured PIN to create a cloned card that could be used where EMV is not as widely deployed, such as the United States.

The researchers successfully used a maliciously crafted EMV (chip and pin) card to install and run a Flappy Bird-like game on the device.

A real world version of this attack would likely involve the attacker using a rogue card to modify the mPoS to stealthily copy card details and PINs of every payment card it processes.

The attacker could later return with another card to extract the harvested information.

Chip cards should not be considered trusted, Butler said. Every card has not been freshly issued by a bank, he warned.

These mPoS devices have a small screen, a card reader, and an input pad to accept PINs.

Even though they may look entirely different, Butler said 75 percent of the devices actually are the same when considering the underlying software and tools available.

These devices generally run Linux, or a variant of, and communicate via Bluetooth with smartphones.

The platform vendor was cooperative when Butler and Nils reported the vulnerability and released the patch for the EMV library in April.

There was some delay in releasing the patch because the modified library had to be re-certified again.

“Legal standards actually make it difficult for manufacturers to release security patches in a timely manner. Some of the mobile device vendors have not yet released the firmware update containing the new EMV library”, Nils said.

Unlike many embedded devices, mPoS can potentially be updated easily, as the firmware can be pushed over Bluetooth by the mobile app.

“Even with the uncovered flaws, mPoS devices are potentially more secure than traditional PoS devices”, Butler said.

“They are simple enough that so long as implementation follows security best practices, there’s not much that can go wrong”, he said.

 


Kindly share this post

Nigeria CommunicationsWeek believes that technology makes life more exciting and helps improve the lives of people around Nigeria and indeed the world. So since 2007, we have devoted our energy to independent reportage of technology and how they affect lives.

Continue Reading
Advertisement
Comments

E-Financial

CBN Revokes Licenses of Two Mortgage Banks, NDIC Begins Liquidation

Published

on

Kindly share this post

Nigeria’s banking regulators have moved to shut down two mortgage lenders after prolonged financial distress, as authorities intensify efforts to enforce capital discipline and restore confidence in the country’s housing finance system.

The Central Bank of Nigeria (CBN) has withdrew the operating licenses of Aso Savings and Loans Plc and Union Homes Savings and Loans Plc, setting in motion a liquidation process that will see insured depositors paid by the Nigeria Deposit Insurance Corporation (NDIC).

The revocation marks a decisive intervention by the central bank, which said the lenders repeatedly failed to meet regulatory standards despite supervisory actions.

In a statement signed by Hakama Sidi Ali, acting director of corporate communications, the CBN said the decision was taken under the Banks and Other Financial Institutions Act, BOFIA 2020, and the revised guidelines for mortgage banks, as it seeks to re-position the sub-sector and entrench compliance.

“As part of its efforts to re-position the mortgage sub-sector and promote a culture of compliance with relevant laws and regulations, the Central Bank of Nigeria has revoked the licenses of Aso Savings and Loans Plc and Union Homes Savings and Loans Plc,” the statement said.

The central bank said the two institutions breached several provisions of BOFIA 2020 and regulatory guidelines, citing weak capital, balance-sheet strain and persistent non-compliance.

According to the CBN, the lenders failed to meet the minimum paid-up share capital requirement for their licence category and did not have sufficient assets to meet their liabilities.

The lenders were also “critically undercapitalised with a capital adequacy ratio below the prudential minimum ratio as prescribed by the CBN,” the regulator said, adding that both institutions failed to comply with several directives imposed by the central bank over time.

The action highlights the CBN’s broader push to tighten oversight of Nigeria’s financial system after years of regulatory forbearance, particularly in niche segments such as mortgage banking that have been weighed down by funding constraints, rising credit risk and weak profitability.

While the sector accounts for a small share of total banking assets, it is viewed as key to expanding access to long-term housing finance in Africa’s most populous economy.

The CBN said it remains focused on safeguarding systemic stability. “The CBN remains committed to its core mandate of ensuring financial system stability,” the statement said.

Following the withdrawal of the licenses, the NDIC was appointed liquidator of the two lenders and has begun the process of winding them up, including reimbursing eligible depositors.

In a separate statement on Tuesday, the Corporation said it had commenced liquidation in line with the NDIC Act 2023 and started verification and payment of insured deposits to customers of the defunct banks.

Depositors are entitled to receive up to ₦2 million per depositor, with payments to be made using Bank Verification Numbers (BVN) to identify alternate bank accounts for automatic credit.

Customers with balances above the insured limit will receive the initial ₦2 million, while the remaining sums will be paid as liquidation dividends after the realisation of assets and recovery of outstanding loans, the NDIC said. The corporation added that it would begin selling the banks’ assets and intensify debt recovery efforts to accelerate payments of uninsured balances.

The NDIC advised depositors to submit claims either online or physically at branches of the closed banks during the verification period, with valid identification and proof of account ownership. Creditors were also asked to file claims, with payments to follow after all depositors have been fully settled, in line with statutory provisions.

Staff and shareholders of the defunct banks will only be paid after depositors and creditors, from proceeds realised during liquidation, the NDIC said, while urging borrowers to repay outstanding loans and assuring the public that other licensed banks remain safe and sound.


