Recent reports from late March and early April 2026 have highlighted a major cyberattack targeting First City Monument Bank (FCMB). While the bank successfully blocked the majority of the fraudulent activity, a significant sum was still moved, raising concerns for digital banking safety.
The Incident: What Happened?
A sophisticated fraud syndicate targeted FCMB in a large-scale operation that aimed to siphon over ₦3.5 billion.
- The Method: Attackers reportedly exploited a “logic flaw” in the bank’s digital transaction pipeline, specifically an API reconciliation layer involving the Payattitude integration.
- Zero Balance Exploit: This vulnerability allowed hackers to initiate transactions that the system validated as “successful” even when source accounts had no funds.
- The Result: FCMB’s security systems detected the anomaly and activated a “kill switch,” successfully blocking ₦2.4 billion. However, approximately ₦677 million was successfully routed to “mule accounts” and withdrawn before the access was fully cut off.
Are Customer Funds Safe?
Reports indicate that the bank has focused on limiting exposure and recovering the stolen funds through legal and forensic channels.
- Court Action: An alleged hacker was recently remanded by the Lagos State Special Offences Court in connection with the theft of ₦3.09 billion from FCMB accounts.
- No Reported Loss to Depositors: There has been no widespread indication that individual customer deposits were lost; the bank’s internal response and recovery efforts are currently aimed at retrieving the ₦677 million that left the system.
Immediate Steps If You Suspect Your Account is Compromised
If you notice unauthorized transfers or suspicious activity on your FCMB account, take these actions immediately:
- Block Your Account: Call the bank’s fraud desk immediately.
- Contact Official Support:
- Call Center: 0700 329 0000
- Email: [email protected] or [email protected]
- Update Security: If you have mistakenly clicked on suspicious links or shared details, change your Mobile App PIN and ATM PIN immediately at a bank branch or via the FCMB Online Fraud portal.
How to Protect Your Account
- Beware of Social Engineering: FCMB will never ask for your PIN, OTP, or password via phone or email.
- Verify Emails: Ignore emails asking you to “update account information” via unverified links.
- Use the USSD Help Menu: You can manage your account and resolve disputes by dialing *329# and selecting the “Self-Service” option.
For further updates and official security tips, you can visit the FCMB Fraud Management page.
Andrew Odekina, has been remanded at the Kirikiri Correctional Facility by the Lagos State Special Offences Court in connection with the ₦3.09 billion fraud.
- FCMB has stated there is no indication of customer deposit losses, as the breach primarily targeted the bank’s internal digital infrastructure.
- Recovery Ongoing: The Economic and Financial Crimes Commission (EFCC) is actively tracing the remaining ₦677 million and prosecuting other syndicate members.
-
UPDATES | ADVISORY | COMPLIANCE | NEWS
Nigeria Data Protection (Amendment) Bill, 2026: All you need to know.
A major debate is currently trending in the data protection space regarding the controversial Nigeria Data Protection Amendment Bill. The proposed bill, sponsored by Senator Ned Nwoko, seeks to introduce strict adjustments to how international tech companies handle Nigerian user data. The most heavily searched aspect of this bill is a mandate requiring every social […]
-
EVENTS | INTERNATIONAL | NEWS | UPDATES
ISACA Honours NDPC for Distinguished Regulatory Leadership in Nigeria
The Nigeria Data Protection Commission has received the Industry Leader Regulator Recognition Award from the ISACA Lagos Chapter during its 30th-anniversary celebration in Lagos. The ISACA Lagos Chapter honored the commission for its distinguished leadership, resilience, and commitment to building a trusted digital ecosystem in Nigeria. Ms. Omoikhefe Ahimie, the commission’s Lagos Liaison Officer, received […]
-
ADVISORY | COMPLIANCE | NEWS
Why non-compliant Businesses Are Being Locked Out of Government and Corporate Contracts
In business data protection compliance certificate is no longer just a regulatory formality—it is a mandatory license to do business. Across the globe, governments and major corporations are actively severing ties with third-party vendors, suppliers, and contractors who cannot prove their data protection compliance. If your organization lacks a valid data protection registration certificate, you […]
-
Fake Compliance Scams Target Small Businesses: How to Verify Your Data Protection Status for Free
As regulatory bodies crack down on data privacy violations, a rising wave of predatory compliance scams is targeting small businesses, charities, and independent professionals across the country. Fraudulent actors, posing as official agents, are demanding exorbitant fees for “mandatory” data protection registration certificates—fees that many struggling organizations simply cannot afford in today’s harsh economic climate. […]
-
The Beginner’s Guide to Renewing Your NDPC Data Protection Registration under the NDPA 2023
If your business collects, stores, or processes the personal data of up to 200 or more Nigerians within a six-month period—whether it’s customer phone numbers, BVNs, email addresses, or employee payroll—you are legally classified as a data controller or data processor. Under the Nigeria Data Protection Act (NDPA) 2023, managing this data comes with strict […]
-
ADVISORY | COMPLIANCE | DATA BREACH | INTERNATIONAL | NEWS | UPDATES
Multiple Nigerian Communications Commission Web Servers Compromised by Threat Actors
The Nigerian Communications Commission (NCC) is facing a significant security incident following a cyberattack that successfully compromised at least two of its public-facing web servers. Threat actors breached the infrastructure hosting consumer.ncc.gov.ng (the NCC Consumer Affairs bureau portal) and csirt.ncc.gov.ng (the official portal for the NCC’s Computer Security Incident Response Team). The irony of the […]
