Fraudsters rarely break into banks. They talk their way through customers, and a convincing phone call is still the cheapest way in.
- ₦25.85bn
- lost to digital payment fraud in Nigeria in 2025
- #1
- Social engineering, talking you into it, is the most common fraud technique
- 63%
- of reported fraud cases came from Lagos alone
Source: NIBSS Annual Fraud Landscape, 2025 figures.
The money leaves your account with your own approval. That is exactly why it is so hard to reverse, and why five seconds of doubt on a phone call is worth more than any password.
Every fake bank call runs the same four steps
Steps 1–3 exist only to make step 4 feel reasonable.
It looks real
The caller ID shows your bank's name or hotline. Spoofing that display costs a scammer almost nothing.
They create panic
“A transfer of ₦480,000 is pending on your account. Did you authorise it?” Fear switches off careful thinking.
They isolate you
“Stay on the line. Don’t discuss this with anyone, the account is under investigation.”
They extract
The OTP, your PIN, a code to dial, an app to install, or a transfer to a “safe account”.
Six things a real bank call never contains
One of these is enough. You do not need to wait for a second.
A countdown
“You have two minutes before the debit goes through.” Urgency is the tool, not the truth.
A request for secrets
Your OTP, PIN, password, full card number or CVV. No staff member ever needs these.
A “safe account”
There is no such thing. Every naira that reaches it is gone.
“Don’t hang up”
Or “don’t tell anyone.” Real banks are happy for you to call back and to ask your family.
A link or an app
Anything you must install, click or approve while they wait on the line.
Details that “prove” it
Knowing your name, BVN digits or last transaction proves a leak, not that they work at your bank.
What a real bank will never do
When you can name the normal version, the fake one stands out.
A real bank will never
- Ask for your PIN, OTP, password or card CVV
- Ask you to move money to a “safe”, “holding” or “mirror” account
- Ask you to install remote-access or “verification” software
- Send a courier to collect your card or cash
- Tell you to keep the call secret from your family
- Threaten to freeze your account unless you act in minutes
This is what normal looks like
- Ask you to approve or decline a transaction inside your own banking app
- Ask a security question you set up yourself
- Ask you to visit a branch with valid ID
- Send an alert and let you call the number on your card
- Be willing to end the call so you can call back
- Confirm nothing sensitive, and never rush you
If the call feels wrong: three steps, in this order
If the caller was genuine, nothing is lost by calling back. If they were not, you just saved your money.
Hang up
You owe an unexpected caller nothing, not politeness, not an explanation. Ending the call costs you nothing and costs them everything.
Wait, or switch phones
Give it five minutes, or use a different phone. A scammer can hold your line open so your “callback” reaches them instead.
Call the number on your card
The one printed on your card or in your bank's official app. Never a number the caller gave you, and never one from a search result.
Four traps that catch careful people
These get past customers who already know “never share your OTP”.
The held line
You hang up and dial your bank, but the fraudster never released the line, so you are still talking to them. Use a different phone, or wait five minutes.
“Your account officer”
A WhatsApp profile with the bank's logo and a familiar name. Banks do not resolve disputes over personal WhatsApp chats.
“Just dial this code”
The USSD string they read out is a transfer or airtime purchase from your own line. Never dial a code given to you over the phone.
“Update your BVN / NIN”
A deadline, a link, a form. Verification exercises are done in a branch or in your bank's own app, never through a link you were sent.
Already shared something? Act fast
Speed decides how much is recoverable. Embarrassment costs more than the call did.
Freeze the account or block the card immediately, in your banking app, or on your bank's official self-service line.
Change your banking password and PIN, from a device you trust and a network you trust.
Call your bank's official line, report the fraud, and write down the reference number and the time.
Follow up the same day by email so there is a written, time-stamped record of when you reported it.
Tell one other person in your household. The same caller usually tries the next number on their list.
Reporting late is still worth doing, but every minute reduces what a bank can recall or freeze downstream.
If this has already happened to you, start here“No real bank asks you to move money to keep it safe.”
Remember one sentence. Send this to one person who would have believed the call. That is the whole point of it.
For banks and organisations
Wimika RMS Technologies helps institutions cut fraud losses and recover faster, including MoneyGuard, which flags covered fraud risk before the money moves.
MoneyGuard for financial institutions© Wimika RMS Technologies. Free to share for customer awareness. General information only, not financial or legal advice.
More guidance in the Safety Centre