Kindly share this post
Continue Reading

E-Financial

CBN Revokes Licences of Aso, Union Homes Mortgage Banks Over Regulatory Breaches

Published

on

Kindly share this post

Central Bank of Nigeria (CBN) has revoked the operating licences of Aso Savings and Loans Plc and Union Homes Savings and Loans Plc, citing persistent regulatory breaches that undermined the safety and soundness of the institutions.

CBN Revokes Licences of Aso, Union Homes Mortgage Banks Over Regulatory Breaches

CBN

In a statement issued on Tuesday, the Acting Director of Corporate Communications, Mrs. Hakama Sidi Ali, said the decision was part of renewed efforts to sanitise the mortgage sub-sector and enforce strict compliance with banking regulations.

According to her, the affected institutions violated several provisions of the Banks and Other Financial Institutions Act (BOFIA) 2020 and the Revised Guidelines for Mortgage Banks in Nigeria.

“The institutions failed to meet minimum paid-up share capital requirements, were critically undercapitalised, and did not comply with multiple regulatory directives. They also lacked sufficient assets to cover liabilities,” Sidi Ali said.

She explained that the revocation was intended to strengthen confidence in the mortgage sector and ensure that only institutions capable of operating safely and soundly are allowed to continue business.

The apex bank stressed that it remains resolute in enforcing regulatory standards across all segments of the financial system.

“The Central Bank of Nigeria remains committed to its core mandate of ensuring financial system stability,” Sidi Ali added.

Nigeria CommunicationsWeek reports that the move follows repeated warnings from the CBN in recent years, urging mortgage operators to improve capitalisation, governance, and compliance with statutory requirements.

Industry analysts say the action is expected to reinforce discipline within the mortgage banking segment and restore public trust in the sub-sector, which has struggled with weak capitalisation and governance challenges.


Kindly share this post
Continue Reading

E-Financial

Tax Reform or Financial Exclusion? The Trouble with Mandatory TINs

Published

on

Kindly share this post

By Blaise Udunze

It is not only questionable but an aberration that a nation where over 38million Nigerians remain financially excluded, where trust in institutions is fragile, and where citizens are pressured under the weight of rising living costs, the use of Tax Identification Number (TIN) has been specified as the only option for their bank accounts operation from January 1, 2026 by the Federal Government of Nigeria.

Tax Reform or Financial Exclusion? The Trouble with Mandatory TINs

Tax Reform

In practice, the policy spearheaded by Taiwo Oyedele, Chairman of the Presidential Committee on Fiscal Policy and Tax Reforms, is rooted in the Nigerian Tax Administration Act (NTAA), and the intention can be understood in the areas of improving tax compliance, widening the tax net, and formalizing economic activities. But in practice, the directive risks becoming yet another well-meaning reform that punishes the wrong people, disrupts financial inclusiveness, and potentially destabilises an already stressed economy.

Yes, Nigeria needs tax reforms. Yes, the country must broaden its tax base. And yes, public revenues must increase to address fiscal pressures.

But compelling citizens to obtain TINs as a condition for operating bank accounts is the wrong tool for the right objective.

Below are five core arguments against the directive, and sustainable alternatives that actually strengthen tax compliance without endangering banking access or punishing informal earners.

The Directive Risks Deepening Financial Exclusion

Nigeria still struggles with financial inclusion. According to several official assessments, over 38 million adults remain outside the formal financial system. Many of them operate small, irregular businesses, survive through subsistence earnings, or depend on cash-based livelihoods.

The Federal Government’s compulsory TIN-for-bank-accounts policy is built on the assumption that every banked Nigerian is structured, organised, and tax-ready. This is false.

For instance, the rural market woman with N30,000 in rotating savings, the okada rider who deposits cash once a week, the petty trader using a mobile POS agent account, the retiring pensioner managing a small monthly income, and the migrant worker sends small remittances to their family. These are not tax evaders; they are survivalists.

Most operate bank accounts not because they run formal businesses, but because those accounts are essential to modern financial life: receiving transfers, accessing loans, participating in digital commerce, saving against emergencies, and avoiding the risks of moving cash in insecure environments.

By creating an additional bureaucratic barrier, the directive risks pushing millions back into a cash-dominant shadow economy, precisely the opposite outcome of what Nigeria’s financial-sector reforms are trying to achieve.

Bank Accounts Are Not Proof of Taxable Income

The NTAA clarifies that the TIN requirement applies only to taxable persons, individuals engaged in trade, employment, or income-generating activities.

But herein lies the problem: banks cannot determine who is “taxable” and who is not. Banks only see deposits and withdrawals. They do not audit the source or consistency of income. They are not tax authorities.

A student may run a small online clothing resale gig. A retiree may occasionally rent out farmland.

A dependent may receive cash support from a relative abroad. A job seeker may get intermittent gifts from family.

Who decides which of these scenarios qualifies as taxable? Banks? FIRS? Or will citizens be expected to self-declare under threat of account restrictions?

The result will be confusion, over-compliance, and mass panic with banks indiscriminately demanding TINs from everyone to avoid regulatory penalties.

