Your Face Is Now a Password: How AI Is Changing Fraud in Nigeria

The photograph on a social media page, a few seconds of recorded speech and a familiar face may now give fraudsters enough material to construct a convincing digital identity. As Nigerian banks and fintechs deploy artificial intelligence to fight financial crime, criminals are learning to use the same technology against them.

A few years ago, a fraudster needed a stolen password, a compromised phone or a convincing story. Today, sometimes all that is needed is a photograph.

A few pictures from Instagram. A short video posted online. A voice note on WhatsApp. A person’s name, workplace and telephone number. Artificial intelligence can turn these fragments of someone’s digital life into a powerful impersonation tool.

A cloned voice can sound like a parent asking for urgent money. A synthetic video can make someone appear to say something they never said. A fabricated identity can combine real personal information with AI-generated images, audio or documents.

The fraudster does not necessarily have to steal an entire identity. They can build a new one from pieces of a real one. For Nigeria, this is becoming a serious compliance problem.

The country’s digital payment ecosystem is expanding rapidly, while banks, fintechs and other financial institutions are being pushed towards increasingly sophisticated fraud and anti-money laundering controls. The Central Bank of Nigeria’s 2026 regulatory direction includes stronger automated AML systems and real-time fraud monitoring.

The paradox is stark.

The same technology being deployed to determine whether a customer is genuine can also be used by criminals to manufacture a convincing fake.

When the machine says it is you………

Consider Amaka, a Nigerian business owner. Her face is all over her digital footprint. She has photographs on Instagram, short videos on WhatsApp and her business details on social media. Nothing unusual. Just the ordinary digital life of someone running a modern business.

One afternoon, a customer receives a voice message apparently from Amaka.

There is an urgent payment to be made. The voice, name and business details all sound right. The customer pays, but Amaka knows nothing about it. Only later does she discover that someone has used pieces of her online identity to impersonate her.

The technology did not steal her entire identity. It reconstructed her.

That is the emerging danger of synthetic identity fraud. A criminal can combine genuine information belonging to one person with fabricated information to create another, highly convincing identity.

And the more Nigerians put online, the more material there is to work with.

Fraud is falling. The threat is not disappearing.

There is good news in Nigeria’s fraud data. Nigeria Inter-Bank Settlement System Plc (NIBSS) reported that digital payment fraud losses fell by 51 per cent in 2025, from ₦52.26 billion in 2024 to ₦25.85 billion. Reported cases also declined from 70,111 to about 67,500. Industry intervention, according to NIBSS, helped prevent approximately ₦20 billion in potential losses.

But falling losses do not mean the fraud problem is going away.

They may instead signal that controls are becoming more effective while criminals are changing tactics.

Social engineering remains a major threat. Phishing, account compromise and SIM-swap attacks continue to evolve.

The old fraud often depended on persuading someone to reveal an OTP. The emerging fraud can be more sophisticated.

The criminal does not simply ask for the OTP. The criminal first convinces the victim that the person asking for it is someone they trust, and that changes everything.

The face at the bank may not be the customer….

For banks and fintechs, the stakes are even higher. Digital onboarding increasingly relies on photographs, biometrics, identification documents and proof-of-life checks.

The basic question is supposed to be simple: Is this person really who they claim to be?

Deepfake technology attacks that question directly.

A genuine photograph may be manipulated. A genuine voice may be cloned. A real person’s identity information may be combined with synthetic material.

The document and identity may be genuine, whilst the person presenting it may still be an impostor. That creates a new KYC problem.

Traditional KYC asks whether the documents are authentic. Modern KYC must increasingly establish whether the person presenting those documents is genuinely the person represented by them. Those are very different challenges.

When AI fights AI…

Financial institutions are responding. The CBN’s regulatory push towards automated Anti-money laundering (AML) and fraud monitoring reflects the reality that Nigeria’s payment system now operates at a speed that makes purely manual monitoring impractical.

Banks can analyse transaction patterns, devices, locations, behavioural changes and other signals to identify suspicious activity. But criminals are learning to manipulate those signals.

Whilst the bank is asking whether a customer’s behaviour looks normal, the fraudster attempts to make the fake customer behave normally.

The bank checks the face, the fraudster creates a better face.

The bank checks the voice; the fraudster clones the voice. The bank checks the device, staying ahead, the criminal attempts to compromise or imitate the digital environment. This is becoming an arms race between detection and deception.

The critical compliance question is therefore no longer simply whether a financial institution has sophisticated technology. It is whether its controls can keep pace with the technology being used to defeat them.

When the machine gets it wrong…

The rise of Agentic Ai is another risk that deserves equal attention. Suppose the technology wrongly identifies a genuine customer as suspicious. The account is restricted, payment fails, money becomes inaccessible, the customer is asked to verify their identity again or explain an apparently suspicious transaction.

For the bank, this is a security measure, it could be a financial emergency. This is why false positives are becoming an important AI governance issue.

A financial institution should not only measure how many fraudsters its systems catch. It should know how many legitimate customers its systems wrongly flag and how quickly those errors are corrected with a clear human escalation process when technology gets the answer wrong. The sophistication of an AI system means little if there is no equally sophisticated process for correcting its mistakes.

Who owns your face?

The AI fraud problem also exposes a deeper data protection issue. Nigerians routinely surrender pieces of their identity to banks, fintechs, telcos, employers, government agencies, online retailers and social media platforms.

Names, phone numbers, photographs, identification documents, addresses, biometric information, and voice recordings form part of a person’s digital identity. Once that information is spread across multiple systems, the security of the individual depends partly on the security of every organisation holding it. That makes data governance a financial crime issue.

Access controls matter, vendor management, data minimisation matters, retention policies and breach response matters. A compromised identity can become the gateway to account takeover, fraudulent transactions, synthetic identities and other forms of financial crime.

The Nigeria Data Protection Act therefore sits closer to the Anti-money laundering (AML) conversation than it might initially appear.

Protecting personal data is not simply about privacy. It can also be about protecting someone’s financial identity.

The average Nigerian is a target

Deepfakes are often discussed as though they are mainly a problem for celebrities, politicians and wealthy executives. That is a mistake.

An ordinary Nigerian may be more vulnerable precisely because nobody expects to be targeted.

A cloned voice can impersonate a parent. A stolen photograph can be attached to a fake profile. Compromised business account can redirect payments. Synthetic identity can be used to access financial services. Convincing video can persuade someone to trust a fraudster. Victims do not need to be famous. They simply need to be trusted.

The new KYC question

For decades, KYC revolved around a basic question: Who are you?

AI is forcing financial institutions to ask something harder: How do we know that you are really you?

And there is an even more uncomfortable question: How do we prove it without forcing legitimate customers to surrender ever more personal information? There is no single technological answer.

Biometrics will remain important. AI-powered transaction monitoring will become more sophisticated. Behavioural analytics, device intelligence and stronger authentication will play larger roles even though no single control can be trusted blindly.

Identity is no longer simply a passport, BVN, NIN, photograph, fingerprint or password. It is a collection of digital signals. Criminals are learning how to manufacture those signals. That means the next phase of financial crime compliance will not simply be about catching yesterday’s fraud faster. It will be about recognising tomorrow’s deception before it becomes tomorrow’s loss.

The face on the screen may look familiar, voice may sound perfect, documents may be genuine, transaction may even appear normal. But in an age of synthetic identities, none of these signals can be accepted in isolation.

The new compliance challenge is no longer simply knowing your customer. It is knowing that the customer is still the person behind the identity.