Source: https://tilburglawreview.com/articles/10.5334/tilr.137/
Timestamp: 2019-04-23 05:59:53+00:00

Document:
This paper1 examines the consumer protection regime under the Nigerian Cybercrimes Act with a view to assessing the extent to which it protects consumers from cybercrimes in the banking and financial sector. It finds that the regime is not adequate as it does not place sufficient obligations on banks and financial institutions to safeguard the personal information of their customers from unauthorized access. Additionally, the findings suggest the absence of an explicit regime for determining liability for unauthorized payment transactions in situations where a consumer’s electronic banking or payment information is compromised. The article also highlights examples of legal regimes in Europe and the United States that could be adopted in order to strengthen the consumer protection regime under the Act. Finally, some challenges impeding the protection of consumers from cybercrimes in the Nigerian banking and financial sector are pointed out along with proposed responses to address them.
Nigeria currently has the largest population of internet users and mobile telecommunications subscribers in Africa.2 Data released by the Nigerian Communications Commission (NCC) in 2018 indicates that Nigeria had over 100 million internet subscribers,3 and over 150 million mobile telecommunications subscribers.4 However, increasing internet penetration and telecommunications access in Nigeria has had implications on the rise of cybercrime in the country. In particular, there has been a growing trend in the perpetration of cybercrime such as phishing, electronic card fraud, Automated Teller Machine scams, hacking, malware attacks, identity theft, denial of service attacks,5 and Business Email Compromise fraud.6 A report by a non-governmental organization, Paradigm Initiative Nigeria, estimates that the annual and potential cost of cybercrime to the Nigerian economy is over 13 billion US dollars.7 One sector that has been affected by the growing trend of cybercrime in Nigeria is the banking and financial services sector. In this regard, both banking and financial institutions as well as their customers have repeatedly been targets of cybercrime activities.8 Despite this development, however, the Nigerian government appeared slow in providing an elaborate legal response that will ensure the protection of consumers.9 Finally, in 2015, the Cybercrimes (Prohibition and Prevention) Act10 was enacted to criminalize cybercrime and provide for the protection of critical information infrastructure. The Act also introduced a range of provisions aimed at protecting the users of electronic banking and payment services from cybercrime. This paper seeks to examine these consumer protection provisions with a view to assessing the extent to which they can effectively protect consumers in the Nigerian banking and financial sector from cybercrime. The paper observes that the Act’s consumer protection regime is not adequate as some of its provisions, such as section 19(3), do not place sufficient obligations on banks to safeguard the personal banking information of their customers. It also identifies the absence of a liability regime on unauthorized payment transactions where a consumer’s electronic banking or payment information is compromised. Additionally, the article highlights comparative examples of legal regimes that protect consumers of electronic banking and payment services in technologically advanced jurisdictions such as the European Union and the United States, with a view to identifying lessons that could be adopted in order to strengthen the consumer protection regime under the Cybercrimes Act. To this end, some tentative reform proposals to the Act are put forward. Finally, the paper points out some general challenges impeding the protection of consumers from cybercrime in the Nigerian banking and financial sector and proposes responses to address them.
The article is organized as follows. The remainder of this first section will discuss the meaning of the terms ‘cybercrime’ and ‘consumer protection’, including an overview of the essence of consumer protection in electronic banking and payment services. It will also provide a background on the Nigerian banking and financial sector. The second part will then focus on the development of Nigeria’s legal response to cybercrime, and most notably the Nigerian Cybercrimes (Prohibition and Prevention) Act of 2015. The third section will analyze selected provisions of the Act that aim to protect consumers of electronic banking and payment services from cybercrime. Subsequently, the fourth section will discuss some challenges impeding the protection of consumers from cybercrime in the Nigerian banking and financial sector and propose appropriate responses. Finally, the main findings are summarized in the conclusion.
There is no universally accepted legal definition of cybercrime or computer crime. Generally, ‘cybercrime’ or ‘computer crime’ are often used interchangeably to refer to instances where digital technologies are either the target of a malicious or unlawful activity or the instrument for facilitating a crime or malicious activity. Thus, ‘cybercrime’ (or computer crime) is used as an umbrella term to refer to all forms of crime perpetrated with the help of computer resources, regardless of whether the final target is a computer resource itself or not.11 Cybercrime has also been defined as “computer-mediated activities which are either illegal or considered illicit by certain parties and which can be conducted through global electronic networks”.12 Accordingly, the term is used to describe a range of offences including traditional computer crimes, as well as network crimes.13 However, there are different views as to the most appropriate legal definition of what constitutes ‘cybercrime’ or ‘computer crime’.14 Generally, cybersecurity laws tend to avoid such explicit definitions.15 In this paper, cybercrime will be used to broadly refer to electronic crimes that target users of electronic banking and payment services including phishing, electronic card fraud, Automated Teller Machine scams and hacking of bank accounts.
Before defining the concept of ‘consumer protection’ it appears imperative to first consider the meaning of a ‘consumer’. The Blacks Law Dictionary defines a ‘consumer’ as “a person who buys goods or services for personal, family or household use, with no intention of resale [or] a natural person who uses products for personal rather than business purpose”.16 Another definition states that a ‘consumer’ is a “[person] who uses or requests a service for non-business use and would include someone not contractually bound to the supplier”.17 The Nigerian Consumer Protection Council Act defines a ‘consumer’ as “an individual who purchases, uses, maintains or disposes of product or services”.18 Thus, in generic terms, a ‘consumer’ refers to an ‘end-user’ of goods or services. In the banking and financial services context, a ‘consumer’ or ‘customer’ would then mean any person who subscribes to or uses the services of a banking or financial institution. Such services may include deposit, savings, credit, debit, money transfer, or electronic banking and payment services.
Generally, the essence of consumer protection is underscored by the need to prevent suppliers from exploiting the vulnerability of consumers. This need appears to arise from reasons including the disparity between the bargaining power of the consumer and the resources of the supplier, and the disparity between the knowledge of a supplier and that of the consumer with respect to a particular product or service. There is also the assumption that suppliers, given their expertise and knowledge, can manipulate demand and prices to the detriment of consumers and further diminish the ability of consumers to make choices. With respect to electronic banking and payment services, the essence of consumer protection arises from the need to ensure that consumers have a high degree of trust in the use of such services, and thereby promoting the adoption and sustained use of electronic banking and payment systems and platforms in conducting financial transactions. Thus, consumer protection in electronic banking and payment services particularly aims to guarantee the protection of consumers’ basic rights by ensuring that consumers are protected from acts such as unauthorized electronic access to their accounts or personal financial information by either service providers or unauthorized third parties, and that service providers and liable third parties will be held to account where such rights and security requirements are breached.
