Police arrest eight-member syndicate over fake NIN verification platforms

Operatives of the Nigeria Police Force (NPF) attached to the National Cybercrime Centre (NCCC) have apprehended eight members of a syndicate behind several unauthorised identity verification platforms that illegally harvested Nigerians’ personal data under the guise of accessing the National Identity Management Commission (NIMC) database.

Addressing a joint press briefing in Abuja on Thursday, Deputy Force Spokesman, ACP Victor Isuku, disclosed that the centre deployed advanced digital forensic techniques to trace the culprits and their illicit domains.

The Deputy Force Public Relations Officer explained that the operation followed a petition by the NIMC Director-General, Abisoye Coker-Odusote, over the unlawful distribution and commercialisation of Nigerians’ personally identifiable information (PII).

According to him, “the NPF National Cybercrime Centre achieved these feats through the use of digital forensic techniques, which helped identify the threat actors and domains involved in the unlawful sale and verification of NIN-linked PII.”

He revealed that the masterminds were Hamzat Lukman and Babalola Tolani Suleiman, arrested in Kwara and Lagos States respectively. Lukman, a software developer, allegedly created and hosted the domain goverify.com.ng on behalf of Suleiman for commercial verification purposes, while also hosting three other domains for the same objective.

Further investigations led to the arrest of other collaborators, including Nura Bello and Ibrahim Abubakar, who were linked to idfinders.com.ng. Others arrested are Shoara Kehinde, Abubakar Amisu, Abdullahi Salisu, and Ashiru Sanni.

“Other domains used to perpetrate this cyber intrusion include verifymyNIN.com, triplus.ng, goverify.com.ng, idfinder.com.ng, verifyforme.com.ng, subpoint.com.ng, verify.datashop.com.ng, championtech.com.ng, anyverify.com.ng, cremetech.com.ng, nickverify.humanity.com.ng, and inventor.com.ng,” Isuku added.

He noted that efforts were ongoing to track down other perpetrators involved in the unlawful distribution and commercialisation of citizens’ data, as well as dismantle syndicates targeting government databases.

Isuku stressed that Inspector-General of Police, IGP Kayode Adeolu Egbetokun, had directed the NCCC to intensify its clampdown on criminal groups targeting critical national infrastructure.

“The IGP has reaffirmed the commitment of the Nigeria Police Force to combating all forms of cybercrime, safeguarding national digital assets, reinforcing data privacy, and protecting the integrity of citizens’ identification data. This operation is a milestone for the Police, for NIMC, and for Nigeria,” he stated.

In his remarks, the Director of the NPF-NCCC, CP Ifenayi Uche, clarified that contrary to public fears, the NIMC database itself was never breached.

ALSO READ:Equities market further dips by 0.5% as investors lose N437.5bn

“When the case was reported, we conducted vulnerability assessments and penetration tests. We confirmed there were no breaches in the NIMC system. What we uncovered was the existence of third parties who created phishing links mimicking NIMC’s website to harvest Nigerians’ personal data for commercial purposes,” Uche explained.

He added that the suspects had built parallel databases with stolen information, which they sold to unsuspecting clients. According to him, 13 of the 14 fraudulent domains identified during the operation have been successfully taken down.

“Out of the 14 domains reported by NIMC, we have been able to take down 13. We also arrested eight of those behind the malicious domains, and prosecution will follow this press briefing,” he said.

In her remarks, NIMC DG Abisoye Coker-Odusote assured Nigerians that the Commission had intensified safeguards to protect citizens’ data.

“The National Identity Management Commission remains steadfast in protecting the integrity of Nigeria’s national identity database. We have recently upgraded our systems to accommodate up to 250 million registrations, decentralised enrolment processes to the ward level, and strengthened our cybersecurity architecture,” she said.

She urged Nigerians to avoid patronising unauthorised agents or business centres, stressing that enrolment is free at all approved NIMC centres.

“There is only one official website. Citizens should use only authorised channels for enrolment, modification, and verification,” Odusote warned.

TRIBUNEONLINE