This not only contradicts the spirit of the law but also exposes ordinary Nigerians to harassment and arbitrary compliance requirements.

The Policy Could Trigger Disruption, Panic Withdrawals, and Cash Hoarding

Whenever Nigerians perceive threats to their access to funds, the natural reaction is withdrawal and hoarding. We saw it during:

–       the 2023 Naira redesign crisis,

–       the 2016 TSA-bank consolidation tightening, and multiple periods of financial instability.

Telling citizens that bank accounts may face “operational restrictions” if they do not obtain a TIN creates a predictable behavioural response: people will rush to withdraw money.

This would be disastrous for a banking system already pressured by:

–       high interest rates,

–       inflation eroding deposits,

–       rising loan defaults, and

–       declining public trust.

Any government policy that unintentionally creates an incentive for citizens to flee the formal banking system is counterproductive.

The TIN Requirement Will Become a Bureaucratic Nightmare

Even if millions of Nigerians want to comply, the system is not ready. Nigeria’s administrative infrastructure does not have the capacity to process tens of millions of TIN registrations within months without:

–       long queues,

–       delays,

–       data mismatches,

–       duplicate records, and

–       systemic errors.

The National Identity Number (NIN)-SIM registration experience is a painful reminder of what happens when ambitious policy meets weak execution capacity.

–       Citizens spent months in overcrowded enrolment centres.

–       Millions were blocked from services.

–       Data inconsistencies persisted.

–       The economy suffered productivity losses.

If Nigeria could not seamlessly synchronise NIN and SIM data, how will it synchronise NIN, BVN, and TIN at a national scale without dislocation?

Forcing TIN Adoption Ignores the Real Problem: Nigeria’s Broken Tax Culture

The Federal Government’s real challenge is not that citizens lack TINs, but that they lack trust in how taxes are used.

A government cannot widen the tax net when:

–       tax leakages remain widespread,

–       citizens feel services do not match taxation,

–       corruption perceptions are high,

–       government spending lacks transparency, and

–       taxpayers do not feel seen, heard, or valued.

Coercion does not build a tax culture. Engagement does. Policy does not create legitimacy. Accountability does.

If the Federal Government wants Nigerians to freely participate in the tax system, it must earn legitimacy first, not mandate compliance through financial restrictions.

What the Government Should Do Instead: A Smarter Path to Tax Reform

Instead of enforcing a policy that may backfire economically and socially, the Federal Government can adopt four smarter, people-centred alternatives.

–       Automatic TIN Issuance Linked to NIN and BVN

Rather than forcing Nigerians to apply manually, the government should:

·       auto-generate TINs for all existing BVN/NIN holders,

·       send the TINs via SMS, email, and bank alerts,

·       allow self-activation only when needed for tax obligations.

This eliminates queues, delays, and confusion.

–       Build a Voluntary Tax Compliance Culture Through Transparency and Incentives

Tax morale improves when citizens see value. Government should:

·       publish annual audited reports of tax revenue use,

·       incentivise compliant taxpayers with benefits (priority access to government grants, credit scoring, etc.),

·       simplify tax filings for small businesses.

People comply more when they feel respected, not coerced.

–       Target High-Value Tax Evaders, Not Low-Income Account Holders

Nigeria’s real tax leakages come from:

·       large corporations shifting profits,

·       politically exposed persons,

·       illicit financial flows,

·       multinational tax avoidance strategies,

·       the informal “big money” class operating outside the banking system.

Instead of threatening small depositors, the government should strengthen:

·       FIRS intelligence and investigation units,

·       inter-agency data integration (CAC, Customs, Immigration),

·       beneficial ownership transparency enforcement.

The fight against tax evasion should focus on those hiding billions, not those depositing thousands.

–       Strengthen Digital Tax Platforms for Easy Self-Registration and Compliance

If tax registration becomes as easy as opening a social media account, compliance will rise naturally. The government should build:

·       a mobile-first tax app,

·       simplified online TIN retrieval,

·       one-click tax filing for gig workers and small traders.

Digital convenience can achieve what regulatory coercion cannot.

Reform Should Not Punish the Public

No doubt, tax reforms are needed urgently, but they must come with a human face, an intelligent, equitable, and aligned with the realities of ordinary Nigerians.

The TIN-for-bank-accounts policy, while well-intentioned, risks undermining financial inclusion, triggering economic instability, and imposing unnecessary burdens on millions who are not tax evaders but survival-based earners.

Good tax policy is built on trust, not fear. On transparency, not threats. On civic legitimacy, not administrative compulsion.

If the Federal Government truly wants to modernise Nigeria’s tax system, it must focus not on restricting citizens’ access to their own money, but on:

·       repairing tax trust,

·       digitising compliance,

·       targeting the real evaders, and

·       making participation easier, not harder.

Financial inclusion took Nigeria decades to build. We cannot afford a policy that carelessly reverses these gains.

A better tax system is possible, but it must start with the people, not with their bank accounts.

Blaise, a journalist and PR professional, writes from Lagos, can be reached via: [email protected]


Kindly share this post
Continue Reading

Trending