The Nigerian banking and financial services sector comprises twenty two major commercial deposit money banks,25 as well as special investment banks and community banks, and non-bank financial institutions.26 The sector is regulated by government institutions including the Central Bank of Nigeria (CBN) and the Nigeria Deposit Insurance Corporation (NDIC). In particular, the CBN is responsible for regulating and supervising the commercial activities of banks and financial institutions,27 and also has a consumer protection unit that manages complaints made by consumers against banks and financial institutions,28 while the NDIC is responsible for insuring the deposit liabilities of Nigerian banks and supervising insured banks.29 Aside from the CBN and the NDIC, government agencies such as the Economic and Financial Crimes Commission (EFCC) and the Consumer Protection Council (CPC) have mandates that apply in the banking and financial sector. For example, the EFCC can investigate financial crimes such as cybercrime in the banking and financial sector,30 while the CPC can take measures to protect consumers in the sector.31 Thus, in light of the above regulatory landscape of the Nigerian banking and financial sector, it can be discerned that there are multiple government institutions and agencies whose powers and regulatory mandates apply in different aspects of the sector.
Some of the major factors that appear to be responsible for this slow adoption of electronic banking and payment channels include low levels of consumer literacy, consumer protection concerns and concerns over cybercrimes such as electronic card fraud.41 With respect to cybercrime, the CBN has observed an increase in number and sophistication of cybersecurity threats that target banks and electronic payment service platforms.42 A report from the Nigerian Inter-Bank Settlement System (NIBSS) estimates that the banking sector lost over 12 billion Naira to various forms of cybercrime between 2014 and 2017.43 Cybercrimes that target consumers in the Nigerian banking and financial sector include phishing, electronic card fraud, ATM scams, hacking of bank accounts and Business Email Compromise fraud.44 It may not be possible to totally eradicate all cybercrime which target consumers that use banking and payment channels. However, the population of consumers using such channels for transactions would likely increase with improved consumer protection responses that enhances a high degree of consumer trust in the use of those channels.
In 2006, Nigeria enacted the Advance Fee Fraud Act57 to tackle advance fee fraud activities in Nigeria. The language of the Act is couched in a manner that criminalizes advance fee fraud activities regardless of whether such activities were perpetrated in a physical environment, or on the internet. The Act also criminalizes activities that constitute advance fee fraud where there is intent to defraud persons in Nigeria, or any other country.58 Offences under the Act include the act of obtaining property by false pretense,59 and the laundering of funds obtained through advance fee fraud activities.60 In order to prevent the use of internet and telecommunication facilities and services for the purpose of perpetrating advance fee fraud, the Act requires telecommunication service providers and internet service providers as well as the proprietors of telephone and internet cafes to identify their subscribers and customers61 and register their business with the EFCC.62 The Act also requires the above businesses to exercise a “duty of care” by ensuring that their services and facilities are not utilized for the perpetration of advance fee fraud scams.63 However, while the Act criminalized advance fee fraud scams such as email scams, it did not criminalize other forms of cybercrime that could affect consumers of electronic banking and payment services such as unauthorized access, system interference, phishing, card fraud and ATM scams.
The Nigerian Cybercrimes Act generally criminalizes several forms of cybercrime that affect the banking and financial sector. For example, the Act criminalizes computer related forgery;77 computer related fraud; 78 the transmission of electronic mails with intent to defraud;79 unlawful diversion of banking and financial electronic mails with intent to defraud;80 unauthorized modification of computer data;81 unauthorized hindering of computer systems;82 insider collusion to perpetrate fraud on bank customers;83 and, the theft of payment terminals or electronic devices such as ATM and PoS terminals.84 In addition to the above, the Act establishes specific provisions that aim to protect consumers of banking and financial services. Those specific provisions will be discussed below.
The above provision requires banks and financial institutions to establish effective fraud prevention measures to protect the ‘sensitive information’ of customers held in their computer systems from being unlawfully accessed by unauthorized third parties. The Act does not define the meaning of ‘sensitive information’ and such definition does not exist under relevant banking laws in Nigeria. However, the CBN Consumer Protection Framework of 2016, which Nigerian banks and financial institutions are required to comply with,88 appears to provide an industry working classification of what can be regarded as ‘sensitive information’. In this regard, the CBN Consumer Protection Framework, provides that “the following information are considered to be confidential and shall be protected at all times; contact details, account number and balance, statement of accounts and any other information known to the financial institution”.89 Thus, within the context of section 19(3) of the Cybercrimes Act, ‘sensitive information’ will include personal banking details such as an account name, account number and personal identification numbers or codes which can be used to access a customer’s account to perpetrate fraud, as well as any information about a consumer that has been acquired by a bank or financial institution.
To a large extent under section 19(3) of the Cybercrimes Act, where a security breach occurs, the proof of negligence will lie on the customer who has to prove that the bank or financial institution could have done more to safeguard his or her information. It is submitted this requirement appears to defeat the consumer protection objective of section 19(3). This is because the section does not put the bank or financial institution, which is the stronger party in the contractual relationship with the consumer, in a position where it will bear greater liability for the breach of consumer data held in its computer system. Rather, the section places consumers in a difficult position whereby they will always have to prove that their banks or financial institutions were negligent in all situations where their sensitive data was accessed by unauthorized third parties. In addition, the requirement also weakens the implied fiduciary obligation of secrecy and confidentiality that banks and financial institutions owe the consumers of their services to safeguard their information. Therefore, the provision enshrines a weak liability regime which appears to reduce regulatory incentive for banks and financial institutions that supply electronic banking and payment services to develop effective measures for safeguarding the sensitive personal data of consumers held or processed on their computer systems. The absence of such strong regulatory incentive can however produce the undesirable effect of reducing consumer trust in electronic banking and payment transactions. The challenge presented by the weak liability regime under section 19(3) of the Act is also compounded by the fact that Nigeria has not enacted a data protection law to protect the sensitive personal data of individuals,90 including consumers that use electronic banking and payment services. Furthermore, consumers may lack the requisite information and technical capability to conveniently prove that banks or financial institutions were negligent in safeguarding their data. Also, while the CBN Consumer Protection Framework imposes a duty of care on banks and financial institutions to safeguard the privacy of all personal information of customers including those with closed accounts,91 the Framework does not address the proof of negligence where a security breach has affected customer’s information that is held by a bank or financial institution.
