Your phone buzzes at 4:50 pm. The SMS says: "Dear customer, your BVN will be blocked today. Update now" followed by a link. Or a caller who sounds polite says he is from your bank's "verification unit" and needs a code "to stop your account from being restricted." Both are the same trick: create panic, then get you to hand over the keys yourself.
This guide shows you how to recognise these messages, what to do in the first ten minutes if you already responded, and how to set up your phone and accounts so the next attempt fails.
How the scam works
Phishing means a criminal pretends to be a trusted organisation to make you reveal private information. It arrives by SMS (sometimes called smishing), by phone call (vishing), by WhatsApp or by email. The BVN angle works because almost every adult Nigerian has one, and people know banks have asked them to link BVN and NIN before.
The scammer's goal is usually one of four things:
- Your login details for a banking or fintech app, captured on a fake website that looks like the real one.
- A one-time password (OTP) sent to your phone. If the scammer is logging in as you or adding a new device, that code is the last barrier.
- Your card details: number, expiry date, CVV and PIN.
- Your identity data: BVN, NIN, date of birth, mother's maiden name, used to open loan accounts or reset passwords.
Red flags in the message or call
Urgency and threats
"Your account will be blocked in 24 hours" is the standard line. Real banks do send notices, but they do not threaten you into acting within minutes through a random link.
A link you did not ask for
Look closely at the address. Fake sites use spellings like extra words, swapped letters, or unusual endings. Shortened links hide the destination completely. If a message wants you to type your login on a page reached through a link, treat it as hostile.
Requests for secrets
No genuine bank staff member needs your PIN, password, CVV, OTP or token code. Those exist so that only you know them. Anyone asking, for any reason, is the problem.
A sender that does not match
Calls from ordinary mobile numbers claiming to be a bank, messages from a number rather than the bank's usual sender name, or WhatsApp messages from "customer care" are all warning signs. Caller ID and sender names can be faked, so a familiar look proves nothing.
Poor or odd wording
Spelling mistakes, "Dear customer" instead of your name, and mixed capital letters are common, though better-written scams exist. Do not rely on bad grammar alone to spot them.
Prizes and "refunds"
Messages saying you won a promo, are owed a refund, or qualify for a "BVN bonus" or grant are bait. Free money that needs your details first is not free.
What you should know about BVN
Your BVN is a number tied to your biometrics and bank accounts. Knowing it alone does not let someone move your money, but combined with your phone number, date of birth and an OTP, it can help them take over accounts or apply for loans in your name. Treat it like a PIN-adjacent secret.
If you genuinely need to update BVN details, do it in person at your bank branch or through the official channel the bank itself directs you to when you contact it. For the rules and any current process, check the Central Bank of Nigeria and NIBSS official sites rather than trusting a message that reached you. Details change, so confirm before acting.
The same applies to NIN. Our NIN guide may not exist at that address, so use the official NIMC website for linking steps and ignore anyone who calls to "link it for you."
Worked example (hypothetical)
Ada, a trader in Enugu, gets a call from someone who says he is from her bank. He knows her name and the last four digits of her account number, which makes him sound real. He says a suspicious ₦250,000 transfer is pending and to cancel it she must read out the code just sent to her phone.
That code is actually the one authorising a new device on her banking app. If she reads it out, he logs in as her and empties the account. The details he knew came from earlier leaks or a receipt she had shared. Knowing a few facts about you is not proof of identity.
What Ada should do: say nothing about the code, end the call, and phone the number printed on her card or on the bank's official website. If the bank has no such alert, the call was fake. Total cost: two minutes.
What to do right now if you already responded
- Call your bank immediately using the number on your card or the official website. Ask them to block the card, restrict the account or freeze transfers.
- Change passwords and PINs for your banking and fintech apps, and for your email, since email is often used to reset everything else. Do this from a device you trust.
- Log out all other devices in app settings where that option exists, and remove any device you do not recognise.
- Contact your mobile network if you gave out details tied to your SIM or notice you suddenly lost signal. See our guide on SIM swap fraud.
- Write down evidence: screenshot the SMS, note the number, time, and what you shared, and keep transaction records.
- Report it. Follow the steps in how to report a scam in Nigeria, and put the complaint in writing to your bank so there is a record.
Speed matters. Money moved a few minutes ago is far likelier to be traced or held than money moved days ago. Do not be embarrassed; banks handle these calls daily.
Set up your phone and accounts so these scams fail
Use the bank's own channels only
Save your bank's official customer care number and its app in your phone. When any message mentions your account, open the app directly or call the saved number. Never use the link or number in the message.
Lock down the basics
- Use a strong, unique password for each financial app, ideally from a password manager.
- Turn on app lock or biometric login and set transaction limits you can live with.
- Add a PIN to your SIM so a thief cannot easily use it in another phone.
- Keep your phone's system and banking apps updated, and install apps only from official stores.
Keep OTPs private even from family
Scammers sometimes hit a relative first, then message you pretending to be them. Agree a rule: codes are never shared, whoever asks.
Be careful where your details end up
Photos of your ID, bank slips and screenshots with account numbers give scammers the facts that make their calls convincing. Delete them from chat groups and avoid posting them online.
How to check a suspicious message in 60 seconds
| Question | If yes |
|---|---|
| Does it ask for a PIN, password, CVV or OTP? | Scam. Stop and delete. |
| Does it contain a link to "update" or "verify" something? | Do not click. Open the official app instead. |
| Does it threaten blocking or arrest within hours? | Pressure tactic. Call the bank on its official number. |
| Is the caller or sender unknown to your bank's records? | Hang up and ask the bank to confirm. |
| Does it promise a prize, refund or grant? | Ignore. Real refunds come through your bank, not a link. |
Common mistakes
- Trusting the caller because he knows your name. Names and partial numbers are easy to buy or guess.
- Calling back the number that called you. Dial from your own saved contact or card.
- Staying on the line. Scammers keep you talking so you cannot think. Hanging up is fine and safe.
- Waiting to see whether money disappears. Report as soon as you suspect something.
- Paying a "recovery agent." People who contact you offering to get your money back are often a second scam. Read why victims get targeted twice.
If you are in Ghana, Kenya or South Africa
The pattern is identical, only the names change: fake mobile money "reversal" calls, fake bank or telecom messages, and fake "SIM registration" prompts. Contact your own provider through its official number or app, and report to your bank and local police or cybercrime unit. Check your regulator's official site for the current reporting process.
Frequently asked questions
Can someone steal my money with only my BVN?
Not by itself in most cases, but it helps them impersonate you and answer security questions. Do not share it casually, and never with unsolicited callers.
Is it safe to click a link if I do not enter anything?
Safer, but not safe. Some pages try to install harmful apps or collect device information. Avoid opening it at all.
My bank really did send me a text. How can I tell?
Do not judge from the text. Open the bank app or call the official number and ask whether any action is needed. Genuine requests will appear there.
I gave out my OTP but no money has moved. What now?
Call the bank anyway, change your passwords, and remove unknown devices. The scammer may be waiting.
Your next step today
Save your bank's official customer care number in your phone under its real name, then tell one relative or friend the rule: no one gets a code, PIN or password, ever. Two minutes now can stop the next call.
This article is for general information only and is not financial, legal, or tax advice. Prices, rates and rules change quickly, so check current details before making money decisions.