THE FLUTTERWAVE SHENANIGANS

In February and March, 2023 it was reported that Flutterwave, a fintech was hacked and customer funds, amounting to over N2.9 billion, held in Flutterwave accounts, were illegally transferred to several bank accounts in Nigeria. Flutterwave submitted a petition to the Nigeria Police concerning the hack and illegal transfer and based on the petition, the Police brought an application to freeze accounts in 27 financial institutions in Nigeria where some of the funds were transferred to and the court granted the application. In the affidavit in support of the application to freeze accounts, the Investigating Police Officer; Inspector Adebowale Michael deposed or swore in paragraphs 1, 3 and 4 as follows:

"(1) That am the above-named person as well as the investigating police officer in a case of Conspiracy and fraudulent transfer reported by Flutterwave Technology Solution Limited through his counsel Albert Onimole, legal practitioner by virtue of which I am conversant with the fact of this case.

(3) That a case of Conspiracy and Fraudulent transfer was reported to the Police via petition written by Albert Onimole & Co. on behalf of Flutterwave Technology Solution Limited bothering on allegation of Conspiracy, stealing and fraudulent transfer over Two billion naira having hacked into the complainant account. Copy of the Petition is hereby attached and marked exhibit ‘A’.

(4) That it was revealed in the course of investigation that the suspected hackers hacked into the cyber space of the complainant and transferred over two billion naira to various accounts listed on this application. Copy of the statement of the Complainant is hereby attached and marked exhibit ‘B’."

Flutterwave in its official statement, said; “During a routine check of our transaction monitoring system, we identified an unusual trend of transactions on some users’ profiles. Our team immediately launched a review (in line with our standard operating procedure), which revealed that some users who had not activated some of our recommended security settings might have been susceptible.” However, the fintech flatly denied that any user lost any funds, as its security measures were “able to address the issue before any harm could be done to our users”.

This denial is in stark contrast to the contents of the petition and affidavit earlier mentioned. If no user funds were lost, how come there was a petition to the police and an application to freeze accounts? The denial and statement shifting blame to "some users who had not activated some of our recommended security settings" is typical of what many financial institutions in Nigeria say whenever a customer complains of unauthorised withdrawals or transfers from their accounts. In the case of Barrister Wole Abidakun v. Diamond Bank Plc.(Suit No: CV/2779/18), which involved unauthorized transfer from customer account, Justice Kutigi of the High Court of the FCT, while delivering judgement on 23 June, 2021 observed thus:

“I agree that because these facilities have security features known only to the customer  and  so  the  customer  bears  some  responsibility  to  secure  them,  once however  a  customer  makes  a  serious  complaint  of  foul  play  in  his  account,  the usual  standard  and  rather  lazy  and  lame  response  by  Defendant  Bank  that  the customer has compromised the security features will not stand or fly in the absence of a forensic investigation to determine responsibility.  There must be proper in-house  and  then  police  investigations  showing  clearly  and  positively  that  the customer  must  have  indeed  compromised  the  security  features  or  given  his  PIN numbers to a third party.  Bare and empty verbal assertions will not suffice in this age of savvy and sophisticated criminals.”  

Now, if it were in the United States, where data breaches and hacks are not tolerated by the financial services regulators, Flutterwave would have been in big trouble. The regulators would have carried out investigations and Flutterwave would have been fined heavily if found wanting. Flutterwave customers would have also likely filed a class action against the fintech.

For instance, in 2020 in the US, a class action was filed against Bank of America for failing to provide sufficient protections for unemployment payment debit cards after thousands across California, fell victim to fraud. Among the issues that were raised in the case against the bank was the lack of secure microchips in unemployment debit cards, a failure to secure private account information and a sluggish response to consumer fraud reports.

Also in the United States, the Consumer Financial Protection Bureau (CFPB) in 2016, found that online payment platform Dwolla, deceived consumers about its data security practices and the safety of its online payment system and therefore ordered Dwolla to pay a $100,000 penalty and fix its security practices.

As of May 2015, Dwolla had more than 650,000 users and had transferred as much as $5 million per day. For each account, Dwolla collected personal information including the consumer’s name, address, date of birth, telephone number, Social Security number, bank account and routing numbers, a password, and a unique 4-digit PIN.

From December 2010 until 2014, Dwolla claimed to protect consumer data from unauthorized access with “safe” and “secure” transactions. On its website and in communications with consumers, Dwolla claimed its data security practices exceeded industry standards and were Payment Card Industry Data Security Standard compliant. They claimed also that they encrypted all sensitive personal information and that its mobile applications were safe and secure.

However, it was found that Dwolla’s data security practices in fact fell far short of its claims. Specifically, the CFPB found, among other issues, that Dwolla misrepresented its data-security practices by:

(1)Falsely claiming its data security practices “exceed” or “surpass” industry security standards: Contrary to its claims, Dwolla failed to employ reasonable and appropriate measures to protect data obtained from consumers from unauthorized access.

(2)Falsely claiming its “information is securely encrypted and stored”: Dwolla did not encrypt some sensitive consumer personal information, and released applications to the public before testing whether they were secure.

