Nigeria NCC Warns: AI Fraud Poses Major Telecom, Banking Threat

• The Nigerian Communications Commission warns that AI-powered cybercrime poses significant threats to the nation's telecommunications, banking, and national security.
• AI-driven attacks are increasingly sophisticated, employing tactics like tailored phishing, automated credential attacks, deepfakes, and self-rewriting malware.
• The NCC has established a Computer Security Incident Response Team and rolled out a Cyber Resilience Framework, urging operators to adopt zero-trust security systems.
• NITDA is collaborating on reviewing the Cybercrime Act and developing a national cybersecurity architecture to address human vulnerabilities.
• The Attorney-General's office is preparing legislative reforms to enhance electronic evidence management and prosecutions against emerging cyber threats.

The potential for widespread disruption, from banking services to national defense, underscores that cybersecurity is no longer merely an IT concern but a fundamental aspect of national stability and economic growth.

The Nigerian Communications Commission (NCC) has issued a stark warning regarding the increasing use of artificial intelligence (AI) by cybercriminals, identifying it as a significant threat to the nation's telecommunications infrastructure, banking sector, and overall national security. Dr. Aminu Maida, the Executive Vice-Chairman of the NCC, conveyed this urgent message on Tuesday at the second International Cybersecurity Conference held in Abuja. He underscored that AI-driven attacks are rapidly evolving in sophistication, posing a severe risk to the integrity of digital networks and the security of financial transactions across the country.

Represented by Sunday Oshadami, the commission's Executive Commissioner for Technical Services, Dr. Maida elaborated on the advanced tactics now employed by malicious actors. These include AI-powered phishing campaigns meticulously tailored to individual targets, automated credential theft operations, and the use of deepfakes engineered to circumvent multi-factor authentication protocols. Furthermore, cybercriminals are deploying malware capable of self-modification to evade detection by conventional security systems. This new paradigm means that security professionals are no longer contending with human adversaries operating at human speeds, but rather machine learning systems executing computations at microsecond intervals.

Nigeria's digital economy is heavily reliant on its telecommunications backbone, which facilitates a vast array of essential services, including banking transactions, business operations, public service delivery, and general communication. Consequently, any successful attack on a telecom provider carries profound implications, potentially disrupting other vital sectors. Dr. Maida explicitly stated that an assault on a telecommunications network effectively constitutes an attack on the financial sector, national defense capabilities, and civil governance. This critical interdependency is further underscored by Nigeria's designation of its telecommunications infrastructure as Critical National Information Infrastructure, emphasizing the imperative to safeguard these networks against the escalating threat of AI-powered cybercrime.

In response to these pervasive threats, the Nigerian Communications Commission has implemented several strategic measures. The NCC has established a dedicated Computer Security Incident Response Team (CSIRT) tasked with monitoring emerging threats, coordinating intelligence sharing among stakeholders, and enforcing mandatory incident reporting protocols. Additionally, the commission has introduced a comprehensive Cyber Resilience Framework, designed to set common security standards for all licensed telecommunications operators within Nigeria. Operators are strongly encouraged to adopt zero-trust security systems, conduct continuous audits of their AI models for potential vulnerabilities, and develop network architectures capable of rapid recovery from attacks without experiencing prolonged service disruptions.

Complementing the NCC's efforts, the National Information Technology Development Agency (NITDA) is also actively engaged in bolstering Nigeria's cybersecurity posture. Kashifu Abdullahi, the Director-General of NITDA, highlighted that cybercriminals are increasingly exploiting human vulnerabilities rather than directly targeting technological systems. To address this, NITDA is collaborating with the Office of the National Security Adviser and the National Assembly on a thorough review of the existing Cybercrime Act. This initiative also involves exploring the development of a robust national cybersecurity architecture and strengthening the nation's digital sovereignty.

Further legislative reforms are underway, spearheaded by the Attorney-General of the Federation and Minister of Justice, Lateef Fagbemi. Represented by Rotimi Oyedepo, the Director of Public Prosecutions, Fagbemi confirmed that the Ministry of Justice is developing new legislation specifically aimed at addressing emerging cyber threats. These proposed reforms are intended to enhance the management of electronic evidence, streamline investigations, and improve prosecution processes, all while meticulously safeguarding fundamental rights. These coordinated efforts across regulatory bodies and government ministries underscore a unified approach to confronting the complex challenges posed by AI-driven cybercrime.

The convergence of advanced artificial intelligence with malicious intent presents an unprecedented challenge to Nigeria's digital landscape, making the proactive measures by the Nigerian Communications Commission and other government agencies critically important. The warnings from the NCC, particularly concerning the speed and sophistication of AI-driven attacks, highlight an urgent need for robust defense mechanisms across all critical sectors. The potential for widespread disruption, from banking services to national defense, underscores that cybersecurity is no longer merely an IT concern but a fundamental aspect of national stability and economic growth.

The ongoing review of the Cybercrime Act, coupled with the Attorney-General's proposed legislative reforms, signifies a crucial evolution in Nigeria's legal framework to combat these modern threats. These changes will likely introduce new compliance obligations and enforcement mechanisms, requiring heightened vigilance from legal and compliance professionals, especially those advising telecom operators and financial institutions. Adopting the NCC's Cyber Resilience Framework and implementing zero-trust security systems are no longer optional but essential strategies for mitigating escalating risks and avoiding potential regulatory penalties.

Moreover, the proposal by Shuaib Salisu, Chairman of the Senate Committee on ICT and Cybersecurity, for a national cybersecurity resilience index to assess organizations, points towards a future where accountability and preparedness will be systematically measured. This comprehensive approach, encompassing regulatory directives, legislative updates, and industry best practices, is vital for Nigeria to secure its digital future against the persistent and evolving threat of AI-powered cybercrime, ensuring the continued integrity of its telecommunications, banking, and national security infrastructure.

Lawyers and compliance officers in Nigeria, especially those advising telecom operators and financial institutions, must closely track the ongoing review of the Cybercrime Act and proposed legislative reforms by the Attorney-General, as these will likely introduce new compliance obligations and enforcement mechanisms in response to AI-powered cyber threats. They should also advise clients on adopting the NCC's Cyber Resilience Framework and zero-trust security systems to mitigate escalating risks and avoid regulatory penalties.

Source: Original reporting via The PUNCH