The cash-less banking initiative created by the Central Bank of Nigeria (CBN) to reduce transaction and currency management costs is threatened by fraud and inefficient technology deployed in banks. The policy, billed for national roll-out on July 1, faces severe backlashes from bank customers, reports COLLINS NWEZE
Nothing forewarned Sunday Chukwu, a Mushin, Lagos tyre merchant of the problem he would soon face. That Saturday, a customer bought goods worth N120,000. The customer said he had no cash and requested his account details to transfer the money. He said: “He typed the number on his phone and within few minutes, I got transaction alert from my bank – First City Monument Bank (FCMB). The alert showed that N120, 000 had been credited to my account. So, he took the goods and went away.
“The next working day, which was Monday, I went to the bank to withdraw the money but it was not there. My account officer showed me my last transaction detail, and informed me that the alert on my phone was not from the bank and that it was a fraud. That was how I lost the money and all efforts to trace the fraudster failed.”
Chukwu released the goods because the alert showed his previous account balance and the new deposit by the customer. That, he said, was an indication that the fraudster was collaborating with an insider from the bank. “Up till today, I have not recovered that money,” he told The Nation.
That horrible experience, Chukwu noted, has made him to always insist on taking cash no matter how well he knew the customer. His verdict was that banks are not ready for cash-less banking, which is set for nationwide roll-out on July 1. He said such policies worked in other countries because there is trust and lenders have taken measures to secure their platforms against fraudsters.
But, Head Corporate Communications at FCMB, Louis Ibe, told The Nation that the hitches could have been caused by a network problem. He said such problems exist everywhere, and promised that the lender would find out what happened. The Managing Director, Park and Carry Limited, Ekwueme Emeka, does not use ATMs because of fear of insecurity.
“I don’t use ATMs. I make my transaction through cheques and withdrawal booklets. It is much quicker and less stressful. Poor network quality remains a major issue that reduces my confidence in e-payment. Sometimes, you go there, slot in your card and nothing comes out but your account is debited,” he said.
Chukwu said the July 1 date for nationwide roll-out should be reconsidered because all parties to the project are not ready. That position came after he lost N120, 000 to fraudsters who bought goods from him and decided to pay through mobile money transfer. In spite of all the arguments in its favour, some bank customers are equally not comfortable using ATM.
Mrs. Olatunji Alima, an egg distributor based in Lagos, is one of such customers. Alima said she has been using ATM since 2012, but does not feel safe with it anymore.
“I own a boutique and I am also a sole distributor of eggs. It has been two years now. I don’t feel secure using the device anymore because robbers are attacking ATM subscribers daily at the point of withdrawal. I am always scared of using my ATM cards,” she said. Alima recounted a time when the ATM card simply refused to work.
“There was a time I came to withdraw money to pay off a debt, as I slotted in my card, it refused to neither slip out nor pay me. It was a bad experience. I am always very careful and time conscious every time I am about to make withdrawals from ATM. That is why I do not withdraw in the night. Anytime past 6:00 pm, I don’t get close to the ATM,” she said.
She called for more security on the part of the banks. “I know they are trying their best but they need to do more in terms of security provided for withdrawers and less technical difficulties should be expected,” she advised.
Like Alima, Damilare Oshibajo, a technician, and Jeremiah Amaukwu, an information technology specialist, are also not comfortable using ATM. Oshibajo conceded that though ATM has made banking easier for Nigerians, but regretted that dispensing error is a major challenge. “The other day, I wanted to withdraw N20, 000 from the ATM. The machine debited my account but did not dispense the cash. I was told it will reverse the transaction within 24 hours. It never did until after 21 days,” he said.
Amaukwu said there were several times when his account was debited and the money was not dispensed, a situation he described as worrisome. “It was N10, 000 they took from my account. I did not get it back until two months after,” he said.
A cashier at SMAT Electronics, Computer Village, Lagos, Maureen Onyekachi, told The Nation that poor network in the use of e-payment channels and the 1.25 per cent charge on merchants’ accounts when PoS is used have depleted some of the benefits that come with the system. She said the merchant fee wouldn’t have mattered if the network were to be seamless and trusted by customers. She narrated that on several occasions, customers got debit alerts after paying through PoS, but at the merchant’s end, the transactions were declined. Onyekachi said although such hitches were always resolved between the customers and their banks, they create doubts on the feasibility of achieving a viable e-payment system in the country.
“Remember we pay 1.25 per cent fee for every successful transaction done via PoS, which translates to N125 for every N10,000 transaction or N1,250 for every N100,000 transaction. Still, that wouldn’t have mattered if the networks are working well,” she said.