In the Nigerian context, it is submitted that an amendment of section 19(3) of the Cybercrimes Act to adopt an approach that is similar to the EU Directive on Payment Services will have the effect of increasing the protection of consumers of electronic banking and payment services from cybercrime. In particular, adopting such an approach will reduce the high burden of proof on a consumer to prove that the breach of the security of his or her data held by a bank or financial institution resulted from the negligence of such bank and financial institution to adequately protect such data. An amendment that will reduce the high burden of proof on a consumer under section 19(3) also appears necessary because a consumer has very limited information about the security architecture of computer systems of a bank or financial institution that holds or processes his or her data. This will therefore make it difficult if not impossible for a consumer to technically discharge the burden of proof under section 19(3) in order to successfully prove that a bank or financial institution was negligent in safeguarding his or her data from unauthorized access. Therefore, an amendment that will reduce the high burden of proof on consumers will also go a long way towards enhancing the accountability of banks and financial institutions for the security of consumers’ data held in their computer systems.
The above provision prohibits the unlawful issuance of an electronic banking instruction by the staff of a bank or financial institution where there is an intent to defraud. The section does not prescribe that the intent to defraud will have to be targeted at either a consumer or banking/financial institution for criminal liability to attach, and therefore it applies to instances where a consumer is the target. Such instances include where a customer’s account has been debited without authorization by the staff of a bank or financial institution with the intent of defrauding the customer. Thus, the provision recognizes that insiders such as employees of banks and financial institutions can engage in cybercrime that may include the unauthorized issuance of electronic banking or payment instructions with the intent of defrauding customers and therefore it aims to criminalize such acts by insiders within a bank or financial institution.
The above provision criminalizes the theft of a bank or financial institution’s identity by an insider such as an employee with the intent of using such identity for fraudulent purposes. Within context, the section does not prescribe that the intent to defraud will have to be targeted at either a consumer or banking/financial institution for criminal liability to attach, as such, the provision would also cover situations where the staff of a bank or financial institution has unlawfully used its identity or the identity of its employees or consultants to defraud a customer. For example, an employee of a bank that directs a customer to a fake bank website that appears similar to the genuine one, with the intent of defrauding such customer will be liable under section 22(1) of the Cybercrimes Act.
The above section aims to promote consumer protection by prohibiting a service provider or vendor of computer based services (such as electronic banking or payment services) from unlawfully using or forging a consumer’s security code with the intent of defrauding the consumer, or obtaining financial or material gain, or providing less service against the value of money paid by the consumer. For example, the provision will apply where a service provider or vendor of electronic banking or payment services, unlawfully uses or forges a consumer’s security code to make unauthorized withdrawals from the consumer’s bank account.
The above provisions of sections 30(1) and (2) criminalize the manipulation of ATM machines and PoS terminals with intent to defraud and also prohibits the commission or facilitation of such act by insiders such as the employees of banks and financial institutions. The section does not prescribe that the intent to defraud will have to be targeted at either a consumer or banking/financial institution for criminal liability to attach. Therefore, the provision applies to situations where an ATM machine or PoS terminal has been manipulated for the purpose of defrauding a customer. Thus, to a large extent, the provision promotes the protection of the customers of banks or financial institutions that use ATM machine and PoS terminals for electronic banking or payment transactions, and therefore it enhances consumer trust in the use of such electronic banking and payment channels.
Thus, section 21(1) of the Cybercrimes Act imposes a duty on organizations including banks and financial institutions that operate computer systems and networks to report the occurrence of any cyber threats such as unlawful attacks and intrusions that affect consumer data held on their computer systems and networks to Nigeria’s National CERT Coordination Center. In addition, the CBN’s Risk-based Cybersecurity Framework and Guidelines for Deposit Money Banks and Payment Service Providers which Nigerian banks and financial institutions are required to comply with, also imposes a similar reporting obligation on banks and electronic payment service providers by requiring them “to report all cyber-incidents whether successful or not immediately after such incident was identified to the Director of Banking Supervision of the CBN”.111 A major aim of the cyber threat reporting obligation is to facilitate a timely national response to cyber incidents that may affect data held on the computer systems and networks of organizations, including banks and financial institutions that provide electronic banking and payment services. For example, confidential information relating to the bank accounts of consumers that use electronic banking and payment services, which is being held on the computer network of a bank, may be breached as a result of an intrusion into the bank’s network. However, the reporting obligation seeks to ensure that such breaches are properly addressed once they are identified so as limit their escalation across the entire banking and financial sector. As such, the requirement promotes the protection of sensitive consumer data in the sector and also has the effect of improving network resilience and consumer confidence in the use of electronic banking and payment services.
The above provision requires banks and financial institutions to properly identify their customers before issuing them with ATM cards, credit cards, debit cards and other related electronic devices. In practice, the identification of a customer by a bank and financial institution in Nigeria will include the acquisition of the customer’s personal data and biometric details, and the issuance or confirmation of the Bank Verification Number which was introduced by the CBN to create an accurate database of bank customers.113 The proper identification of customers by banking and financial institutions is a crucial element of any banking and financial transaction and usually is a prerequisite for any form of business relationship between a bank and a customer to occur. This duty is commonly known as the “Know Your Customer” (KYC) principle. Generally, the purpose of customer identification is to ensure that a bank or financial institution does not engage in transactions with a customer, unless it is aware of the customer’s identity.114 The KYC requirement under section 37(1) of the Cybercrimes Act has the effect of enhancing consumer protection in the use of electronic banking and payment platforms because it aims to ensure that stolen identification is not used to fraudulently access a consumer’s account. In addition, the KYC requirement helps to ensure that the perpetrators of fraudulent electronic banking and payment activities are traced and held accountable. This also helps to discourage the perpetration of fraud against consumers that use electronic banking and payment services.
The above provision requires a bank or financial institution that has made an unauthorized debit on a customer’s account to provide clear legal authorization for such debit upon a written notification by the customer, or reverse such debit within 72 hours. The provision aims to protect bank customers that use electronic cards on electronic banking and payment platforms from being debited in error due to issues including fraud and the malfunction of payment devices such as ATM and PoS terminals. Apparently, the provision became necessary to address reoccurring cases of unauthorized account debits arising from fraud and the malfunction of ATM terminals in the Nigerian banking industry. For example, there are instances where card users may operate ATMs to withdraw money without success and their accounts are debited in error although they had not obtained money from the machine. There are also instances where a card user may request to withdraw a particular sum of money from the ATM, only for the machine to dispense a lower amount and erroneously debit the card user’s account to the full amount.116 In most cases, a card user whose account has been wrongly debited while using an ATM is faced with the challenge of resolving the issue with the bank and retrieving the debited funds. To address this state of affairs, the Central Bank of Nigeria issued a consumer protection directive in 2010 which required all Nigerian banks to handle all consumer complaints on ATM transactions within 72 hours of receiving such complaint.117 Thus, section 37(3) of the Cybercrimes Act appears to have enshrined that CBN consumer protection directive as part of Nigerian law.
