THE INSIDER HAD THE KEYS: How Fidelity Bank Employee Exploited System Access in ₦2.7BN Fraud Scandal

A bank employee, privileged access to internal systems and manipulated customer account details. That combination formed the basis of a ₦2.7 billion fraud case that has exposed a critical vulnerability in Nigeria’s banking system: the threat of financial crime from within the institution itself.

The conviction of former Fidelity Bank employee, Christopher Jackson Edeh, by the Special Offences Court in Lagos has brought renewed attention to the risks associated with insider fraud, unauthorised system access and weaknesses in banking operational controls.

Justice O.O. Abike-Fadipe sentenced Edeh to five years’ imprisonment without an option of fine after finding him guilty on nine counts bordering on fraudulent false accounting and unauthorised access to a computer system. The sentences are to run concurrently.

The Economic and Financial Crimes Commission (EFCC) said the case involved the alleged manipulation of account details belonging to several customers and institutional entities, including the Kano State Government Power Intervention Fund, NNPC Trading Limited, Stallion Vision Limited, the Lagos State Government Blue Line project, the State Contributory Pension Account and Chukwuemeka Odumegwu Ojukwu University.

An earlier account of the charges identified unauthorised access to Fidelity Bank’s Entrust portal as part of the alleged scheme. One of the charges concerned an intended fraudulent operation involving ₦2,737,784,800.

The significance of the case extends beyond the amount involved. It illustrates how access to sensitive banking infrastructure, combined with the manipulation of financial records, can potentially create opportunities for fraud that conventional customer-facing security measures may fail to detect.

For financial institutions, the case raises uncomfortable questions about privileged access management, segregation of duties and the effectiveness of internal surveillance.

Could an employee modify sensitive customer or beneficiary information without sufficient independent authorisation? Were changes to account records subjected to robust maker-checker verification? Could the institution’s audit systems promptly identify unusual modifications involving high-value government and corporate accounts?

These are critical questions because account manipulation can undermine the integrity of transaction monitoring systems. Where customer or beneficiary information is compromised, the subsequent movement of funds may become harder to identify and investigate.

From an anti-money laundering perspective, insider-enabled fraud presents a particularly serious risk. It can facilitate the diversion of funds, concealment of beneficiaries and movement of criminal proceeds through seemingly legitimate banking channels.

The case reinforces the need for banks to integrate cybersecurity, operational risk management, fraud surveillance and AML controls. Privileged users should operate under strict access restrictions, with sensitive transactions independently authorised and system activities continuously monitored.

The conviction also highlights the importance of effective whistleblowing channels, employee integrity assessments and independent reviews of critical banking applications.

The most dangerous fraudster may not need to break into a bank. The individual may already possess authorised access.

The lesson from the ₦2.7 billion case is unmistakable: banking security must protect not only the perimeter, but also the people, permissions and processes operating behind it.