Cash-less banking
The CBN launched the Cash-less Nigeria Project in Lagos State, in January 2012 and extended the policy to the Federal Capital Territory (FCT), Abia, Anambra, Ogun, Kano and Rivers States in June 2013. The policy was initiated against the backdrop of cash dominance in the payments system, a development which encouraged the circulation of huge sums of money outside the banking system and imposed huge currency management cost on the economy.
The policy was meant to ensure price stability through effective monetary policy; sound financial system and efficient payments system. It was a critical part of the payment system modernisation, designed to promote the use of Automated Teller Machines (ATMs), Point of Sale (PoS) terminals, web payment, online transfers and even mobile money in banking transactions instead of relying on cash.
CBN Governor Godwin Emefiele, on June 5, removed the three per cent charge on cash deposits above N500, 000 for individuals and N3 million for corporate customers which are the sanction prescribed for defaulters but said the nationwide rollout will hold.
Former CBN Deputy Governor, Operations Tunde Lemo, who oversaw the cashless policy for the first two years after its introduction, admitted that there are challenges with the epayment system but denied that most of the PoS terminals are not working effectively. He said there are challenges about bandwidth of the telecommunications service providers. “We spoke to the service providers on the need to improve bandwidth which they did and we saw improvement in the Lagos area. We have started talking to NICOMSAT, and they did a test-run in Lagos area and we are satisfied about their proposition.
So within the next few weeks, you will notice improvement in connectivity in Lagos area at least,” he said. Lemo said some supermarket attendants sabotage the system and tell customers that the PoS is not working because paying through the machine denies them the access to tips or free left over cash of N20 or N40 from customers.
“In one of our meetings with the merchants, we have told them to building some reward system that will still allow the attendants access to the free change they get from customers even as tips without compromising the standard of service. When we do that, you will discover that these things work,” he said.
Banking security fears
Such concerns over banking security have put wide embrace of e-payment channels in abeyance. A recent survey by Visa International showed that high net worth account holders neither own nor use ATM cards. The study revealed that people that earn below N500, 000 per annum, which form 47 per cent of its respondents, own and are regular users of debit cards, including for online purchases. It showed that the higher people earn, the less they own and use their debit cards. Majority of the rich, it said, think that avoiding debit cards is the best way to stay protected from online frauds.
Data obtained from the CBN result for 2012 showed the bank received and processed 6,274 complaints, via e-mail on various financial crimes, particularly advance fee fraud. There were 4,527 cases of fraud and forgery involving the sum of N14.8 billion and $1.6 million. The CBN also received and investigated four complaints against the commercial banks even as the issues were promptly reported to the law enforcement agencies such as the Economic and Financial Crimes Commission (EFCC) for investigation.
Globally, estimated credit card fraud stood at $11 billion in 2012, making it one of the most significant criminal developments in modern times. Nevertheless, Managing Director, Happy Man Magnificent Ventures Limited, Celestine Enemuo, is of the view that Nigeria’s evolving cashless policy is good, but he puts the blame for the present skepticism over electronic-based payment squarely on the shoulders of banks and the CBN. He noted that these institutions have not been able to create the right awareness for the policy.
He also lamented the inefficiency associated with the implementation of the policy, adding that fraud and theft are the biggest challenge with the policy.
“Sometimes, the ATMs will send you alert saying, transactions not completed, but you will get alert showing that you have been debited. And for you to go to your bank to reclaim your money, it will take you time, energy and resources,” he lamented, adding: “But if they can emulate practices in other countries, it will be good.”
He said most Nigerians were not fully aware of the need to keep their passwords secret, and going nationwide will worsen the problem. “I want the CBN to give more time during which people will be educated, and banks fortify their technology because of challenges that will follow nationwide rollout,” he advised.
Enemuo said customers whose funds were kept by banks because of poor services, should be paid interest on the money. “I prefer online transactions, but for the security challenge. Again, I have requested for PoS machine from my banks for the past one year from Diamond Bank and Zenith Bank and the banks are yet to supply the device. They said I should wait for them to retrieve PoS from customers who secured them, but are not using them,” he said.
He said these hitches should prompt the CBN to extend the nationwide rollout by one year and monitor banks’ preparatory moves. For him, the real victims of the policy were bank consumers.
How safe are ATMs?