However, the Cybercrimes Act does not establish a regime for determining when card users or their banks/financial institutions are liable for unauthorized debits arising from fraud. For example, the Act does not explicitly address the level of a card user’s liability for unauthorized debits on his or her account which arises from a cybercrime due to negligence on the part of the card user or his or her bank or financial institution.
To some extent, the CBN Consumer Protection Framework attempts to address a card user’s liability for unauthorized debits on his or her account arising from negligence. The Framework provides that “financial institutions shall promptly refund customers for actual amounts lost due to fraud with interest at the CBN prescribed rate unless it can be proved that loss occurred as a result of customer’s negligence or through fraudulent behavior”.118 The CBN Guidelines on Operations of Electronic Payment Channels in Nigeria (2016) also attempts to address the liability of a card holder for unauthorized account debits which arise from negligence by providing that “the cardholder shall be held liable for fraud committed with his card, arising from the misuse of his PIN or his card”.119 A similar provision exists under the CBN Guidelines on Electronic Banking (2003) which provides that “…the cardholder will be liable for frauds arising from PIN misuse”.120 However, the CBN’s regulatory instruments (the CBN Consumer Protection Framework, the Guidelines on Operations of Electronic Payment Channels, and the Guidelines on Electronic Banking) just like the Cybercrimes Act, do not adequately address a card user’s liability for unauthorized debits which have occurred as a result of a cybercrime arising from negligence on the part of the card user or a bank or financial institution. For example, there are no provisions on the degree of a bank or financial institution’s liability where a customer has reported that his or her electronic bank card or other confidential electronic banking or payment details has been compromised as a result of negligence or other factors such as duress or theft. In such circumstances, would the customer still be liable for any unauthorized debits that take place after he or she has made a report to the relevant bank or financial institution? It is submitted that this possible scenario has not been addressed in the Cybercrimes Act or under the CBN’s Consumer Protection Framework and the Guidelines on Operations of Electronic Payment Channels. Therefore, it appears necessary to consider responses in other parts of the world.
where the card user failed to timely notify the relevant payment service provider upon becoming aware of the loss, theft, misappropriation or unauthorized use of the card.
There are currently no provisions in the Cybercrime Act or the CBN’s regulations that address for example the degree of a customer or bank’s liability where a customer has reported that his or her electronic bank card or other confidential electronic banking information has been compromised as a result of negligence or other factors such duress or theft. Given this state of affairs, it will be helpful for Nigeria to consider adopting the above examples of the United States and the EU. Adopting the above examples will enhance certainty in the liability regime that applies to unauthorized payment transactions as a result of cybercrime which arise from the compromise of electronic bank cards or payment details due to negligence or other factors such duress or theft.
Aside from the shortcomings that were identified in the legal analysis above, there are also several challenges that impede the protection of consumers from cybercrime in the Nigerian banking and financial sector. In this regard, a major challenge is the issue of poor public awareness regarding cybercrimes that target electronic banking and payment platforms. This lack of awareness can be traced to low levels of cybersecurity awareness due to poor consumer education as well as ineffective and poorly disseminated consumer enlightenment programs.145 The problem of lack of awareness is further compounded by low levels of technology literacy. Many consumers lack basic knowledge on how to conduct electronic financial transactions146 and have to seek the assistance of third parties which then results in the disclosure of confidential banking details such as the PINs of their bank cards. This lack of technology literacy also leads to situations whereby consumers may respond to unsolicited communications purportedly coming from banks or financial institutions but actually made by criminals, requiring them to disclose their personal banking details.
The CBN’s Risk-Based Cybersecurity Framework and Guidelines for Deposit Money Banks and Payment Service Providers which was issued on 25 June, 2018, clearly recognizes the need for banks and payment service providers to promote cybersecurity awareness amongst consumers and employees.148 Accordingly, the Framework requires banks and payment service providers to develop cybersecurity awareness trainings, and “communicate cybersecurity awareness to their customers in the language they understand; possibly in local dialect at least monthly or when there is an identified cyber-threat or attack vector”.149 The Framework also requires banks and payment service providers to devise mechanisms to communicate such cybersecurity awareness via SMS, emails, radio, newspapers and other mass media platforms.150 The effective implementation and enforcement of the above obligations under the Framework will go a long way towards promoting consumer awareness of cybersecurity threats on electronic banking and payment platforms and thereby reduce the volume of consumer losses arising from cybercrime in the Nigerian banking and financial industry.
It should be noted that the Nigerian Consumer Protection Council Act,151 which creates a legal and regulatory framework for the protection of consumers in Nigeria, also applies to services such as electronic banking and payment services. Under the Act, the CPC can compel a service provider to provide relief and compensation to consumers who have been injured by the effects of adverse technologies.152 For example, a bank customer can obtain remedies through the CPC in the case of losses arising from an unauthorized payment transaction on his or her account due to the bank’s failure to adequately protect its electronic banking and payment platforms. However, the existence of the Consumer Protection Act has not had significant impact on the protection of consumers that use electronic banking and payment platforms. This state of affairs appears to arise from the CPC’s lack of requisite institutional regulatory capacities such as qualified manpower and technical capacities to address consumer issues relating to electronic banking and payments. Although, the CPC has expressed interest in protecting electronic card users by indicating its readiness to commence legal proceedings against banks that fail to compensate victims of cybercrime such as ATM fraud,153 however, the CPC did not establish any regulatory directives in that regard and no banks have been prosecuted. There is also the challenge of limited consumer access to CPC’s consumer redress mechanism, as many consumers do not stay in areas where they can easily access the CPC’s consumer redress mechanisms, and the option of traveling long distances to lay complaints that involve small claims usually discourage consumers from seeking redress.154 Also, when the costs of redress is weighed against a small consumer claim and the time that will be spent on the dispute resolution process, consumers are usually more inclined to abandon the option of seeking redress.
There is need for the government to enhance the CPC’s technical and institutional regulatory capacities to address consumer issues related to the use of electronic banking and payment platforms. This will go a long way towards enhancing consumer trust in the effectiveness of the CPC’s consumer redress system. Also, given that consumer complaints, which arise from issues related to the use of electronic banking and payment platforms (including consumer complaints that relate to cybercrime), may involve small claims and thereby lessen the incentive for consumers to seek redress, it is therefore imperative for the CPC to promote the enforcement of consumer rights and claims. The CPC can achieve this by exercising its regulatory powers to institute actions on behalf of consumers, or by encouraging civil society organizations to institute class action suits that seek to address common consumer complaints, including those that arise from cybercrime on electronic banking and payment platforms.
