By Juliet Umeh<\/p>\n
On a quiet Sunday morning, January 6, 2026,\u00a0Lagos-based musician Kingsley Samuel was\u00a0scrolling through WhatsApp when a\u00a0notification from an unfamiliar number, popped up.<\/p>\n
\u201cThe message had been forwarded and carried the kind of promise many unemployed or under-employed Nigerians have learned to pause over, but not entirely ignore,\u201d Samuel told Vanguard.<\/p>\n
According to him, the message read: \u201cHello, I\u2019m the recruitment manager at Jumia. We are hiring for our team. You will be required to work remotely for 30 to 60 minutes daily and earn between N100,000 and N200,000 as daily salary.\u201d<\/p>\n
It went on to say: \u201cIf you are interested in this part-time position, please click the WhatsApp link below to add a customer service manager and apply,\u201d with an arrow directing him to where to click.<\/p>\n
\u201cI never applied for any job. I didn\u2019t submit my CV anywhere. So, I asked how he got my number,\u201d Samuel said. He added that the sender offered only a vague response \u2013 \u201cSlim\u201d \u2013 before the conversation abruptly went silent minutes later.<\/p>\n
What appeared to be a routine spam message reflects a deeper data-protection impact failure within Nigeria\u2019s digital economy, one where personal phone numbers circulate freely across platforms, vendors, and third-party systems without consent, transparency, or accountability.<\/p>\n
A pattern of unlawful data processing<\/p>\n
Across Nigeria, unsolicited job offers, fake loan messages, spam calls, robocalls, and aggressive short message service, SMS marketing now flood phones daily. Many recipients report that these messages appear shortly after SIM registration, bank transactions, POS usage, or app downloads, suggesting systemic weaknesses in lawful processing, purpose limitation, and data minimisation, as required under the Nigeria Data Protection Act, NDPA, 2023.<\/p>\n
For such people, the question is no longer whether their data has been accessed, but how far it has travelled beyond its original purpose.<\/p>\n
A familiar scam, a familiar trail<\/p>\n
\u201cOn June 13, 2025, at exactly 7:35 p.m., I received a simple \u2018hi\u2019 on my WhatsApp from a number I didn\u2019t recognise,\u201d said Mary Okeke, a Lagos-based hairstylist.<\/p>\n
\u201cThere was no profile photo, no mutual contact, nothing to suggest who the person was.\u201d<\/p>\n
Okeke said curiosity made her respond, suspecting it might be someone she knew. \u201cA few minutes later, the person introduced herself as Adebimpe Balogun and claimed she was calling from Temu Online Shopping Mall,\u201d she recounted.<\/p>\n
\u201cShe said they were recruiting and offered me a work-from-home job as an \u2018Online Coordinator\u2019, promising daily earnings of between N80,000 and N150,000.\u201d<\/p>\n
According to her, the sender repeatedly emphasised that no upfront payment was required, a reassurance often used to lower suspicion in online recruitment scams.<\/p>\n
\u201cThe promises were big, the details were vague, and everything felt rushed,\u201d Okeke recalled. Sensing danger, she said that she blocked the number.<\/p>\n
Bayo Bankole, a 25-year-old university student, described a similar encounter, this time around the sender said they were recruiting for iTradeNest Online Shopping Mall. The sender promised him N100,000 to N200,000 daily for simple tasks like taking screenshots of products.<\/p>\n
\u201cThey told me I would earn N1,500 for browsing two products and could make up to N200,000 daily,\u201d he said. \u201cThen they asked me to move the conversation to Telegram. I had to disengage and block the person,\u201d Bankole said.<\/p>\n
Lagos residents Rachel Nwankwo and Ken Ikeh shared nearly identical experiences. The messages were polite, personalised, and professionally written, preying on Nigeria\u2019s rising demand for remote work in a struggling economy.<\/p>\n
When privacy failure leads to financial harm<\/p>\n
For Julie Maduka, unemployed for nearly a year, the cost of data misuse was not theoretical. After responding to what appeared to be a legitimate job offer to work-from-home, she was asked to pay a one-time \u201cregistration fee\u201d of N80,000.<\/p>\n