According to experts, Nigerian banks are using an outdated Microsoft Windows operating system, which is vulnerable to hacking, for their operations. This is partly responsible for the frauds associated with their operations. Microsoft Nigeria said 95 per cent of all ATMs which run on Windows XP operating system are vulnerable to hacking. General Manager Microsoft Nigeria, Kabelo Makwane said machines that run on outdated operating systems do not receive security updates are the easiest to hack.
He added that non-migration to the Windows 8 can open the banks up for potential security vulnerability and threats. He said Microsoft stopped issuing security patches and updates for bugs in the Windows XP system from the 8th. The chairman of the Committee of e-Banking Industry Heads (CeBIH), Chuks Iku, said banks were discussing with Microsoft Nigeria to extend security features in Microsoft XP on ATMs. This followed the expiration of the April 8 deadline set by Microsoft for users of Windows XP to migrate to Windows 8 Operating System (OS).
Fraud cases
The National Drug Law Enforcement Agency (NDLEA) had in February, arrested a man with 107 ATM cards at the Murtala Mohammed International Airport in Lagos. The ATM cards were discovered in the man’s luggage during the outward screening of passengers travelling to Istanbul, Turkey aboard Turkish Airlines. It was discovered that the man also had two international passports bearing photographs of him, but with different names.
“He had a Nigerian passport with the name Funsho Oladimeji Babatunde and a Turkish passport with the name Kosar Kursat, both bearing his photographs. The cards found in his luggage are 68 Citi MasterCard cards and 39 Citi Visa cards,” The NDLEA Airport Commander, Mr. Hamza Umar, said. The agency said the cards were believed to be used for fraudulent purposes, since he was not an authorized agent.
Also, last year, the EFCC arrested two undergraduates for an alleged N2.05 billion fraud at an old generation bank. They allegedly used Oracle’s ‘flexicube’ software to access a bank’s database and fraudulently transferred various sums of money. Chief Executive Officer, Forenovate Technologies Ltd, Don Okereke said cybercriminals were using skimming and trapping devices to steal credit/ debit card details of individuals without such persons knowing. He said there have also been several cases of online account takeover, where an unauthorised party gains access to an existing account by stealing the access codes and conducting illegal funds transfer to a designated account.
“In today’s increasingly connected world, convenience, speed, technology adoption, and payment options allow people and businesses to conduct online financial activities with ease. Fraudsters are taking advantage of this trend, fleecing customers of their funds. “A leading bank has been bragging of its capacity to open instant bank accounts via Facebook. I advise banks not to sacrifice security and safety of their customers for speed,” he said.
Okereke said a large number of bank customers are illiterates who are yet to be accustomed to the dictates of cashless banking and all the issues associated with it. He said many of these customers lost confidence in their banks after many reported cases of people losing their money to fraudsters. “There is also another category of discerning, security conscious Nigerians who are abreast with the weaknesses inherent in cashless banking. For instance, I am yet to download any of my banks mobile banking Apps because of security concerns,” he said.
The General Manager, IBM Africa, Taiwo Otiti, said these happenings led Visa International and other global payment firms to increase sophistication of technology deployed in Nigeria. He said during an interview at the IBM headquarters in Lagos: “The standard for Visa in Nigeria is the strictest in the whole payment system worldwide. The Visa stipulated a very, very high standard for Nigeria.
“We have seen syndicates work with internal staff of banks to transfer funds to fraudulent accounts. The easiest way is to get a normal card, open an account and get someone internally to transfer funds into the account. The funds are withdrawn mainly through the ATMs.”
Otiti explained that in other cases, online fraudsters could compromise a customer’s account by cunningly demanding his token. “They can send you a mail asking you to generate a token, and you would be unwise to oblige them. Remember, each time you generate a token, the system in the bank waits for further instruction that would come either from the fraudster, or from you,” he said.
The Chief Executive Officer, New Horizons Nigeria, an IT-security and business solutions company, Tim Akano, said these happenings showed that banks are still vulnerable to hacking, nearly two years after migrating to chip-and-pin technology from magnetic stripe cards. He said banks remain in very delicate condition, with high possibility of losing huge sums to fraudsters, especially through the collusion of insiders. Akano said it is the duty of banks and global payment companies to ensure data security and protect cardholders from fraud, while achieving electronic payments that are safe, simple and secure.
CBN’s position
Aware of these dangers, the CBN has decided to set up a five-year Information Technology (IT) Standards for banks. CBN’s Director, Information Technology, John Ayoh, said the exercise would help banks identify and adopt global IT standards that address industry problems. He said banks were expected to implement the plan on continuous basis and in accordance with set timelines.