Cybercrimes that target electronic banking and payment services generally reduce consumer trust in electronic transactions and also impedes the adoption and penetration of electronic banking and payment services as well as e-commerce. This also has the effect of limiting the social and economic development prospects of information communication technologies in developing countries such as Nigeria. Although, Nigeria has taken a commendable step by establishing the Cybercrime Act to protect consumers that use electronic banking and payment platforms in the banking industry, there is still a need for further responses as highlighted in this paper. In particular, it will be helpful for Nigeria to consider drawing lessons from the highlighted examples of legal regimes in the United States and the EU in order to strengthen the protection of consumers that use electronic banking and payment services. More importantly, the Nigerian Cybercrime Advisory Council which is established under section 42(1) of the Nigerian Cybercrimes Act has powers to formulate guidelines for the implementation of the Act.155 In this regard, the Council can make guidelines that will impose a greater or strict liability regime on banks and financial institutions under section 19(3) of the Cybercrimes Act, so that they can have a higher degree of liability for the breach of consumer data. The Council can also establish guidelines that will address the degree of a customer or bank’s liability where a customer has reported that an electronic bank card or other confidential electronic banking or payment information, have been compromised as a result of negligence or other factors such duress or theft. Another option is for the Attorney General of the Federation to exercise the powers under section 57 of the Act with a view to making guidelines that will address the identified shortcomings of the consumer protection regime under the Act. In addition, the CBN can exercise its powers to regulate the banking and financial sector156 in order to make regulations that will strengthen the consumer protection regime under the Cybercrimes Act. Finally, It is also imperative that regulatory developments are timely initiated to address highlighted gaps in the consumer protection regime under the Act so as to further enhance certainty and consumer trust in the use of electronic banking and payment services in Nigeria.
1The article was presented at the International Conference “The Responsible Consumer in the Digital Age: International and Nordic Perspectives on Financial Consumer Protection”, organized in 2018 by the Centre for Enterprise Liability, Faculty of Law, University of Copenhagen, with the support of the Carlsberg Foundation, the Dreyers Fond and the Romanian Embassy to the Kingdom of Denmark and Iceland.
2See Internet World Stats, Nigeria Internet Usage and Telecommunications Reports (December, 2017) <https://www.internetworldstats.com/stats1.htm> accessed 5 November, 2018.
3See NCC, ‘Internet Subscriber Data’ (May, 2018) <https://www.ncc.gov.ng/stakeholder/statistics-reports/industry-overview#view-graphs-table-5> accessed 5 November, 2018.
4See NCC, ‘Telecommunications Subscriber Data’ (May, 2018) <https://www.ncc.gov.ng/stakeholder/statistics-reports/industry-overview#|view-graphs-table-5> accessed 5 November, 2018.
5See Craig Rosewarne and Adedoyin Odunfa, The 2014 Nigeria Cyber Threat Barometer Report (Wolfpack Information Risk and Digital Jewels 2014) 51–56.
6See Symantec Corporation and African Union, Cybercrime & Cybersecurity Trends in Africa (Symantec Corporation and African Union 2016) 15.
7See Gbenga Sesan, et al, Economic Cost of Cybercrime in Nigeria (Paradigm Initiative 2013) 11.
8See Segun Akintemi, ‘Electronic Banking Frauds: An overview’, The Nigerian Banker (July–September, 2015) 9–12.
9See Uchenna Jerome Orji, Cybersecurity Law and Regulation (1st edn, Wolf Legal Publishers 2012) 487–561.
10See Cybercrimes (Prohibition and Prevention, etc) Act 2015, s 1.
11See Lambiotte Guillaume, ‘Fighting Cybercrime: Technical, Juridical and Ethical Challenges’, Virus Bulletin Conference (September, 2009) 63.
12See Chris Hale, ‘Cybercrime: Facts and Figures Concerning the Global Dilemma’, (65)6 Crime and Justice International, (2002)18. (Emphasis added).
13See Gercke Marco, Understanding Cybercrime: A Guide for Developing Countries (ITU 2009) 17.
14See Orji, (n 9) 17–19.
15See for e.g., The African Union Convention on Cyber Security and Data Protection (Malabo, 2014), and the Council of Europe, Convention on Cybercrime, 41 I.L.M. 282 (Budapest, 23.XI, 2001).
16See Bryan A. Garner (ed), The Black’s Law Dictionary (9th edn, West Publishing Co 2009) 358.
17See Ernie Newman, ‘Consumer Protection and Telecommunications’, in Ian Walden (ed) Telecommunications Law and Regulation (OUP 2012) 455.
18See Consumer Protection Act 1992, s 32.
19See Felicia Monye, Law of Consumer Protection (Spectrum Books Ltd 2003) 19.
20See United Nations Guidelines for Consumer Protection (as expanded in 1999) (2003), paras II and III.
21See Giesela Ruhl, ‘Consumer Protection in Choice of Law’, (44) Cornell International Law Journal (2011) 571.
24See Uchenna Jerome Orji, Telecommunications Law and Regulation in Nigeria (Cambridge Scholars Publishing 2018) 252.
25See Central Bank of Nigeria, ‘List of Financial Institutions/Commercial Banks’ (August, 2018), <https://www.cbn.gov.ng/supervision/Inst-DM.asp> accessed 5 November, 2018.
26See Central Bank of Nigeria, ‘Financial Institutions’, available at <https://www.cbn.gov.ng/supervision/finstitutions.asp> accessed 5 November, 2018. See Monetary Policy Department of the Central Bank of Nigeria, The Nigerian Financial System at a Glance (Central Bank of Nigeria, March 2017) 3–5.
27See Banks and Other Financial Institutions Act, 1991 (As Amended) s 1, 2, 3, 5, 31–39. See s 1(3) and 2(d) Central Bank of Nigeria Act, 2007, Official Gazette of the Federal Republic of Nigeria (1 June, 2007) 94, Government Notice No. 34, A63–19.
28See Central Bank of Nigeria, ‘Complaints Management’, available at <https://www.cbn.gov.ng/Supervision/cpdcomgt.asp> accessed 5 November, 2018.
29See Nigeria Deposit insurance Corporation Act 2006, s 27–32.
30See Economic and Financial Crimes Commission (Establishment) Act 2004, s 6 (b)–(h).
31See Consumer Protection Council (CPC) Act 1992, s 2.