\u201cI was so happy when the message came. Even my aged mother was happy, thinking God had answered our prayers,\u201d Maduka told Vanguard. \u201cHe told me I would be put in charge of a team.\u201d<\/p>\n
She said she was later asked to pay a one-time \u201cregistration fee\u201d of N80,000, which she did. Moments after making the payment, she realised she could no longer reach the sender.<\/p>\n
\u201cI suspected he had blocked me,\u201d she said. \u201cI just sat there staring at my phone. That money was all I had left.\u201d<\/p>\n
For many Nigerians, such scams do more than drain finances; they erode trust in digital platforms, leaving victims wary of even legitimate opportunities.<\/p>\n
Loan apps and weaponised phone numbers<\/p>\n
Nigeria\u2019s digital lending sector has become one of the most visible examples of data-protection impact failure.\u00a0<\/p>\n
Since 2023, multiple media reports documented how some digital loan apps were using phone numbers as tools of intimidation during debt recovery. Borrowers reported receiving threatening messages, not just personally, but sent to friends, family members, and colleagues whose numbers were harvested from contact lists.<\/p>\n
One widely circulated message read: \u201cOur agents have been calling and yet payment has not been made. Make a transfer now\u2026\u201d Others threatened to label borrowers and their relatives as criminals. These were coercive debt-recovery tactics, enabled by unauthorised access to private contact data.<\/p>\n
An Abia-based pastor with the United Church of Christ, UCC, Mr. Innocent Offor, told Vanguard how he became an unexpected target of harassment by a digital loan app over a debt he never incurred.<\/p>\n
Offor said the loan company repeatedly contacted him, demanding repayment of N100,000 that they claimed was owed by a former church member who had once been in the chorister group before relocating.\u00a0<\/p>\n
\u201cHow they got my number is still a mystery to me. I kept receiving dozens of calls and text messages every day,\u201d Offor recounted. \u201cThey were branding [the church member] a fraudster and insisting that I pressure him to pay.\u201d<\/p>\n
According to the cleric, he had no direct relationship with the loan app and did not guarantee or co-sign any loan. Yet his phone number appeared to be in the lender\u2019s possession, raising concerns about how his personal contact details were obtained.<\/p>\n
\u201cWhat shocked me most was that they spoke as if I was responsible for the debt,\u201d he said. \u201cThey didn\u2019t care that I am a pastor or that I never borrowed any money from them.\u201d<\/p>\n
Offor\u2019s experience mirrors the\u00a0 pattern in which loan apps\u00a0 harvest contact lists and emergency numbers, spam relatives, friends, and associates of borrowers into aggressive debt-recovery campaigns, often without consent.<\/p>\n
Bulk loan offers and the data trail<\/p>\n
A Vanguard investigation of February 3, 2024, into Lagos-based lender Lucky Finance in 2024 revealed a more industrialised data-exploitation mode.<\/p>\n
Victims alleged the company got access to phone numbers in bulk and sent unsolicited SMS messages urging recipients to apply for short-term loans repayable within seven days. Clicking the links reportedly redirected users to a mobile app that harvested sensitive personal data, including Bank Verification Number, BVN, details, bank information, emergency contacts, call logs, SMS records, and phone contact lists.<\/p>\n
Defaulters were publicly shamed, while relatives and contacts with no contractual link were targeted. Victims said the company allegedly used data extracted from their phones to smear them on social media, falsely labelling defaulters as criminals, fraudsters, or even HIV carriers<\/p>\n
Vanguard further reported concerns about the company\u2019s regulatory status, including how it registered and deployed dozens of SIM cards daily, and whether it complied with Nigeria\u2019s data-protection and consumer-protection laws. Despite its registration with the Federal Competition and Consumer Protection Commission, FCCPC, the company\u2019s practices allegedly contradicted its stated policies.<\/p>\n