CBN’s Director, Banking Payment and Systems Dipo Fatokun said the introduction of chip-and-pin payment cards have led to drastic drop in ATM card fraud. He said the CBN and other relevant institutions have been able to reduce card frauds considerably by instituting ATM Fraud Prevention Group and the Nigeria Electronic Fraud Forum (NeFF). The groups are to enable banks to collaboratively share data on fraud attempts and proactively tackle them to reduce losses.
According to Fatokun, the CBN, instructed banks to set and implement mandatory daily limits for ATM cash withdrawal, while other related transactions, including PoS and web purchases should be subjected to stringent limit as agreed and documented between the banks and customers. He said it was the responsibility of the banks to ensure that a trigger was automatically initiated when limits were exceeded.
CBN’s Deputy Director, Banking Supervision Ibedu Onyebuchi said banks have to wake up to the realities of cyber fraud and boost their IT formations in a way that hackers would not be able to penetrate, and when they do, their acts would be easily tracked and checked. Onyebuchi said banks have to improve on their IT, ensuring that they were not just rolling out e-payment products and channels, but also protecting their customers who use such platforms. “We cannot continue to roll out echannels without securing them. Transactions have moved from the banking halls to the e-channels. Therefore, we must control all aspects of these channels, both internally and externally,” he advised.
He said by strengthening IT in banks, management would be sure that depositors’ funds were secured and the customers too would be confident that their deposits and online transactions were protected. Phillips Oduoza, Group Managing Director, UBA Plc, says any serious banking institution that wants to succeed in this digital age cannot afford to ignore information security as any major compromise of bank’s system and network has potentials for colossal damage. He says no amount spent on banking security is too much, given the dangerous consequence of inaction.
Biometric Project Manager at NIBSS, Oluseyi Adenmosun, said the introduction of Bank Verification Number (BVN) by the CBN was to frustrate fraudsters. He said the project, which is part of the $50 million biometric contract awarded to Dermalog, a German-based IT firm, would make it extremely difficult for the fraud perpetrators to succeed. “It will not completely eliminate fraud, but it will cut it to the barest minimum,” he said.
What global payment companies have to say
Visa Country Manager in West Africa Ade Ashaye said the firm invests heavily in advanced fraud fighting technologies and continues to develop and deploy new and innovative programmes to mitigate fraud and protect cardholders. Ashaye said in an interview with The Nation that the global payment firm’s efforts have helped keep fraud rates steady near historic lows, enabling account holders to use Visa with confidence. “In fact, with technological innovations and advances in risk management, global fraud rates have declined by more than two-thirds in the past two decades. VisaNet has an enhanced ability to identify fraud on individual accounts and coordinated attacks on multiple accounts across the system, enabling issuers to stop potential fraud at checkout, before it occurs,” he said.
He said the firm’s advanced authorisation tool analyses and scores in real-time, every transaction for fraud potential. Risk scores are based on a global view of fraud and spending patterns across the entire network providing an analysis of fraud trends.
“In less than one second of processing, the Visa network can analyse transactions and provide risk scores accurately. This speed and clarity help issuers prevent fraud from occurring in the first place, rather than just reacting to fraud after it occurs,” he said. Also, Visa, MasterCard and American Express have proposed using “digital tokens” instead of account numbers for processing purchases made online and with mobile devices. Tokens provide an additional layer of security and eliminate the need for merchants, digital wallet operators or others to store account numbers.
Interswitch, owners of Verve card, explained that as a second layer of defence, it has also introduced Scorebridge, a fraud management system that enables Electronic Financial Transaction (EFT) messages to be processed through predefined Artificial Intelligence. This helps determine the transaction’s risk and probability of a fraud. Visa remains biggest payment network, with $4.4 trillion in purchases and 74.4 billion transactions in 2013. It, however, lacks direct hooks to consumers as it has to work through banks. MasterCard recorded $3 trillion in purchases on 45.5 billion transactions.
Way out
The Nigeria Interbank Settlement System (NIBSS), collaborating with banks, is working out modalities that will ensure that customers that use their e-payment cards to pay for goods and services on PoS terminals and web platforms get cash refund of 50 kobo for every N100 spent. Iku, who disclosed this, said lenders are serious about the offer, as they look at more ways of rewarding users of e-channels like PoS, Automated Teller Machines (ATMs) or even web payments. The removal of N100 ATM fee on other bank’s machines was also meant to encourage more people to embrace e-channels.