32See Dipo Olowookere, ‘CBN Admits Failing to Reduce Nigeria’s Unbanked Population’, Business Post (6 June, 2018) <https://www.businesspost.ng/2018/06/24/cbn-admits-failing-reduce-nigerias-unbanked-population/>; Obinna Chima, ‘Report: 53% of Nigerians in Banking System – Ericssion’, Thisday (3 March, 2016), <https://www.thisdaylive.com/index.php/2016/03/03/report-53-of-nigerians-in-banking-system/amp/>; Chike Onwuegbuchi, ‘CBN Puts Unbanked Population @ 37%’, Nigeria Communications Week (23 June, 2018), available at <https://www.nigeria communicationsweek.com.ng/cbn-puts-unbanked-population-37/> accessed 5 November, 2018.
33See U Kama and M Adigun, ‘Financial Inclusion in Nigeria: Issues and Challenges’, (45) Central Bank of Nigeria Occasional Paper (August, 2013) 26–28, 31–34.
34See National Bureau of Statistics, PoS Adoption and Usage: A Study on Lagos State (National Bureau of Statistics 2015) 9.
36See Central Bank of Nigeria (CBN) Industry Policy on Retail Cash Collection and Lodgment (IITP/C/001) Ref: COD/DIR/GEN/CIT/05/031 (20 April, 2011).
37See Uchenna Jerome Orji, ‘Building a Cashless Economy in Nigeria: An Analysis of the Policy Framework and Proposals for Responses’, 27(7) Journal of International Banking Law and Regulation (2012) 265–271.
38See National Bureau of Statistics, (n 34) 22.
39See Chuka Odittah, ‘More Nigerians Used ATM Electronic Banking in 2016, says NBS Report’, The Guardian (29 January, 2017) <https://www.guardian.ng/news/more-nigerians-used-atm-electronic-banking-in2016-says-nbs-report/>; National Bureau of Statistics, ‘2017 POS Analysis’ (2017) <https://www.nibss-plc.com.ng/pos-statistics-2016/>; National Bureau of Statistics, ‘2016 POS Statistics’, (2016) <https://www.nibss-plc.com.ng/pos-statistics-2016/> accessed 5 November, 2018.
40See National Bureau of Statistics, (n 34) 37.
42See Central Bank of Nigeria, Risk-Based Cybersecurity Framework and Guidelines for Deposit Money Banks and Payment Service Providers (25 June, 2018) 1.
43See Editorial, ‘Nigerian Banks Lose N12.30 Billion to Fraud in 4 Years- NIBSS’, The Vanguard (21 June, 2018) <https://www.vanguardngr.com/2018/06/nigerian-banks-losen12–30bn-fraud-4-years-nibss/> accessed 5 November, 2018.
44See Osita Nwanu, ‘E-Fraud in Nigeria: Growing or Dying Trend’, in Nigerian E-Fraud Forum 2015 Annual Report: Improving and Securing the Cyber Environment (Central Bank of Nigeria 2015) 18–20; F. Wada and G.O. Odulaja, ‘Electronic Banking and Cyber Crime in Nigeria – A Theoretical Policy Perspective on Causation’, 4(3:2) African Journal of Computing & ICT, (2012) 71–75.
45Internet use data also indicate that Africa’s Internet user population grew from 4,514,400 million people in 2000 to 453.3 million people in December, 2017, representing approximately 35.2 percent of Africa’s entire population estimate. See Miniwatts Marketing Group, ‘Internet Usage Statistics for Africa’, (31 December, 2017) <https://www.internetworldstats.com/stats1.htm> accessed 5 November, 2018.
46The scam is also known as the ‘Nigerian Letter Scam’ or the ‘419 Scam’ after Section 419 of the Nigerian Code.
47See Uchenna Jerome Orji, ‘Curbing Advance Fee Fraud in Nigeria: An Analysis of the Regulatory Framework and Contemporary Challenges’, 22(12) International Company and Commercial Law Review, (2011) 409; Andrews Atta-Asamoah, ‘Understanding the West African Cybercrime Process’, 18(4) African Security Review (2010) 106–114; Ben Simon Okolo, ‘Demystifying the Advance fee Fraud Criminal Network’, 18(7) African Security Review (2009) 11.
48See Keiran Dunne, ‘Nigerian 419 E-Mail Scams’, The ATA Chronicle (July, 2007) 33; Harvey Glickman, ‘The Nigeria ‘419’ Advance Fee Scams: Prank or Peril?’, 39(3) Canadian Journal of Africa Studies (2005) 472; Russell G. Smith, Michael N. Holmes and Philip Kaufmann, ‘Nigerian Advance Fee Fraud’, (121)1 Trends and Issues in Crime and Criminal Justice (1991).
49See Caroline Baylon and Albert Antwi-Boasiako, Increasing Internet Connectivity While Combatting Cybercrime: Ghana as a Case Study (Centre for International Governance Innovation and Chatham House, 2016) 6; Ultra Advanced Global Investigations, 419 Advance Fee Fraud Statistics 2009 (Amsterdam, 2010) 13. For further discussion see Orji, (n 47) 408–409.
50See Internet Crime Complaint Center, 2010 Internet Crime Report (National White Collar Crime Center 2011) 11; Internet Crime Complaint Center, 2013 Internet Crime Report (National White Collar Crime Center 2014) 15 and 21.
51See Orji, (n 47) 408–421.
52See Nigerian National Policy for Information Technology, (2001) 3 and 28.
53The acronym ‘419’ is derived from the provisions of section 419 of the Nigerian Criminal Code which was the first Nigerian law to criminalize the act of obtaining money or property by false pretense. See Nigerian Criminal Code Act, Chapter 77, Laws of the Federation of Nigeria (1990) s 419.
54See Orji, (n 9) 497.
55See BBC News, ‘Diplomat shot Dead in Prague’, BBC News (19 February, 2003) <http://news.bbc.co.uk/2/hi/Europe/2780259.stm>; John Leyden, ‘World’s First 419 Revenge Killing?: Czech Police Hold Man after Nigerian Embassy Shooting, The Register (20 February, 2003) <https://www.theregister.co.uk/2003/02/20/worlds_first_419_revenge_killing/> accessed 5 November, 2018.
56For an analysis of the Bill, see Orji, (n 9) 508–533.
57See The Nigerian Advance Fee Fraud and Other Related Offences Act 2006.
58See Orji, (n 47) 409–410.
59See Advance Fee Fraud Act 2006, s 1.
60See Advance Fee Fraud Act 2006, s 7.
61See Advance Fee Fraud Act 2006, s 12.
62See Advance Fee Fraud Act 2006, s 13(1) (a).
63See Advance Fee Fraud Act 2006, s 13(3).
64See The Nigerian Cybersecurity and Data Protection Agency Bill – HB, 154, C4443, 2008. For an analysis of the Bill, see Orji, (n 9) 535–537.