The above action of the CFPB in the US represents how a regulator should act in the face of continuous data breaches and/or hacks.  In 2022 it was MTN Mobile Money Bank that was hacked but it is unclear what actions, if any, the  regulators in Nigeria took or made against MTN, concerning the breach or hack. The Federal Competition and Consumer Protection Commission, the Central Bank of Nigeria, the Nigeria Deposit Insurance Corporation, and the newly created Nigeria Data Protection Commission needs to sit up and do more.

It is therefore, high time that the regulators in Nigeria mentioned above woke up to their responsibilities and took punitive action against erring financial institutions in Nigeria for data breaches and hacks. Perhaps the fear of sanctions will make the financial institutions to improve on their cyber security practices and better protect customer funds/deposits in their custody.

It is also recommended that there should be a quarterly or yearly report made available to the public, showing financial institutions that were sanctioned for failing to comply with relevant industry cybersecurity framework and/or data protection regulations.

 

 

Nigeria and Data Protection

According to Omer Tene & Jules Polonetsky:

“We live in an age of “big data.” Data has become the raw material of production, a new source of immense economic and social value. Advances in data mining  and  analytics  and  the  massive  increase  in  computing  power  and  data storage capacity have expanded, by orders of magnitude, the scope of information available to businesses, government, and individuals. In addition, the increasing  number  of  people,  devices,  and  sensors  that  are  now  connected  by digital networks has revolutionized the ability to generate, communicate, share, and access data. Data create enormous value for the global economy, driving innovation, productivity, efficiency, and growth.  At the same time, the “data deluge” presents privacy concerns that could stir a regulatory backlash, dampening the data economy and stifling innovation."

It is therefore clear from the above that data, especially personal data(any data or information in connection with a specific individual, which can be used, separately or in combination with other data, to identify an individual) has acquired an immense value in the age we are living(the digital age) and serious steps ought to be taken to protect the personal data of citizens but Nigeria seems to be lagging behind as the best we have at the moment is the guidelines on personal data issued by National Information Technology Development Agency(NITDA) which is good gut not enough(what we need is a law) and there is also a draft bill on Personal Information and Data Protection which is pending before the federal lawmakers.

This does not augur well for the citizens whose personal data is scattered all over the place (banks, the Federal Road Safety Commission (FRSC), the National Identity Management Commission (NIMC), the Nigeria Communications Commission (NCC), GSM service providers and online retailers like Jumia and Konga who are currently making waves in the Nigeria internet sphere as online shopping is becoming increasingly popular among Nigerians).

In China they have taken serious steps to guard and protect the personal data of their citizens with the passage of such laws as the Peoples’ Republic of China Law on the Protection of Consumer Rights and Interests and persons who flout the law are been arrested and prosecuted. For instance the Police in China, apprehended a 10-member gang in Beijing and Shanghai for illegally obtaining and selling nearly one million...You can find the rest of the story here. 

Why You Should Format or Permanently Delete Data on Your Laptop Computer before Selling It

Always ensure that you format or completely wipe off the data on your laptop computer, phone or USB flash drive before selling it. This might save you from a lot of trouble, embarrassment or legal action depending on which part of the world you are in. The story of a 25 year old American; Brian K. Rogers might make you want to have a rethink when you are selling your laptop computer, USB flash drive or phone. Brian sold his laptop to a pawn shop. The company while trying to restore the laptop to factory settings so that it could be resold discovered files (videos and images) of child pornography in the recycle bin of the laptop. In case you are not aware, it is an offence to knowingly possess child pornography in the US. The company contacted the police and upon investigation Brian’s desktop computer at home was searched and more child pornography files were discovered on the desktop. He was charged to court, tried, convicted and sentenced to 5 years imprisonment and also ordered to pay more than $3,000(about N480,000) in restitution to a victim in a video he downloaded. He was also sentenced to eight years of probation. Brian’s story can be found here  and here.

Now, only if Brian was careful enough to format his laptop before selling it to the pawn shop, his criminal activities won’t have been exposed. Brian been an American and in America where there is a high rate of computer literate persons you would expect that Brian would not take things like formatting his laptop before selling it for granted or he would know that it is crucially important for him to format his laptop before selling it. The implicating pornographic file was actually found in Brian’s recycle bin. It was that discovery that led to further discovery of implicating files on his home computer (desktop).

It is instructive to note that when you delete files from your computer they go to the recycle bin and even when you empty your recycle bin the contents of the file are not physically obliterated on your computer’s hard drive, but rather the file is simply flagged as deleted. More precisely, the space it occupies is marked as available for writing or saving new files. This means that the older the file, the less chance there is of successful recovery because it is more likely to have been overwritten by another newer file and this applies to your memory card or USB flash drive. However, with appropriate softwares (e.g. Recuva, Easus Data Recovery Wizard) the files could still be recovered if they have not been overwritten by new files.

In other words files that are deleted on your laptop or when you empty your recycle bin or format your laptop are not really deleted or permanently erased, it is only the links to where the files are located on your laptop or memory card or flash drive that are removed and despite allowing you to use the space for other files again, the actual information is still lurking on your disk space therefore even when you format your laptop files could still be recovered by an adept computer user using recovery softwares.

However to delete files and render them unrecoverable you try using such softwares like File Shredder which erases files permanently so it cannot be recovered and is part of Glary Utilites which can be found here or CCleaner which provides a method to permanently remove any deleted data from your hard drive, memory card or USB flash drive. For more information on how to permanently delete or erase data on your computer read this article.