Such practices illustrate what regulators describe as a systemic DPI breakdown, where multiple actors across telecoms, app ecosystems, and financial services process personal data without coordinated risk assessment or accountability.<\/p>\n
A rare court victory<\/p>\n
One such issue eventually reached Nigeria\u2019s courts. On December 20, 2024, the Court of Appeal ordered MTN Nigeria to pay N15 million in damages to subscriber Anene Ezugwu, who alleged that he received over 244 unsolicited text messages for services he did not subscribe to.<\/p>\n
According to Vanguard report, the three-member panel of justices unanimously ruled that the unsolicited messages and airtime deductions were fraudulent and violated subscribers\u2019 right to privacy under Section 37 of the 1999 Constitution, as well as Regulation 28 of the Consumer Code of Practice Regulations.<\/p>\n
The bigger picture: A leaking digital economy<\/p>\n
Beyond individual stories, evidence from Nigeria underscores the scale and persistence of unsolicited digital messaging and harassment. In 2025 alone, one of the major telecommunications service operators said it flagged over 9.6 million spam SMS within just two months. Phishing and bulk unsolicited messaging were ranked among the top industry risks by the Nigerian Communications Commission, NCC, in 2023.<\/p>\n
Regulatory responses from the NCC and FCCPC in 2023 and 2025 demonstrate sustained efforts to address number harvesting and harassment by digital loan apps, even though exact complaint totals are not publicly released.\u00a0<\/p>\n
According to the Nigeria Data Protection Commission\u2019s, NDPC, 2023 Annual Report, as reported by Vanguard on March 29, 2024, the regulator was investigating more than 400 cases of privacy breaches involving digital lenders and had received over 1,000 data breach complaints since the law came into effect.<\/p>\n
In 2025, the NDPC stated that it handles an average of nearly three new loan shark privacy complaints daily, while the FCCPC reported that 492 digital loan apps had registered under new lending regulations by October 2025 to avoid potential penalties.<\/p>\n
Cybersecurity expert insights<\/p>\n
Cybersecurity technologists, Gbemisola Esho said the first line of defence against digital threats is mindset.\u00a0<\/p>\n
\u201cScammers consistently gain access to phone numbers and personal details through interactions with third parties, vendors, or malicious app downloads.\u201d<\/p>\n
She said: \u201cIn the cyber world, understanding that networks and computers are interconnected is critical, because even if a system appears \u2018fully secure\u2019 which is often a fallacy, other connected networks may have vulnerabilities that threat actors can exploit. \u201c<\/p>\n
Esho noted that vulnerabilities exist in almost every system, and that while\u00a0 organisations and cybersecurity experts deploy new tools and expertise, threat actors are also evolving.<\/p>\n
\u201cThe responsibility of defenders is to continuously track these vulnerabilities, mitigate them as quickly as possible, put guardrails in place, and secure systems effectively,\u201d she said. \u201cData breaches and weak infrastructure further amplify these threats. Technology alone cannot solve the problem; people and awareness are equally critical.<\/p>\n
She\u00a0 \u00a0commended the Nigeria Data Protection Commission, NDPC, for increased enforcement, citing its ongoing privacy-breach case against Meta (Facebook) as evidence of regulatory responsiveness.<\/p>\n
Another cybersecurity expert and Managing Director of Havosoft International Limited, Rock Adote, said Nigeria is still playing catch-up in data-protection compliance, noting that technology has evolved far beyond the models on which the country\u2019s original compliance frameworks were built.<\/p>\n
\u201cPeople are uploading entire company datasets, including staff records, into AI platforms hosted on foreign servers without realising that this alone constitutes a breach of the Nigeria Data Protection Act,\u201d he said.<\/p>\n
Adote added that granting apps unrestricted access to contacts, messages, and location data on corporate-issued devices effectively exports sensitive Nigerian data to foreign servers.<\/p>\n