65See Abikoye Oluwafemi and Yusuf Salibu ‘Cybersecurity in Nigeria: Need for a Paradigm Shift’, (3)1 Paradigm Initiative Policy Brief (3 July, 2014).
66See The Cybercrimes (Prohibition and Prevention etc) Act 2015.
67See Cybercrimes (Prohibition and Prevention, etc) Act, 2015, s 1.
69See Cybercrimes (Prohibition and Prevention, etc) Act, 2015, s 50 (1) (a)–(c).
70See Cybercrimes (Prohibition and Prevention, etc) Act, 2015, s 50 (1) (d)–(i).
71See Orji, (n 9) 252.
72Ibid at 220, 252, and 280.
73See Uchenna Jerome Orji, ‘Deterring Cyberterrorism in the Global Information Society: A Case for the Collective Responsibility of States’, 6(1) Defence Against Terrorism Review (2014) 31–32; Uchenna Jerome Orji, International Telecommunications Law and Policy (Cambridge Scholars Publishing 2018) 1.
74See Cybercrimes (Prohibition and Prevention, etc) Act, 2015, s 50 (1) (d)–(ii).
75See Bryan A. Garner (ed), The Black’s Law Dictionary (9th edn, West Publishing Co 2009) 151.
76See Uchenna Jerome Orji, ‘Multilateral Legal Responses to Cybersecurity in Africa: Any Hope for Effective International Cooperation?’, in Markus Maybaum, et al (eds), Architectures in Cyberspace- 7th International Conference on Cyber Conflict (NATO CCD COE 2015) 111–112.
77See Cybercrimes (Prohibition and Prevention, etc) Act, 2015, s 13.
78See Cybercrimes (Prohibition and Prevention, etc) Act, 2015, s 14(1).
79See Cybercrimes (Prohibition and Prevention, etc) Act, 2015, s 14(4).
80See Cybercrimes (Prohibition and Prevention, etc) Act, 2015, s 14(4) (a).
81See Cybercrimes (Prohibition and Prevention, etc) Act, 2015, s 16(1).
82See Cybercrimes (Prohibition and Prevention, etc) Act, 2015, s 16(3).
84See Cybercrimes (Prohibition and Prevention, etc) Act, 2015, s 15.
85See Uchenna Jerome Orji, ‘A Review of the Special Duties of Banks under the Nigerian Money Laundering Act’, Journal of International Banking Law and Regulation (2011) 26 (6)305.
86See for e.g., the English case of Tournier v National Provincial and Union Bank of England  1 KB 46, where the Court held that the relationship between a customer and banker is a confidential one, and stated that it is an implied term of contract between a banker and the customer that the banker will not divulge to third parties either the state of the customer’s account or any of his or her transactions with the bank or any information relating to the customer which was acquired through the keeping of his or her account.
87See Cybercrimes (Prohibition and Prevention, etc) Act, 2015, s 19(3). (Emphasis added).
88The CBN Consumer Protection Framework of 2016 was established in the exercise of the CBN’s powers to issue regulatory guidelines for the purpose of governing the operation of banks and financial institutions in Nigeria. Compliance with CBN regulatory guidelines such as the Consumer Protection Framework is mandatory for banks and financial institutions in Nigeria and non-compliance can result in regulatory sanctions including fines and the revocation of operational licenses. See Banks and Other Financial Institutions Act, 1991 (As Amended), s 60 (2), (4) and 64. See Central Bank of Nigeria Act, 2007, s 33(1) (b) and 33 (5).
89See Central Bank of Nigeria, Consumer Protection Framework (7 November, 2016) at 21, para 2.6.
90See Uchenna Jerome Orji, ‘Regionalizing Data Protection Law: A Discourse on the Status and Implementation of the ECOWAS Data Protection Act’, International Data Privacy Law (2017) 7 (3)186–187.
91See Central Bank of Nigeria, Consumer Protection Framework (7 November, 2016) at 23, para 2.6.2.
92See European Union Directive 2015/2366 on Payment Services in the Internal Market, amending Directives 2002/65/EC, 2009/110/EC and 2013/36/EU and Regulation (EU) No 1093/2010, and repealing Directive 2007/64/EC (November, 2015) at para 72. [Hereafter, EU Directive on Payment Services].
93See Cybercrimes (Prohibition and Prevention, etc) Act, 2015, s 20.
94See Cybercrimes (Prohibition and Prevention, etc) Act, 2015, s 20.
95See Cybercrimes (Prohibition and Prevention, etc) Act, 2015, s 28(3).
96See Cybercrimes (Prohibition and Prevention, etc) Act, 2015, s 22(2).
97See Cybercrimes (Prohibition and Prevention, etc) Act, 2015, s 29(1).
98See Cybercrimes (Prohibition and Prevention, etc) Act, 2015, s 30 (1).
99See Cybercrimes (Prohibition and Prevention, etc) Act, 2015, s 30 (2).
100See Cybercrimes (Prohibition and Prevention, etc) Act, 2015, s 58.
101See Cybercrimes (Prohibition and Prevention, etc) Act, 2015, s 32(1).
102See Orji, (n 9) 40.
103See Cybercrimes (Prohibition and Prevention, etc) Act, 2015, s 33(1).
104See Cybercrimes (Prohibition and Prevention, etc) Act, 2015, s 33(3).
105See Cybercrimes (Prohibition and Prevention, etc) Act, 2015, s 33(4) and 34.
106See Cybercrimes (Prohibition and Prevention, etc) Act, 2015, s 33(5)–(9).
107See Cybercrimes (Prohibition and Prevention, etc) Act, 2015, s 33(10).
108See Cybercrimes (Prohibition and Prevention, etc) Act, 2015, s 33(12).
109See Cybercrimes (Prohibition and Prevention, etc) Act, 2015, s 36(1).
110See Cybercrimes (Prohibition and Prevention, etc) Act, 2015, s 21(1).
111See Central Bank of Nigeria, Risk-Based Cybersecurity Framework and Guidelines for Deposit Money Banks and Payment Service Providers (25 June, 2018) 10 at para 7.6.
112See Cybercrimes (Prohibition and Prevention, etc) Act, 2015, s 37(1).
113See Central Bank of Nigeria, Regulatory Framework for Bank Verification Number (BVN) Operations and Watch-List for the Nigerian Banking Industry, BPS/DIR/GEN/CIR/04/010 (18 October, 2017).
114See Uchenna Jerome Orji, ‘A Review of the Special Duties of Banks under the Nigerian Money Laundering Act’, Journal of International Banking Law and Regulation (2011) 26 (6) 301.
