EXCLUSIVE: Nigerians’ NINs, BVNs, Photos Still for Sale Online. I Bought 4 With Just N560

 

Since 2011, Nigeria has spent about $630 million trying to build a functional national identity system. That year, the federal government under Goodluck Jonathan approved N30.66 billion to provide electronic ID cards to all Nigerians above the age of 18.

By 2019, the country secured a $433 million World Bank-backed grant supported by the French Development Agency (AFD) and the European Union. The project’s goal was to register at least 148 million Nigerians by mid-2024 and strengthen the country’s identity management infrastructure.

When FIJ uncovered XpressVerify in April 2024, a rogue website selling access to sensitive data of Nigerians for as little as N200 per search, it started a national conversation and caused agencies like the National Data Protection Commission (NDPC) and the National Information Management Commission (NIMC) to take reactionary precautions.

The site had access to the national identity database despite having no official ties to NIMC, and it was using this access to make a profit illegally.

The backlash was swift. NIMC temporarily suspended all third-party access to the National Identity Database and later restored only what it called “essential service providers”.

NDPC launched an investigation and warned that NIMC, or any negligent agents, could face fines of up to N10 million or 2 per cent of their annual revenue. Early findings hinted that one of NIMC’s licensed agents as the likely source of the leak.

FOLLOW UP AND REVELATION

I decided to follow up in July. After all, Paradigm Initiative, a civil society group, had stated that XpressVerify was not an isolated case after FIJ’s story in 2024.

Out of curiosity and concern, I began to search for other websites offering NIN or BVN verification services. I didn’t expect to find much. Surely, after the XpressVerify scandal, all loopholes would have been sealed.

What I found instead was NINPrint.com.

NINPrint brands itself as a “digital identity and background check company” and offers a dizzying list of services. It claims to verify NINs using phone numbers, virtual NINs or document numbers.

It also promises BVN searches by name, date of birth, gender and phone number. It retrieves lost NINs using only tracking IDs. It validates bank accounts for immigration purposes and runs CAC and driver’s licence lookups.

It even offers voter card access, bank slip recovery and “people tracking” services. The cost of this, according to the homepage, is just a few hundred naira.

TESTING THE SERVICE

To test the services NINPrint offered, I sought the consent of some colleagues. We pooled a few phone numbers and decided to try it out. Before I could run any search, I had to fund my account. That step revealed even more.

The platform is operated by Abbeytech Ventures, a sole proprietorship registered by Abdullahi Shogbanmu Abiodun with RC number BN-2858320.

Traced the phone number linked to the company to a cybercafé that also advertises itself on Facebook as an accredited NYSC registration centre. When I called to ask about its connection to NIMC, the respondent became irritated and abruptly ended the call.

Still curious, I funded my account with N150 and attempted a few searches. Some failed and simply deducted the money.

But on the fourth attempt, the platform produced results. I was able to access NIN and BVN-linked information using only phone numbers, including those of three Nigerian journalists.

Exposing sensitive information such as BVN, NIN, addresses and other personal data puts individuals at risk. Criminals can use these details to steal identities, open bank accounts, take loans or commit crimes in the victim’s name.

With access to an individual’s BVN, fraudsters can also bypass some bank verification processes and carry out unauthorised transactions, potentially draining bank accounts.

The exposure of multiple data points together makes the situation even worse. When criminals can link a person’s NIN, BVN, phone number and address, it becomes easy to build a complete profile to exploit.

This allows for more targeted scams, phishing attempts and social engineering attacks. In some cases, victims may even be blacklisted from banking services if their details are used in fraudulent transactions.

Beyond financial risks, there are physical and emotional consequences. Knowing a victim’s home address and phone number could lead to harassment, stalking or even kidnapping. Victims may also face reputational damage if their stolen identities are used to commit crimes, and their personal privacy is permanently compromised.

WHAT THE LAWS SAY

Section 14 of the NIMC Act, 2007, gives the Commission sole responsibility for establishing and maintaining the National Identity Database.

Section 26 states that personal data can only be accessed with the individual’s consent, a court order or as prescribed by regulation. Section 28 makes it a criminal offence to “without lawful authority access, disclose, sell or use” identity information, punishable by a fine of at least N1 million and/or a minimum of three years in prison.

The Nigeria Data Protection Act (NDPA), 2023, is just as clear. Section 25 requires data controllers to process personal data lawfully, fairly and transparently.

They must have a legal basis, such as consent, a contract or a statutory obligation, and must inform individuals how their data is being used and who it is being shared with.

Section 41 mandates that in the event of a data breach, the controller must notify the NDPC within 72 hours and inform affected individuals if the risk is high.

Sections 48 and 49 empower the NDPC to impose heavy penalties for these data violations, including fines of up to N10 million or 2 per cent of a company’s annual gross revenue.

NINPrint’s activities raise the same questions Nigerians asked when XpressVerify was exposed in 2024. How many more websites have access to sensitive data in the country’s databases? And how long before another breach leaves millions of Nigerians exposed again?

Kayode Adegoke, the NIMC spokesperson, acknowledged FIJ’s message notifying the agency about the breach and promised to address it as soon as possible.