Follow Us on Google
By Chinenye Anuforo
[email protected]
The arrest of suspected illegal National Identification Number (NIN) enrolment operators by the National Identity Management Commission (NIMC) has renewed concerns about the security of the nation’s identity database, the activities of third-party enrolment agents and the potential exposure of millions of citizens to identity-related fraud.
The arrests, which reportedly took place in Gwagwalada, Abuja, and other locations, followed investigations by NIMC’s Identity Crime Enforcement Unit (ICEU) into alleged illegal NIN enrolment, unauthorised modification of identity records and extortion.
The commission also seized equipment allegedly used by the operators to carry out unauthorised enrolment activities.
NIMC director-general, Abisoye Coker-Odusote, said the commission maintained a zero-tolerance policy towards extortion, illegal enrolment and unethical conduct by individuals involved in identity management.
The commission has warned that initial NIN enrolment should only be conducted at approved centres, while eligible modifications to personal information should be processed through its authorised self-service platform.
However, the latest development raises broader questions about how effectively the country is monitoring the growing network of individuals and organisations involved in collecting, processing and verifying Nigerians’ identity information.
While NIMC has not disclosed the number of suspects arrested, the specific identity records allegedly affected or whether any national database information was compromised, the incident comes against the backdrop of previous concerns about the handling of NIN data, unauthorised access to identity verification services and the security implications of linking millions of SIM cards to citizens’ identities.
It also brings renewed attention to the risks associated with identity theft, SIM-swap fraud and the possible misuse of personal information in a country where the NIN has become increasingly important for accessing financial, telecommunications and government services.
National identity programme has expanded significantly in recent years, with the NIN becoming a major requirement for accessing essential services.
The number is now linked to services ranging from SIM registration and bank account verification to government programmes and other digital transactions.
As previously reported by The Sun, NIMC had issued 117.5 million NINs from a total of 134.6 million enrolments as of June 30, 2026. This left the country with a gap of 62.5 million NINs towards the Federal Government’s target of enrolling 180 million Nigerians by December 2026.
The expansion has involved a large network of public and private sector participants. The identity programme had 362 licensed front-end enrolment partners, nearly 34,000 trained personnel and 46 Nigerian government offices abroad equipped to support enrolment activities.
By June 2026, about 13.4 million people were also using digitally enabled services under the World Bank-supported Identification for Development (ID4D) programme.
These figures demonstrate the scale of the identity infrastructure being developed. But they also highlight the responsibility of ensuring that every individual, device, enrolment centre and verification channel connected to the system operates within strict security and accountability standards.
The challenge is not simply to register more Nigerians. It is to ensure that the information collected is accurate, protected from unauthorised access and used only for legitimate purposes.
Kelechi Ndieze, Chief Executive Officer of Africa Tech Factory, emphasised that the success of the national identity programme should not be measured only by the number of people registered but also by the accuracy, security and usability of the identities created.
“This distinction is important because a large identity database can become a valuable tool for service delivery, but weaknesses in the systems and processes surrounding it can expose citizens to serious risks”, he said.
The World Bank’s foundational ID4D project documentation had also highlighted the oversight challenges associated with an ecosystem-based enrolment model. With several private sector partners participating in the process, NIMC could lose some direct control over monitoring the performance of enrolment agents and enforcing standard operating procedures.
The document identified the need for additional controls, supervision and data quality measures to address these risks.
The latest arrests therefore raise an important question on how effectively are the activities of licensed partners, their employees, sub-agents and other individuals operating around the identity ecosystem being monitored?
This is not the first time questions have been raised about the security of Nigerians’ identity information.
In March 2024, the Nigeria Data Protection Commission (NDPC) commenced an investigation into allegations that personal information belonging to NIMC enrollees was being accessed and monetised through an online platform, XpressVerify.com.
Then, the NDPC’s Dr. Vincent Olatunji, ordered a full-scale investigation into allegations of unauthorised access to NIN information.