115See Cybercrimes (Prohibition and Prevention, etc) Act, 2015, s 37(1).
116See Editorial, ‘Nigeria’s ATM Galleries of Failure’, Leadership (23 July, 2017) <https://www.leadership.ng/2017/07/23/nigerias-atm-galleries-failure>; Oyetunji Abioye, ‘Resolving ATM Cash Dispense Error with Ease’, Punch (26 October, 2016) <https://www.punchng.com/resolving-atm-cash-dispense-error-ease> accessed 5 November, 2018.
117See Uchenna Jerome Orji, ‘Creating a Sustainable Legal and Regulatory Environment for Electronic Banking in Nigeria’, Journal of International Banking Law and Regulation (2011) 26 (12) 614.
118See Central Bank of Nigeria, Consumer Protection Framework (7 November, 2016) at 23 para 2.6.1.5. (Emphasis added).
119See Central Bank of Nigeria, Guidelines on Operations of Electronic Payment Channels in Nigeria (April, 2016), at 17 and 28 paras, 2.4.6.5 and 3.4.6.5.
120See Central Bank of Nigeria, Guidelines on Electronic Banking in Nigeria (August, 2003) at 3 para 1.4.2.
121See The Electronic Funds Transfer Act, United States Code: Title 15: section 1693 (a).
122See The Electronic Funds Transfer Act, United States Code: Title 15: section 1693(g).
123See The Electronic Funds Transfer Act, United States Code: Title 15: section 1693g (a). See also section 1693g (e) ibid.
124The term ‘accepted card’ or ‘other means of access’ is defined under the EFTA to mean a card, code, or other means of access to a consumer’s account for the purpose of initiating electronic fund transfers when the person to whom such card or other means of access was issued has requested and received or has signed or has used, or authorized another to use, such card or other means of access for the purpose of transferring money between accounts or obtaining money, property, labor, or services. See The Electronic Funds Transfer Act, United States Code: Title 15: section 1693a(1).
125See The Electronic Funds Transfer Act, United States Code: Title 15: section 1693(g) (a).
128See Benjamin Geva, ‘Payment Transactions Under the EU Payment Services Directive: A U.S. Comparative Perspective’, Penn State International Law Review (2009) 27(3/4)732.
129See, Krusser v Bank of America (Cal Rpts. 463, CIV.ct.App.1994). In that case, a cardholder who believed that his debit card had been destroyed in 1986 failed to notify his bank of a 20 US dollar unauthorized ATM withdrawal which appeared in his bank statement in December, 1986. Later in September 1987, the cardholder received bank statements for July and August 1987, which indicated 47 unauthorized ATM withdrawals with the card, amounting to 9,020 US dollars. The cardholder then notified the bank of all unauthorized withdrawals including that which had earlier appeared in the bank statement of December 1986. The Court held that the cardholder’s failure to report the unauthorized 20 dollar withdrawal, which appeared on December 1986 statement, barred him from recovering the loss incurred in July and August 1987. See, Benjamin Geva, The Law of Electronic Funds Transfer, (Lexis Publishing 2000) 105. See also, Kethi D. Kilonzo, ‘An Analysis of the Legal Challenges posed by Electronic Banking’, Kenya Law Review (2007) (1) 338–339.
130See The Electronic Funds Transfer Act, United States Code: Title 15: section 1693g (d).
131See The Electronic Funds Transfer Act, United States Code: Title 15: section 1693q.
132See EU Directive on Payment Services 2015, art 64 (1).
133See EU Directive on Payment Services 2015, art 64 (2).
134See EU Directive on Payment Services 2015, art 71.
135See EU Directive on Payment Services 2015, art 73(1).
136See EU Directive on Payment Services 2015, art 74(1).
137See EU Directive on Payment Services 2015, art 74(1) (a).
138See EU Directive on Payment Services 2015, art 74(1) (b).
139See EU Directive on Payment Services 2015, art Article 74(1).
140See EU Directive on Payment Services 2015, art 64 (1) (a).
141See EU Directive on Payment Services 2015, art 64(2).
142See EU Directive on Payment Services 2015, art 64 (1) (b).
143See EU Directive on Payment Services 2015, para 71.
145See Onajite Regha, ‘Aggressive Consumers Awareness Initiatives: A Proactive & Consistent Mechanism to Preventing E-fraud’ in Nigerian E-Fraud Forum 2015 Annual Report: Improving and Securing the Cyber Environment (Central Bank of Nigeria 2015) 10–13.
146See Ifeanyi Chris Onodugo, ‘Overview of electronic banking in Nigeria’, International Journal of Multidisciplinary Research and Development (2015)2 (7)340; U Kama and M Adigun, ‘Financial Inclusion in Nigeria: Issues and Challenges’, Central Bank of Nigeria Occasional Paper (August, 2013) (45)31–33.
147See Central Bank of Nigeria, Circular on the Establishment of Industry Fraud Desks, BPS/DIR/GEN/CIR/02/004 (11 June, 2015).
148See Central Bank of Nigeria, Draft Risk-Based Cybersecurity Framework and Guidelines for Deposit Money Banks and Payment Service Providers (25 June, 2018) 18–19 at Appendix III, para 3.
149See Central Bank of Nigeria, Draft Risk-Based Cybersecurity Framework and Guidelines for Deposit Money Banks and Payment Service Providers (25 June, 2018)19 at Appendix III, para 3 (e).
150Ibid, at 19, Appendix III, para 3 (f).
151See The Nigerian Consumer Protection Council Act, Cap. C25 LFN.
152See Nigerian Consumer Protection Council Act, s 2.
153See Victor Oluwasegun and Dele Anofi, ‘Reps, CPC Probe Banks over Malfunctioning ATMs’, The Nation (4 June, 2013) <http://www.thenationonlineng.net/reps-cpc-probe-banks-over-malfunctioning-atms/>; PM News, ‘ATM Fraud: CPC, NBA Set to Tackle Banks’, PM News (24 August, 2010), available at <https://www.pmnewsnigeria.com/2010/08/24/atm-fraud-cpc-nba-set-to-tackle-banks/> accessed 5 November, 2018.
155See Cybercrimes (Prohibition and Prevention, etc) Act, 2015, s 43(1)(b).
156See Banks and Other Financial Institutions Act, 1991 (As Amended) s 1, 2, 3, 5, 31–39. See s 1(3) and 2(d) Central Bank of Nigeria Act, 2007, Official Gazette of the Federal Republic of Nigeria (1 June, 2007) 94, Government Notice No. 34, A63-19.

References: art 64
 art 64
 art 71
 art 73
 art 74
 art 74
 art 74
 art 64
 art 64
 art 64