Nigeria's 3G retirement is a security project, not only a spectrum project

A direction of travel, not yet a Nigerian deadline

On 22 June 2026, TechCabal reported that MTN Group is preparing to shut down some of its African 3G networks before 2030. The operator has not announced a Nigeria-specific retirement date. The direction is nevertheless clear: 3G still consumes spectrum, equipment and operational attention while users increasingly move to 4G and 5G.

Statistics published through the Nigerian Communications Commission illustrate the shift. In April 2026, 3G represented 5.32% of mobile connections, compared with 54.41% for 4G, 35.93% for 2G and 4.34% for 5G, according to figures cited by TechCabal from the regulator's portal. The network generation that helped establish Nigerian mobile internet is no longer the dominant access layer.

For operators, refarming frequencies can improve capacity and energy efficiency on newer networks. For security and business-continuity teams, the relevant question is different: which services still depend on a SIM, modem or radio module that can only use 3G?

How retirement can reduce security complexity

An older mobile network is not automatically insecure. However, every maintained generation adds operational surface: radio equipment, core-network functions, management interfaces, signalling rules, suppliers, billing systems and specialist skills. Running several layers in parallel increases the number of configurations that must be monitored and the number of fallback paths an attacker may try to abuse.

Retiring a lightly used layer can therefore reduce complexity, support more consistent controls and concentrate investment on networks with stronger monitoring. It can also accelerate the replacement of modems with unsupported firmware and obsolete management platforms. That benefit only exists if equipment is actually removed, administrative access is revoked and inherited rules are cleaned up. A commercially retired technology that remains reachable from an internal network is still technical debt.

The transition should not create another false assumption: 4G or 5G does not mean automatic security. API flaws, weak identity controls, exposed interfaces and poor segmentation remain possible. The gain comes from reducing the component count and using the migration to rebuild coherent controls.

The hidden risk is machine connectivity

Visible subscribers usually migrate when they replace or reconfigure a handset. The harder dependencies to identify are machine-to-machine uses: payment terminals, cash machines, alarms, lifts, meters, vehicle trackers, backup routers, agricultural systems and telemetry devices. These assets can operate for years without appearing in a conventional IT inventory.

In Nigeria, this matters directly to banks, fintechs, retailers, logistics companies and infrastructure operators. A terminal may use fibre or Wi-Fi during normal operation while keeping a 3G SIM as its backup. The failure will then become visible only during a primary outage, exactly when the organisation depends on resilience.

A migration based only on subscriber numbers may miss critical services. Operators can see SIMs and traffic profiles but may not know the business function behind every module. Enterprises understand their processes but may not know which radio generation a device actually negotiates. A credible inventory has to combine both views.

Fraud will use the migration as a pretext

Network changes also create believable social-engineering material. Fraudsters can claim that a SIM update, 4G activation or urgent replacement is required to avoid disconnection, then ask for a one-time code, credential or payment. This is particularly sensitive where financial and public services rely on the mobile number as a contact and recovery channel.

Operators and regulators need simple public guidance: a legitimate migration does not require a customer to disclose a PIN, password or OTP to a caller. Official campaigns should use recognisable domains, short codes and service locations. Banks should monitor unusual SIM and device changes during the transition while avoiding indiscriminate blocks on people legitimately replacing old equipment.

A defensible migration method

The first step is a data-led inventory. Operators can identify SIMs that still attach exclusively to 3G and distinguish smartphones, routers and IoT modules. Enterprises should reconcile those lists with asset registers, telecom contracts and continuity plans.

The second step is to test fallback paths. Equipment marketed as 4G-compatible may still prefer 3G, support the wrong local bands or depend on old firmware. A controlled trial that removes 3G from a limited area can reveal those gaps before national retirement.

The third step is secure decommissioning. Old gateways should be removed from monitoring systems, directories, VPNs and access lists. Unused SIMs should be disabled. Devices holding credentials or logs should be wiped before disposal or recycling.

What organisations should do now

• Ask operators for a list of corporate lines and modules still limited to 3G.
• Locate cellular POS devices, alarms, backup routers and industrial equipment.
• Test continuity by temporarily forcing equipment onto 4G.
• Add fake migration notices to fraud-awareness exercises.
• Budget for hardware replacement, not only subscription changes.
• Maintain one timetable across network, security, procurement and business teams.

Conclusion

Retiring 3G can simplify and modernise Nigerian mobile infrastructure. It can also cause avoidable disruption if hidden uses are discovered only at the deadline. The useful readiness measure is not merely the percentage of customers already using 4G. It is the percentage of critical services tested without 3G, with a complete inventory, an accountable owner and a verified fallback.

— ◆ —