Chief Information Security Officer Akinwumi Ayodele has outlined the top five cyber risks that fintech organisations in Nigeria must monitor closely this year, highlighting the shift from simple scams to complex, multi-layered attacks.
These risks include AI-powered deepfake identity fraud, systemic API and open banking contagion, exploitation of “race conditions” in instant payments, advanced ransomware-as-a-service, and the “orphaned account” insider threat.
Ayodele said the use of generative artificial intelligence will pose the number one technical challenge in 2026. Fraudsters are expected to use high-fidelity deepfake videos and audio to bypass digital identity checks, including the proof-of-life steps commonly used during Know Your Customer onboarding. AI-generated voices may also be deployed to impersonate bank officials or relatives in sophisticated social engineering attacks.
“This will compromise remote onboarding systems and enable the creation of fake accounts at scale,” Ayodele told The PUNCH. He advised fintechs to invest in AI detection tools, secondary communication channels for identity verification, and simulated attack drills to treat deepfakes as a high-level strategic risk.
As Nigeria’s open banking framework matures, fintechs are becoming increasingly interconnected, creating supply chain vulnerabilities. A single weak link in a shared service, such as an identity verification partner or payment switch, could trigger cascading attacks across multiple platforms.
Ayodele described the risk as a “hub-and-spoke” scenario, where compromising one central provider gives attackers access to the data of dozens of downstream fintechs. To counter this, he recommended adopting a Zero Trust architecture that prioritises containment over perimeter defence.
With the Nigerian Inter-Bank Settlement System enabling near-instant transfers, attackers may exploit millisecond gaps between transaction authorisation and settlement to conduct double-spending or “shadow credit” attacks.
“Everything is real-time in fintech, which shrinks the window for fraud detection,” Ayodele said. He suggested structural solutions, including treating multi-step actions as indivisible transactions, assigning unique receipt numbers, implementing distributed locking, and using message queuing to ensure that balance checks and deductions happen simultaneously. These measures, he explained, would prevent timing-based financial losses.
Ayodele noted that Nigerian fintechs are increasingly on the radar of global ransomware syndicates. He warned of “Big Game Hunting”, where attackers target platforms with high technical debt or legacy systems integrated with cloud infrastructure. Such attacks may involve “triple extortion”: encrypting data, stealing it for public leak, and launching distributed denial-of-service attacks simultaneously.
To mitigate these threats, he urged fintechs to maintain immutable backups, monitor and encrypt outgoing data, deploy cloud shields to deflect traffic, and isolate ageing systems to prevent breach propagation.
Finally, Ayodele highlighted insider risks stemming from rapid staff turnover and talent emigration. “Orphaned” administrative accounts that remain active or poorly documented systems may be exploited by disgruntled employees or sold to cybercriminal networks.
Organisations, he said, should automate the deactivation of access via HR-linked systems, enforce just-in-time administrative permissions, and require peer reviews to prevent malicious backdoors.
Ayodele advised that Nigerian fintechs must treat these threats as strategic priorities, combining technology, process improvements, and organisational vigilance to protect financial data and maintain public trust in the digital finance ecosystem.
The Nigerian fintech sector is facing a rapidly evolving cyber threat landscape in 2026, with artificial intelligence, open banking, and other economic factors driving more sophisticated attacks.
Read the full article here