\u201cPhishing is no longer basic. Artificial intelligence has increased the scale and complexity of attacks, making detection far more difficult. WhatsApp is one of the worst channels for phishing because users cannot easily preview links the way they can with emails. These scams follow predictable scripts, inflated earnings, fake job roles, and urgent instructions, yet they remain effective because trust in digital platforms is already fragile,\u201d he explained.<\/p>\n
Both experts agreed that stronger enforcement, improved organisational compliance, and sustained public cybersecurity awareness are critical to curbing the growing abuse of Nigerians\u2019 personal data.<\/p>\n
Regulators react \u2013 but gaps remain<\/p>\n
The NCC, on September 7\u20138, 2023, publicly warned loan apps and telemarketers against illegally accessing subscribers\u2019 phone numbers, threatening prosecution for violations while promoting the Do-Not-Disturb, DND, code 2442 to block unsolicited messages.\u00a0<\/p>\n
The CBN followed on May 12, 2025, cautioning Nigerians against unsolicited SMS and WhatsApp messages falsely claiming to represent CBN loans, grants, or intervention funds. Meanwhile, the NDPC has ramped up engagement and investigations, hosting the Network of African Data Protection Authorities, NADPA, conference in April 2025 to reinforce compliance and best practices.<\/p>\n
Yet enforcement remains slow, leaving a thriving underground data market where phone numbers and personal information continue to be harvested, traded, and exploited without consent.<\/p>\n
Legal perspective<\/p>\n
Davidson Oturu, lawyer and General Partner at Nubia Capital, warned that the rising wave of unsolicited loan messages, spam calls, and harassment constitutes a clear violation of the Nigeria Data Protection Act, NDPA, 2023 and the constitutional right to privacy.<\/p>\n
\u201cUnsolicited loan SMS, spam calls and harassment of people who never requested loans typically violate key provisions of the Nigeria Data Protection Act,\u201d he said. \u201cPersonal data must be processed lawfully, fairly and transparently. Using someone\u2019s phone number for loan marketing or debt recovery without consent has no lawful basis under the law.\u201d<\/p>\n
He added: \u201cThe law is very clear on purpose limitation. Data collected for one purpose, such as registering for a service, cannot later be used for unsolicited marketing or debt recovery. When people are harassed based on inaccurate or outdated information, it also reflects a failure to uphold data accuracy and minimisation principles.\u201d<\/p>\n
Oturu noted that NDPC enforcement actions include the N766 million fine imposed on Multichoice Nigeria and ongoing investigations into over 400 privacy breaches linked to digital loan apps. He further said victims could seek civil redress under Sections 24 to 34 of the NDPA.<\/p>\n
The trust deficit<\/p>\n
At the heart of Nigeria\u2019s digital transformation lies a trust problem: If Nigerians cannot trust that their data is safe, can the country truly build a secure digital economy?<\/p>\n
SIM-NIN integration, digital IDs, mobile money, and public digital infrastructure all rely on citizens believing their data will be protected.\u00a0<\/p>\n
But as unsolicited messages, loan harassment, and phishing schemes multiply, that trust continues to erode. Until organisations are required to conduct meaningful Data Protection Impact Assessments, enforce consent, and treat personal data as a constitutional right rather than a commodity, Nigeria\u2019s digital economy will remain powerful and dangerously porous.<\/p>\n
*This report is supported by the DPI Africa Journalism Fellowship Programme of the Media Foundation for West Africa and Co-Develop<\/p>\n
Vanguard News
\nThe post Poor Data Privacy: How online scams, unsolicited ads score Nigeria\u2019s digital economy low appeared first on Vanguard News.<\/p>\n","protected":false},"excerpt":{"rendered":"
By Juliet Umeh On a quiet Sunday morning, January 6, 2026,\u00a0Lagos-based musician Kingsley Samuel was\u00a0scrolling through WhatsApp when a\u00a0notification from … <\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"","fifu_image_alt":"","footnotes":""},"categories":[22],"tags":[19],"class_list":["post-4998","post","type-post","status-publish","format-standard","hentry","category-african-news","tag-general-africa-top-news"],"yoast_head":"\n