Nigeria: fake road safety websites steal bank codes in real time

On 16 September 2026, Nigerian actress Eva Ibiam described on social media how she had lost nearly ₦400,000 in a few minutes. It all started with a text message informing her of a new traffic offence recorded by the Federal Road Safety Corps (FRSC), the federal road safety agency. A few days earlier, she had in fact been stopped by officers who photographed her number plate. So the message seemed credible.

The link led to a polished page showing a speeding offence, a “reduced” fine to pay quickly, and a form to enter her bank card details. According to a bank alert seen by the outlet The Condia, UBA sent her a genuine one-time code at 3:27 pm, followed a few minutes later by a debit of ₦364,574.36. The transaction description: an online purchase from a merchant called “SERIOUS FIX MACHINERY”, in Dubai.

The security code, the scam’s target

The most worrying element of this case is the code. The one-time code sent by the bank, often called an OTP, is supposed to protect against this kind of fraud: even if a scammer knows your card number, they cannot pay without this code. Here, the fraudsters obtained it live.

Two methods are possible, and analysis of the case did not settle which. Either the fake site displays a second screen asking for the code received, under the pretext of “confirming payment of the fine”. Or the scam operators watch the site in real time: as soon as the victim enters their card details, they launch a purchase abroad themselves, trigger the bank to send the code, and retrieve that code on the fake page before it expires. Either way, speed is essential, hence the urgency hammered home in the text message and on the site.

• 1. A text message announces a traffic offence and points to a link.
• 2. A fake page in official colours shows a “reduced” fine to pay quickly.
• 3. The victim enters their bank card details.
• 4. The scammers launch a purchase abroad; the bank sends a real code to the victim.
• 5. The victim enters that code on the fake page: the purchase is approved and the money is gone.

Addresses that keep rotating

Eva Ibiam’s case was not isolated. Many users shared almost identical messages on X and Facebook, pointing to a growing list of addresses: fctevreg.cam, frscgov.top, frsac-govt.cc, fctevregonline.click, fctevreg-gov.top, and several subdomains of a service under .eu.cc. Most end with the path “/ng”. These sites do not redirect to the official portals: they are the phishing pages themselves, imitating the look of the FRSC or vehicle registration services.

Public registration data is available for only one of these addresses. According to The Condia, fctevreg.cam was registered on 15 September, the day before the first reports, with the registrar Gname.com, based in Singapore, with the owner’s details hidden and a location given as Hong Kong. The others use privacy services or subdomains, which have no registration of their own. It is a classic method: buy cheap addresses, use them for a few days, then move on to the next ones when they are reported.

The FRSC’s response

The FRSC responded the same day with a statement signed by its head of public education, Osondu Ohaeri. It names the address frscgov.top directly, says it has no link with the agency, and points to its official website and its toll-free line, 122. The FRSC’s Corps Marshal, Shehu Mohammed, called for an awareness campaign summed up in three words: stop, verify, report.

« These messages are designed to create a sense of urgency by claiming that a new offence has been recorded. Clicking on the links may lead to the loss of personal information, financial data and other sensitive data. »

Federal Road Safety Corps statement (paraphrased)

The agency says it is working with law enforcement and cybersecurity authorities to identify those responsible. The statement does not say what technical steps have been taken to have the other addresses shut down.

Where do the phone numbers come from?

An awkward question remains: how did the scammers get motorists’ numbers? At this stage, nothing proves a leak from the FRSC’s systems, and an agency official declined to comment further. But the Nigerian context makes the operation possible without direct access to official data. Numbers from past leaks, at banks, company registries or other platforms, circulate on underground markets and are reused from one scam to the next. Commercial lists of Nigerian mobile numbers are also easy to buy.

Above all, the scam does not need to target people who were actually booked. It is enough to send thousands of messages: among the recipients, some will indeed have come across a traffic check in recent days, and the message will seem all the more credible to them. That is what happened to Eva Ibiam.

Banks’ responsibility in question

The case revives a recurring debate in Nigeria: is a code by text message still enough? A purchase abroad, from a merchant the customer had never used, for a large amount, could have triggered an alert in the bank’s fraud detection systems. Several banks also offer to block international card payments by default, which the customer switches on only when needed. It is a simple protection that is still too little known.

For victims, recourse is limited but exists: dispute the transaction with the bank immediately, reporting it as fraud, and file a complaint. The faster the dispute, the better the chances of getting the money back, especially if the merchant has not yet been paid.

A pattern that repeats

The scenario is not unique to Nigeria. Scams involving fake fines, fake parcels held at customs or fake tax refunds are rife worldwide, exploiting the same mechanism: a well-known authority, a small sum to pay, urgency. What changes is the speed: these sites appear and disappear within days, and the theft happens in minutes. Against this, users’ caution remains the first line of defence, but it is not enough. Mobile operators, which carry these text messages, banks, which approve payments, and registrars, which sell the addresses, each have a role to play in breaking the chain.