But after these carrots, also comes the stick. In most banks, withdrawing less than N100, 000 across the counter now attracts a surcharge. Customers are expected to use ATMs or make direct online transfer into beneficiaries’ accounts. Iku said despite these approaches, majority of bank customers still prefer cash transactions, mainly because of fear of losing their money in what they see as unsecured platforms.
Vice President, IBM Tivoli Storage, Software Group, Steve Wojtowecz advised banks to adopt efficient and quality banking software despite their high cost to effectively fight fraudsters.
Wojtowecz who spoke at the Edge 2014 conference organized by IBM in United States said that banks should ensure that people responsible for data security are highly efficient to achieve maximum protection.
He said the cost for acquiring software will be upset in a matter of months from efficiency and security benefits. He advised banks to acquire several layers of data security and authentication so that should one layer fail, the other can sustain their operations. “There are many mechanisms a bank can implement to limit fraud, including having several layers of data security and authentication, because preventing fraud is very difficult. Limiting fraud is the best case option at the moment,” Wojtowecz said.
Chief Executive Officer, Primex Background Check Limited, Frank Oyorhigho said most bank fraud takes place with internal connivance. “It is the rat inside that tells the rat outside that there is food in the house” he said proverbially.
He advised banks to ensure that they know their prospective employees beyond the qualifications and abilities. Banks, he said, are also expected to check in-between the lines, their attitudes, pedigree, integrity and where have worked before. “Having enough information about such employee like knowing the guarantor, village among others also serve as a serves as a check. It will check the employer. There are some people who cannot work in a particular industry because of their previous activities. They have been blacklisted,” he said.
Oyorhigho said a situation where the prospective employee is the one that takes the reference letter to the referee is not right because the report will be subjective. He said independent background check brings objective report but regretted that over 80 per cent of the banks do not employ independent verifiers to do the background checks for prospective employees. “Banks do not have the time, and also do not want to spend money conducting accurate background checks, and this is affecting fight against fraud,” he said.
Also, CBN Director, Banking Supervision, Mrs. Tokunbo Martins had in a letter to banks and discount houses titled: “The Need for the CBN Prior Clearance of Prospective Employees of Banks’ directed the lenders to always obtain its written approval before employment. The order was meant to prevent recycling of workers that had been indicted, terminated or dismissed for fraud and other acts of dishonesty within the industry.
Speaking at the 2014 Committee of Chief Compliance Officers of Banks in Nigeria (CCCOBIN) held in Lagos, CBN Deputy Governor, Financial System Stability Adebayo Adelabu said Nigeria has adequate legal and regulatory measures that should address breaches to the Know Your Customer (KYC), Customer Due Diligence (CDD) and Enhanced Customer Due Diligence (EDD) provisions.
“It is the application of these KYC provisions that are meant to reveal illegitimate sources of funds and trigger investigation by relevant stakeholders that matters. Like in many developing countries, compliance has been a major regulatory challenge in Nigeria,” he said. Adelabu said the 2013 Global Fraud Report showed Africa has the largest fraud cases. Among other regions surveyed, Sub-Saharan Africa scored 77 per cent as the zone with the most prevalent fraud problems.
For physical assets thefts, it scored 47; corruption, 30 per cent; regulatory or compliance breaches, 22 per cent; internal financial frauds, 27 per cent and misappropriation of organisational funds, 17 per cent. It also showed that 2.4 per cent of the regions revenues are lost to fraud. He disclosed that Global Economic Crime Survey 2014 by PWC Global showed that fraud, identity and password infringement and accounting fraud have damaged the reputation and integrity of financial institutions and also discouraged honest investors. “These practices have caused loss of jobs, loss of retirement benefits, untimely death and closure of businesses. They continue to affect the stability of financial institutions as well as economic growth of the country,” he said.
Adelabu said the practice of placing high value on the accumulation of wealth without regard to its source, continuous advancement in technology without commensurate emphasis on capacity building; inadequate laws or poor implementation of legal/regulatory provisions and insatiable appetite for wealth among others are fueling fraud, poor staff recruitment processes and weak internal controls are also to blame for rising cases of fraud.
Programme Director, Nigeria Leadership Initiative (NLI) Anthony Ubani said the solution to the e-payment crisis is that people in charge of processes should be rooted in values. That way, he said, it will be difficult for them to compromise the system. “In a society where morals and values have broken down, there is nothing that will work, be it technology or policies because it is the people that will execute them. If you bring someone that lacks values to execute a laudable policy, he will compromise the entire process. Nigeria’s problems have not been lack of ideas or policies, or programmes or plans, but lack of value-based leaders,” he said.
