Inside The World Of Phishing Messages Targeting Nigerian WhatsApp Users

Victor Olabode

October 2, 2026
11 min read
WhatsApp

A message promising free data, a request for an urgent transfer, a warning that a bank account will be blocked or an invitation to claim an unexpected prize can appear harmless on a Nigerian WhatsApp screen.

Increasingly, however, such messages are being designed to manipulate users into surrendering personal information, clicking malicious links, sharing fraudulent promotions or handing over access to their accounts.

The Nigerian Communications Commission’s Computer Security Incident Response Team (NCC-CSIRT) issued a fresh warning on October 1, 2026, about a phishing campaign offering users 10GB of free mobile data and ₦5,000 airtime. The campaign directs victims to a fraudulent website, asks for their phone numbers and then instructs them to share the link through WhatsApp contacts or groups. NCC-CSIRT classified the campaign as having high potential damage and high probability.

The campaign provides a revealing picture of how modern phishing works: the criminal does not necessarily need to break into a phone. Instead, the victim is persuaded to open the door.

For millions of Nigerians who use WhatsApp for family communication, business, community groups, school activities and financial transactions, that distinction is increasingly important.

The Message That Looks Like A Gift

Phishing is fundamentally an exercise in deception.

A criminal creates a message designed to look convincing and uses it to persuade a target to provide information, click a link, download a file or take another action.

Nigeria’s cybersecurity authorities have previously warned that phishing can be delivered through email, text messages, phone calls and social media platforms. The information sought can include personal identification details, banking information and account credentials.

On WhatsApp, the approach can become particularly effective because messages often arrive through familiar social networks.

A suspicious link from an unknown number may be ignored.

The same link forwarded by a relative, colleague or friend may receive immediate attention.

That is one reason the latest NCC-CSIRT campaign is instructive.

The fraudulent promotion does not simply advertise a reward. It asks users to share the link with other WhatsApp contacts or groups, turning recipients into distributors of the scam.

The campaign therefore uses two psychological attractions at the same time: the promise of a financial or telecommunications benefit and the trust users place in their own contacts.

Why Free Data Scams Work

Free data and airtime are particularly attractive in Nigeria because mobile connectivity has become an important part of everyday life.

People use mobile data for work, education, banking, entertainment, social interaction and business.

A message offering several gigabytes of free data can therefore appear immediately useful.

The latest campaign identified by NCC-CSIRT reportedly claims to offer 10GB of data and ₦5,000 airtime.

The recipient is instructed to enter a mobile phone number and share the promotional page before supposedly receiving the reward.

But the offer is fraudulent.

According to the NCC-CSIRT advisory, the campaign is designed to harvest information and propagate itself through messaging platforms. The agency said there was no evidence that the campaign depended on exploiting a vulnerability in mobile operating systems or telecommunications infrastructure.

Instead, the primary weapon is social engineering: manipulating people into taking actions they would otherwise avoid.

The Familiar Name Trap

Not every phishing message offers money.

Some pretend to come from organisations people already know.

A message may claim to be from a bank, telecommunications company, government agency, delivery service, employer or technology platform.

The wording may create urgency.

“Your account will be blocked.”

“Verify your details now.”

“Your package is waiting.”

“Your number has won a prize.”

“Click here to activate your account.”

The objective is to make the recipient act before thinking.

WhatsApp itself warns users to be suspicious of messages containing requests for personal information, links to activate supposed features, requests for payment or other unusual demands. The platform also points to poor spelling and grammar as possible warning signs, although sophisticated scams may be written convincingly.

The message does not need to be perfect.

It only needs to convince enough people.

When Your Friend’s Account Is Used

One of the most difficult forms of WhatsApp fraud occurs when criminals gain access to an account and then use it to contact the victim’s friends and family.

A message from a known person can carry more credibility than a message from an unfamiliar number.

The criminal may send a request for money, claim to be stranded somewhere or ask the recipient to help with an emergency.

This is why identity verification matters even when a message appears to come from someone known.

