Identity Theft Concerns Rise as OPay and PalmPay Face Account Manipulation Issues

In recent incidents across Nigeria, there have been reports of fraudulent activities involving the opening of OPay and PalmPay accounts using unsuspecting individuals’ identities. The issue came to light when cases emerged of accounts being created under the full legal names of individuals without their knowledge.

One instance involved an elderly individual whose phone was stolen, leading to fraudulent OPay accounts being opened in her name, resulting in a financial loss. Similar cases targeted high-profile individuals, including tech CEOs, raising concerns about the vulnerability of the account creation process.

Investigations uncovered a potential loophole in OPay’s account creation, where, in addition to standard NIN/BVN verification, a third method, “Verify with bank account,” was identified. This method appeared to be less stringent, allowing fraudsters to manipulate the system using a phone number, facial recognition, and any name and address, facilitating identity theft.

A video circulating online demonstrated how someone opened an OPay account using the name of a popular actress, prompting further concern. Testing this process, it was confirmed that an OPay account could be opened seamlessly with a friend’s phone number and commercial bank account details.

PalmPay, which also features a “verify with bank accounts” option, was found to have a similar vulnerability, allowing account creation with any name without verification, enabling transactions up to ₦50,000.

These incidents highlight broader implications for the growing financial fraud epidemic in Nigeria, with concerns raised over unlicensed financial services companies posing as deposit-taking institutions. While the CBN has mandated the use of NIN for tier 1 wallets and bank accounts, questions arise about the effectiveness of these measures.

As the investigation unfolds, the key question remains: Is the Central Bank of Nigeria (CBN) aware of these vulnerabilities, and if so, what actions are being taken to address them and enhance the security of digital payment systems?