Renowned Nigerian-British Doctor of Information Security and technology expert Dr. Kingsley Chibuzor Aguoru has raised an alarm over a critical security oversight in Nigeria’s payment ecosystem, calling on regulators and payment giants to stop the dangerous practice of using card PINs in online transactions.
In a petition submitted to the Central Bank of Nigeria (CBN) and the Economic and Financial Crimes Commission (EFCC) in November 2024, Dr. Aguoru highlighted the breach of PCI PIN Security Standards, a globally recognised framework designed to protect cardholder data established by the major credit card companies.
Dr. Aguoru pointed out that allowing card PIN usage in card-not-present transactions, such as on web browsers, violates the core tenets of PCI PIN compliance.
The standards mandate that PINs must only be entered into secure PCI-compliant PIN Entry Devices (PEDs) and web browser is not. Using PINs in untrusted environments like web browsers exposes millions of Nigerians to skimming, phishing, and other forms of financial fraud.
“Despite these glaring risks, the CBN has failed to take action, leaving Nigerians to bear the brunt of this neglect. Payment giants, that dominate Nigeria’s card payment processing ecosystem, have also come under fire for their inaction.
Dr. Aguoru accused them of prioritising transaction volumes over consumer safety, calling their continued allowance of this practice a clear abuse of trust.
“This is not just a regulatory failure; it is a betrayal of the Nigerian people,” Dr. Aguoru said. “The CBN and others are complicit in endangering the financial security of millions of Nigerians, choosing convenience and profit over compliance with global standards.”
Adding to his efforts to address this issue, Dr. Aguoru launched a petition on Change.org, urging all Nigerians to sign and demand accountability.
“This is a call to action for every Nigerian,” he stated. “We must collectively stop this abuse and neglect before it results in further financial losses and insecurity.”
The risks of inaction are already evident, with financial fraud cases on the rise in Nigeria. Card skimming and phishing attacks are rampant, with criminals exploiting the vulnerabilities created by the unsafe use of card PINs online.
Despite these threats, neither the CBN nor the payment processors have taken meaningful steps to enforce compliance or implement safer alternatives and recommendations like PSD2’s Strong Customer Authentication.
Dr. Aguoru’s recommendations include an immediate ban on card PIN usage in card-not-present transactions, enforcement of PCI PIN compliance across financial institutions, and the adoption of secure authentication methods for online payments.
He emphasised that these measures are essential to protect the integrity of Nigeria’s financial ecosystem.
“The continued silence of the CBN and the negligence of Visa and MasterCard speak volumes about their disregard for Nigerian consumers,” Dr. Aguoru remarked.
“Nigerians deserve better, and it is time for the authorities to act decisively to end this abuse.”
As digital payments become increasingly central to Nigeria’s economy, the urgency to address this issue cannot be overstated. The failure to uphold global security standards not only compromises consumer trust but also threatens the nation’s financial future.
Dr. Aguoru’s petition and ongoing advocacy serve as a critical wake-up call for the CBN to prioritise the safety of Nigerian cardholders