A phone call to the person through another channel can sometimes expose the deception immediately.

The same principle applies to requests for sensitive information.

Knowing the sender personally does not automatically make a link safe.

An account can be compromised, impersonated or used without the owner’s knowledge.

The Danger Of Verification Codes

Another common route into WhatsApp accounts involves verification codes.

A criminal may attempt to register a victim’s phone number on another device.

The victim then receives a verification code and may be contacted by someone pretending to be a friend, WhatsApp representative or service provider.

The criminal asks the victim to forward the code.

Once the code is surrendered, the attacker may gain control of the account.

The Nigerian Communications Commission has specifically recommended two-factor authentication for WhatsApp users to reduce the risk of account takeover.
WhatsApp also advises users to enable two-step verification and keep the associated PIN secret.

A verification code should therefore be treated as confidential.

If somebody asks for it, the safest response is not to provide it.

A Link Can Be The Beginning, Not The End

Clicking a phishing link does not always immediately result in money disappearing from a bank account.

The link may lead to a fake website that asks for additional information.

The victim may be asked to enter a phone number, email address, password, bank details or other personal information.

That information can subsequently be used in additional scams.

In other cases, the fraudulent page may encourage the victim to download an application or file.

WhatsApp warns users that suspicious links can be designed to look like legitimate websites while actually directing people to harmful destinations. The platform advises users to inspect links carefully before opening them.
NCC-CSIRT has similarly advised Nigerians to be cautious about unsolicited links and requests for personal information.

AI Is Making Deception Harder To Spot

Nigeria’s cybersecurity environment is also changing as criminals adopt increasingly sophisticated tools.

A fresh ngCERT advisory issued on October 1 warned of a significant rise in cyber incidents affecting Nigerian organisations, involving phishing, ransomware, business email compromise and data breaches.

The advisory said threat actors are increasingly using phishing-as-a-service and other cybercrime models, while artificial intelligence is helping criminals scale social engineering and produce more convincing attacks.

This development matters to ordinary WhatsApp users because traditional warning signs may become less obvious.

A phishing message no longer necessarily contains glaring spelling mistakes.

It may be professionally written.

It may use familiar branding.

It may contain information that appears relevant to the recipient.

That makes verification more important than simply judging whether a message “looks professional.”

The Psychology Behind The Scam

The most successful phishing messages often create one of four emotional reactions: excitement, fear, urgency or curiosity.

A free-data promotion creates excitement.

A warning that an account is about to be blocked creates fear.

A request to send money immediately creates urgency.

A message saying “look what someone posted about you” creates curiosity.

The desired reaction is the same: immediate action.

Cybersecurity experts therefore encourage users to pause before responding.

A few seconds of verification can prevent a major loss.

If a message claims to come from a bank, the user can open the bank’s official application or website independently instead of clicking the link in the message.

If a telecommunications company is offering a promotion, the customer can verify it through the company’s official channels.

If a friend requests money urgently, the recipient can call the friend directly.

The crucial principle is to verify through a separate channel.

Businesses Are Also At Risk

WhatsApp phishing is not only a problem for individuals.

Small businesses increasingly depend on messaging applications for customer communication, sales and payments.

A compromised business account can expose customer information or be used to defraud clients.

An employee who clicks a malicious link on a work device may also create a pathway into organisational systems.

The latest ngCERT advisory warns that Nigerian organisations across sectors are facing increasingly sophisticated phishing and other cyberattacks, with weak identity and access controls, inadequate multi-factor authentication and insufficient user awareness among recurring weaknesses. ([CSIRT Nigeria][7])

Businesses therefore need cybersecurity policies that go beyond installing antivirus software.

Staff should know how to recognise suspicious requests and understand that sensitive credentials should never be disclosed simply because someone appears to be a colleague or manager.

WhatsApp Is Adding More Protection

WhatsApp has several security mechanisms designed to reduce scams and account compromise.

The company says it uses automatic spam detection and proactive security alerts and provides users with tools to report suspicious accounts and messages.

