BVN and NIN Details Illegally Sold on Suspicious Websites for ₦100

by Ohepo Ohepo

Lagos, Nigeria – Just three months after the exposure of XpressVerify, another private website, AnyVerify, has been discovered trading sensitive Nigerian identification data, including Bank Verification Numbers (BVNs). This alarming development has prompted Paradigm Initiative (PIN), an ICT for Development and Digital Rights group, to seek legal redress for the breach of data privacy rights on behalf of Nigerian citizens.

In response to the breach, PIN’s legal partners, Vindich Legal, have issued a pre-action notice to several key government agencies, including the National Identity Management Commission (NIMC), the Nigeria Data Protection Commission (NDPC), the Nigeria Immigration Service (NIS), the Federal Inland Revenue Service (FIRS), the Central Bank of Nigeria (CBN), the Independent National Electoral Commission (INEC), the Federal Road Safety Corps (FRSC), and the Office of the Attorney General of the Federation (AGF).

Legal Demands

Vindich Legal is demanding the following actions from Nigeria’s federal government:

  1. Declaration of Violation: Recognition that AnyVerify’s unauthorized access and commercialization of Nigerian citizens’ data breaches Section 37 of the Constitution of the Federal Republic of Nigeria 1999 (CFRN).
  2. Enforcement of Data Protection Measures: Enforcement of Sections 30 and 39 of the Nigeria Data Protection Act (NDPA) 2023, obligating government agencies to implement robust technical and organizational measures to secure citizens’ data.
  3. Full Investigation and Reporting: A comprehensive investigation into the data leak involving, with the findings published publicly.
  4. Transparency: Public disclosure of the activities of agents and sub-licensees of involved government agencies.
  5. Compensation: Provision of restitution to individuals affected by the data leak.

Background and Current Situation

PIN revealed that has been operating in Nigeria’s digital space since November 2023. The website offers a range of personal data services, including National Identity Number (NIN), BVN, virtual NIN, driving license, international passport details, company information, Tax Identification Number (TIN), Permanent Voter’s Card (PVC), and phone numbers, all for a nominal fee of N100 per data request.

Website Traffic and Reach

The site has seen substantial traffic, with 567,990 visits in February 2024 and 188,360 visits in April 2024. It ranked among the top 3400 websites in Nigeria, receiving at least 68,000 visits in May.

Official Responses and Actions

Following FIJ’s earlier exposé on XpressVerify in March, the NIMC clarified that XpressVerify was not a licensed partner. Similarly, AnyVerify is not listed as a licensed partner on the NIMC’s website. Despite efforts to contact the NDPC and NIMC for comments, phone calls, texts, and emails from FIJ reporters have gone unanswered.

NIMC has yet to release a list of its licensed partners, and FIJ continues to request this information to clarify the status of entities like AnyVerify.

Next Steps

As the situation unfolds, PIN and its legal partners are pressing for immediate government action to safeguard the personal data of Nigerian citizens and to hold those responsible for breaches accountable. The establishment of stringent data protection measures and transparent operations within government agencies are critical to preventing further data privacy violations.

You may also like

Are you sure want to unlock this post?
Unlock left : 0
Are you sure want to cancel subscription?
Update Required Flash plugin
Verified by MonsterInsights