Since 2011, Nigeria has spent about $630 million to build a functional national identity system. That year, the federal government under Goodluck Jonathan approved 30.66 billion guilds to provide electronic ID cards to all Nigerians over 18 years of age.
So when Fij revealed Xpressverify in April 2024, a rogue website sold sensitive data from Nigerians at prices as low as N200 per search, it started a national dialogue and led to automatic reservations by agencies such as the National Data Protection Commission (NDPC) and the National Information Management Commission (NIMC).
Despite no official contact with NIMC, the website still has access to the national identity database and is using this access to make illegal profits.
The rebound is fast. NIMC temporarily suspended all third-party access to the national identity database and later restored only the so-called “basic service providers”.
NDPC launched an investigation and warned NIMC or any negligent agents that could face the highest annual income fine, accounting for 2% of their annual income. Early discoveries suggest that one of the NIMC’s licensed agents may be the source of the leak.
Follow-up and enlightenment
I decided to follow up in July. After all, a civil society organization Paradigm Initiative said Xpressverify is not an isolated case after the 2024 Fij story.
Out of curiosity and concern, I started searching for other websites that offer NIN or BVN verification services. I didn’t expect to find too much. Of course, all vulnerabilities will be sealed after the Xpressverify scandal.
What I found was ninprint.com.
Ninprint uses itself as a brand of “digital identity and background check companies” and provides a dazzling list of services. It claims to verify the NIN using a phone number, a virtual NIN or a document number.
It also promises BVN searches by name, date of birth, gender and phone number. It only uses the tracking ID to retrieve the missing NIN. It verifies bank accounts for immigration purposes and runs CAC and driver’s license lookups.
It even provides voter card access, bank slip recovery and “people tracking” services. According to the homepage, the fee is only a few hundred naira.
Testing Services
To test the services provided by Ninprint, I sought the consent of some colleagues. We put together a few phone numbers and decided to give it a try. I have to fund my account before doing any searches. That step reveals more.
The platform is run by Abbeytech Ventures, a sole proprietorship registered by Abdullahi Shogbanmu Abiodun with its RC Number Number bn-2858320.
FIJ tracks the phone number linked to the company to the web boat, which is also advertised on Facebook as a New York State Registration Center recognized by the New York State. When I called to inquire about his contact with NIMC, the defendant got angry and suddenly ended the call.
Still curious, I funded my account with N150 and tried some searches. Some people fail and just deduct the money.
But in the fourth attempt, the platform produced results. I was able to access information on NIN and BVN connections using only phone numbers (including those of three Nigerian journalists).
The meaning is serious.
Exposing sensitive information such as BVN, NIN, address and other personal data puts an individual at risk. Criminals can use these details to steal identities, open bank accounts, accept loans, or commit crimes in the name of the victim.
By accessing an individual’s BVN, fraudsters can also bypass some bank verification processes and conduct unauthorized transactions and may drain bank accounts.
Exposure of multiple data points makes the situation worse. When criminals can link a person’s NIN, BVN, phone number and address, building a complete profile becomes easy to utilize.
This allows for more targeted scams, phishing attempts and social engineering attacks. In some cases, the victim may even include it in a banking service if he uses details in a fraudulent transaction.
In addition to financial risks, there are also physical and emotional consequences. Knowing the victim’s home address and phone number can lead to harassment, stalking, and even kidnapping. If the victim uses a stolen identity to commit a crime and their personal privacy is permanently compromised.
How to say the law
Article 14 of the NIMC Act 2007 gives the Commission its sole responsibility for the establishment and maintenance of national identity databases.
Article 26 provides that personal data can only be accessed with the consent of an individual, court order or regulation. Article 28 provides that a criminal offence is subject to a criminal offence without legal authorization, disclosure, sale or use of identity information, and a fine of at least one million guild and/or a minimum of three years in prison.
The Nigeria Data Protection Act (NDPA), 2023, is equally clear. Section 25 requires the data controller to process personal data legally, fairly and transparently.
They must have legal basis, such as consent, contract or legal obligations, and must inform the individual how to use their data and whom they share with.
Article 41 stipulates that if data is leaked, the controller must notify the NDPC within 72 hours and notify the affected person when the risk is high.
Sections 48 and 49 authorize NDPC to impose serious fines for these data violations, including fines up to 10 million n10 million of the company’s annual revenues to be included in 10 million guilds or 2%.
Ninprint’s campaign raises the same question Nigerians asked when they exposed Xpressverify in 2024. How many websites in the country’s database can access sensitive data? How long has another violation exposed millions of Nigerians again?
NIMC spokesman Kayode Adegoke acknowledged Fij’s information, notified the agency about the violations and promised that it would be resolved as soon as possible.