It also recommends two-step verification, use of the official WhatsApp application and appropriate privacy controls.

Users can block suspicious contacts and report problematic behaviour.

WhatsApp also says official support will not ask users for sensitive personal information, passwords, PINs or payment details. A supposed WhatsApp support account without the appropriate official verification should be treated with suspicion.
These tools, however, cannot eliminate the human element.

A user who voluntarily enters information into a fraudulent website can still be exposed even if the messaging platform itself remains secure.

What Nigerians Should Do

The first rule is simple: do not click first and investigate later.

When a message arrives unexpectedly, stop and examine it.

Ask who sent it.

Ask whether the request makes sense.

Look at the link carefully.

Consider whether the promotion exists on the organisation’s official website or verified social-media account.

Do not provide banking information, passwords, PINs or verification codes through an unsolicited message.

Do not forward suspicious messages to family groups simply because the message asks you to “share with 10 people.”

Do not assume a message is safe because it came from someone you know.

Keep WhatsApp and the device operating system updated.

Enable two-step verification.

Use strong, unique passwords for related accounts and activate multi-factor authentication wherever available.

NCC guidance also recommends keeping device software updated, reviewing application permissions and maintaining appropriate security protections.

What To Do If You Have Already Clicked

A common reaction after clicking a suspicious link is panic.

The first step should be to stop interacting with the page.

Do not enter additional information.

If credentials were entered, change them through the legitimate service’s official website or application.

If banking information may have been exposed, contact the bank immediately through its official channels.

If a WhatsApp account has been compromised, begin the account-recovery process and warn contacts that messages from the account may not be genuine.

Suspicious WhatsApp accounts and messages should also be reported through WhatsApp’s reporting tools. The company says reporting suspicious behaviour helps it review accounts and take action where appropriate.

Where financial fraud has occurred, victims should also contact their financial institution and appropriate law-enforcement or cybercrime authorities.

The Real Cost Of One Click

The danger of phishing is not limited to the first piece of information surrendered.

A phone number can become a starting point for additional targeting.

A stolen password can expose other accounts if the same password has been reused.

A compromised WhatsApp account can be used to deceive friends, relatives and business contacts.

Personal information can be combined with information obtained elsewhere to construct more convincing scams.

That is why cybersecurity is increasingly about protecting an entire digital identity rather than simply protecting one application.

A New Digital Habit

For Nigerian WhatsApp users, the strongest defence may be developing a simple habit: pause, verify and then act.

The free-data campaign identified by NCC-CSIRT demonstrates how quickly a fraudulent message can use an attractive offer and trusted messaging networks to reach more people.

The broader cybersecurity warnings issued this week show that phishing is becoming more sophisticated, with criminals increasingly using automation and artificial intelligence to improve their social-engineering operations.

The answer is not to stop using WhatsApp.

The platform remains an important tool for communication, commerce and community life.

The answer is to use it with greater digital awareness.

A message that promises free data may not be a gift.

A message from a familiar contact may not have been sent by that person.

A link that looks legitimate may lead somewhere else.

And a request for a verification code may be an attempt to take control of an account.

In Nigeria’s increasingly connected society, recognising those differences can mean the difference between ignoring a scam and becoming its next victim.

Before clicking, stop. Before sharing information, verify. Before sending money, confirm who is asking.

Inside The World Of Phishing Messages Targeting Nigerian WhatsApp Users

Victor Olabode

Victor Olabode

Categories

Search

Recent Post

Nigeria, India Deepen Aviation Partnership as Sector

Healthy Living: Know The Warning Signs Of

Inside The World Of Phishing Messages Targeting

Featured Videos

Popular Categories

Useful Links

Follow us

Inside The World Of Phishing Messages Targeting Nigerian WhatsApp Users

Categories

Search

Recent Post

Never Miss A Post!

Featured Videos

All Tags

Related Posts

Popular Categories

Useful Links

Never Miss A Post!

Follow us