Nigeria’s Cyber Law Overhaul Faces an AI-Driven Fraud Test

By Olivia Hart

TechCabal reported that AI was linked to 55% of cybercrime incidents recorded across Africa in 2025, while deepfake cases rose sevenfold between the second and fourth quarters of 2024.

AI lets criminals automate scams, manufacture convincing identities and find weaknesses faster. The source provides no Nigerian breakdown or classification method for the 55% figure, leaving direct exposure uncertain.

That gap drives Nigeria’s review. The government says existing frameworks lack adequate guardrails and full alignment with international best practices. It is reviewing cybercrime enforcement, institutional standards and digital-economy governance.

The government also considers a national cybersecurity architecture with baseline standards nationwide. The proposal sets no enforcement timetable, budget or penalties. Without stronger enforcement and local expertise, it could expand state surveillance without improving safety.

Which laws are changing?

The reforms run along three tracks:

• The Cybercrimes (Prohibition, Prevention, etc.) Act 2015, amended in February 2024.
• The National Cybersecurity Policy and Strategy, introduced in 2014 and revised in 2021, with its five-year review due in 2026.
• The National Digital Economy and E-Governance Bill 2025, which held a public hearing in Abuja in November 2025 and seeks a legal framework for digital services and e-governance.

A broader policy review convened lawmakers, government agencies and industry stakeholders in Lagos.

The government says it has advanced a draft executive bill to strengthen legal protection against cyber threats. In October 2026, Adedeji Stanley Olajide, Chairman of the House Committee on ICT & Cybersecurity, told TechCabal at the International Cybersecurity Conference in Abuja: “the timeline is immediately after the election…” He said little could happen during political campaigns.

Olajide nevertheless expected the cybercrime, cybersecurity and digital economy bills to be enacted between January and June 2027. He said the laws would curb cyberbullying and enforce stricter compliance and security standards across finance. A report cited by Premium Times said nine in ten Nigerian children face risks from cyberbullying, harassment and online exploitation.

The legislative calendar is clear; enforcement remains undefined.

What are the financial stakes?

NIBSS figures put Nigeria’s electronic-payment fraud losses at ₦25.85 billion ($19.2 million) in 2025. In September 2026, the Central Bank of Nigeria warned banks, fintechs and payment service providers that cyber risks and AI-driven vulnerabilities directly threaten financial stability.

TC Insights’ report, The Compliance Reckoning: Regulating Financial Services in the Age of AI, said gross fraud losses fell in 2025 while AI-powered attacks grew more sophisticated. It linked rising regulatory fines to systemic compliance risk.

The Nigeria Data Protection Commission fined MultiChoice Nigeria ₦766.24 million ($568,630) in 2025 for data-protection breaches and unauthorized cross-border transfers of personal data. The NDPC also opened investigations into 1,369 organizations across banking, insurance, pensions and gaming.

The Economic and Financial Crimes Commission separately investigated a ₦3 billion ($2.23 million) fraud scheme that targeted First City Monument Bank customer accounts through unauthorized access.

The cases show enforcement activity, but they do not erase the losses or close the vulnerabilities.

Why are public systems exposed?

TechCabal reported that suspicious voter records in an AI-generated photo controversy entered the Independent National Electoral Commission’s database through authorized terminals operated by officials, not through an external hack. The episode exposed weak access controls, staff monitoring and pre-entry data verification.

BusinessDay reported that a Corporate Affairs Commission breach exposed more than 15 million corporate documents and beneficial ownership records. The Guardian reported that Remita, the central payment gateway for Nigeria’s Treasury Single Account, exposed nearly three terabytes of financial data through a misconfigured cloud storage bucket.

At a five-day cybersecurity training for ministry, department and agency personnel in June, NDPC National Commissioner Vincent Olatunji said the commission’s portal faced more than 2,000 cyberattack attempts in one week.

Esentry and Darktrace found that attackers rarely force their way through software flaws. Compromised credentials and weaponized internal trust often bypass conventional alerts. Their partnership said West Africa lost over ₦1 billion ($742,104) in fraudulent transactions that passed legacy controls in the first half of 2026.

Nigeria accounted for only 5%—about one in 20—of Darktrace-observed regional incidents, behind South Africa’s 45% and Kenya’s 6%. Yet ransomware appeared in four of five investigated Nigerian cases, and data exfiltration in two of five. Esentry and Darktrace said AI-enabled behavioral evasion lets attackers mimic legitimate users, hijack authorized workflows and undermine static firewalls and manual audits.

Low regional visibility is not evidence of low risk; TechCabal says exposed registries hold data essential for corporate verification and anti-money-laundering enforcement.

How will Nigeria build local capacity?

The National Digital Cloud Policy offers tax and duty waivers on servers and data-center infrastructure. It directs federal agencies to move legacy systems to the cloud while keeping sensitive national data, including biometric and healthcare records, in Nigeria.

Official government reports cited by TechCabal said Nigeria allocated ₦4.5 trillion ($3.34 billion) to information technology between June 2023 and June 2026. Vanguard reported that the government aims to attract $250 million in private investment within 12 months and $750 million within 24 months.

Capital targets do not prove security capacity. Abdul-Hakeem B.D. Ajijola, Chair of the African Union Cyber Security Expert Group, set the test plainly: “the value of security investments must be measured by the capabilities that remain after vendor contracts expire.” Without local engineers, Nigeria risks vendor lock-in.

Esentry and Darktrace expect AI to become standard offensive infrastructure. Their second-half 2026 forecast points to faster deepfake-driven executive fraud, software supply chain compromises and automated ransomware against cloud assets.

The investment test is retained technical capability, not money committed.

Can stronger laws deliver?

TechCabal says legislation can clarify agency duties and expand investigative mandates, but expanded oversight must preserve privacy and civil liberties.

The operational tests are faster detection, prompt patching, mandatory breach disclosure, rapid recovery and penalties for non-compliance with minimum standards. The broader measures are higher prosecution rates, fewer systemic breaches and stronger data protection.

If Nigeria does not attach enforceable standards, sustained local engineering capacity and credible enforcement to its bills, passage will mark political intent rather than safer public services.