Nigeria's rogue base-station warning moves banking fraud into the radio layer

A warning, not confirmation of an attack in Nigeria

On 24 September 2026, NCC-CSIRT, the incident-response team of the Nigerian Communications Commission, published advisory NCC-CSIRT-2026-010 on rogue cellular networks and mobile-signal hijacking used for banking fraud. The notice followed information shared with Nigerian authorities about a case in the United Arab Emirates, where a criminal group reportedly used specialised equipment to create fake mobile networks, intercept text messages and send messages impersonating banks.

The distinction matters. The advisory does not confirm that an identical campaign has been observed in Nigeria. It describes a threat rated critical and highly probable for a country where the phone is simultaneously a banking channel, an identity attribute and an authentication mechanism. The important development is therefore not an unproven claim of a national breach. It is the movement of fraud into a different technical layer: attackers are no longer limited to deceiving users over the Internet; they may try to position themselves between a handset and the mobile network.

How the technique changes the attack surface

NCC-CSIRT describes criminals temporarily degrading legitimate coverage in a target area and then activating a rogue base station with a stronger or more attractive signal. Nearby devices may connect to infrastructure controlled by the attacker. That infrastructure can be used to inject messages that appear to come from a financial institution, conduct localised smishing campaigns or attempt to intercept communications, including SMS one-time passwords.

This model weakens several familiar defences. A bank's messaging filter or domain-reputation service may never see an SMS injected directly through rogue radio equipment. HTTPS does not protect a customer who trusts a fraudulent message and discloses information through another channel. An SMS OTP is also less convincing as proof when the radio path or the telecom identity surrounding the number has been manipulated.

Rogue stations should not be described as universally capable devices. Their practical reach depends on equipment, spectrum, network generation, encryption, handset behaviour and operator configuration. The operational conclusion remains sound: a bank cannot manage this risk alone when its authentication journey relies on a mobile network.

The mobile number has become financial infrastructure

In Nigeria and across many African markets, one number connects bank accounts, mobile wallets, transaction alerts, account recovery and sometimes public identity services. That concentration creates systemic dependency. A telecom anomaly can become financial fraud, while a compromised financial interaction can be concealed behind convincing messages delivered to the customer.

In August, the NCC also explained its Telecoms Identity Risk Management System, or TIRMS. Authorised organisations can use it to check whether a number has recently been SIM-swapped, recycled, churned, blacklisted or reassigned. This is useful against fraud linked to the lifecycle of a number. It does not, on its own, identify a rogue radio station operating locally without formally changing the SIM's status.

Defence therefore needs two families of signals. The first concerns number identity: a recent SIM change, reassignment, unusual device or account-recovery event. The second concerns network behaviour: an unknown cell, abnormal radio parameters, jamming, clusters of suspicious messages, unusual geography and simultaneous customer complaints from one area.

A shared telecom and financial responsibility

NCC-CSIRT recommends rogue base-station detection, stronger spectrum monitoring, mechanisms to block unauthorised transmissions, cooperation with security agencies and enhanced supervision of SMS gateways. Financial institutions need to add their own controls.

Banks and fintechs should reduce the authority granted to a standalone text message for sensitive operations. A high-risk transaction can combine in-app authentication, binding to a known device, local biometrics, transaction-specific confirmation and behavioural analytics. A recent SIM change or network anomaly should not automatically exclude legitimate customers, but it can trigger a stronger verification path.

A GSMA case study on scam controls in Malaysia illustrates the value of a layered model: SMS firewalls, behavioural detection, shared intelligence, rogue-station location and physical intervention. African markets should not copy another jurisdiction mechanically, but the underlying lesson travels well. No single organisation sees the complete chain.

Priorities for African operators and financial institutions

• Map every banking and wallet journey that still treats SMS as the decisive factor.
• Correlate fraud alerts with SIM events, device changes and radio-network anomalies.
• Deploy rogue-station detection around financial districts, government zones and dense public areas.
• Establish rapid coordination among operators, banks, fintechs, spectrum regulators and investigators.
• Tell customers that a message displaying a bank's name is not proof of authenticity.
• Preserve accessible alternatives for basic-phone users so that stronger security does not become financial exclusion.

Conclusion

Nigeria's advisory does not document a confirmed domestic wave. It identifies a credible evolution of mobile fraud, and its lesson extends beyond Nigeria. Where a phone number has become a banking key, financial security also begins in the radio spectrum. Resilient systems will connect telecom identity, network detection, transaction controls and a shared operational response.

— ◆ —