The commission said it would examine the audit trails of the alleged unauthorised processing and monetisation of personal data.
NIMC, however, denied that its central database had been breached and said XpressVerify was not one of its licensed partners.
The commission’s Director-General, Abisoye Coker-Odusote, also ordered an internal investigation to establish whether any licensed tokenisation agents or their sub-licensees had breached the terms governing access to NIMC’s verification services.
Subsequent developments suggested that the controversy may have involved a third-party licensed verification provider whose credentials were allegedly used to grant XpressVerify access to NIN verification services.
In an interview, Olatunji explained that the investigation had found that the media presentation of the incident was not entirely accurate. He said the underlying issues involved some NIMC agents and had been addressed through remedial measures.
That clarification is important. The 2024 controversy should not be presented as proof that the central NIMC database was directly breached. Rather, it exposed concerns about the activities of third-party agents, the control of verification credentials and the potential for misuse of access granted to authorised service providers.
It also demonstrated why identity security cannot depend solely on the protection of a central database. Every organisation or individual granted access to identity verification services represents a potential point of vulnerability if the access is poorly controlled.
The latest arrests raise similar questions about how NIMC identifies, investigates and prevents unauthorised activities within the wider identity ecosystem.
The risks associated with identity information extend beyond the unauthorised collection or modification of NIN records.
Personal information can be used to impersonate individuals, compromise accounts, facilitate fraudulent transactions and gain access to services that should ordinarily be available only to verified account holders.
One of the most concerning areas is SIM-swap fraud.
A SIM swap occurs when criminals gain control of a victim’s mobile phone number, potentially allowing them to intercept one-time passwords and other authentication messages sent by banks and digital service providers.
Once control of a phone number is compromised, fraudsters may attempt to gain access to financial accounts, reset passwords and carry out transactions using the victim’s identity.
Jude Ozinegbe, founder of Cyberchain, explained how criminals can exploit SIM-swap attacks to intercept one-time passwords, access financial accounts and, in some cases, apply for microloans using victims’ information.
The process can leave victims struggling to regain control of their telephone numbers and financial accounts, particularly when several service providers are involved.
Although SIM-swap fraud is not necessarily evidence of a breach of the NIMC database, the growing dependence of financial and digital services on identity verification makes the protection of personal information increasingly important.
A compromised phone number, combined with other personal information obtained through phishing, social engineering or other methods, can provide criminals with opportunities to impersonate individuals.
This is particularly significant in the country, where the NIN has become a major identity reference across telecommunications, banking and other digital services.
The connection between identity management and telecommunications security became more prominent during the Federal Government’s NIN-SIM linkage exercise.
The policy was introduced to strengthen the relationship between subscribers’ identities and their mobile telephone numbers, with the authorities arguing that it would help address criminal activities involving anonymous or improperly registered SIM cards.
Earlier, the Nigerian Communications Commission (NCC) disclosed that more than 153 million SIM cards had been linked to NINs, representing about 96 per cent compliance at the time.
The NCC had also disclosed that security agencies and relevant authorities uncovered individuals holding more than 100,000 SIM cards.
The exercise, however, was not without challenges.
In July 2024, the NCC ordered the immediate reactivation of lines affected by problems with NIN-SIM verification after subscribers complained that their telephone lines had been blocked despite attempts to comply with the directive.
The commission said some subscribers had experienced difficulties because their NIN details could not be successfully verified against their SIM registration records.
The experience exposed another dimension of identity management, inaccurate records, verification failures and technical problems can affect legitimate users just as much as deliberate criminal activity.
While linking SIM cards to NINs can improve the ability of authorities to identify subscribers, it does not automatically eliminate SIM-swap attacks, identity theft or other forms of digital fraud.
The security of the system depends on the integrity of the information collected, the reliability of verification processes and the ability of telecommunications operators, banks and other service providers to detect suspicious activities.
It also requires effective cooperation among institutions when a subscriber reports that their identity or telephone number has been compromised.
The Federal Government has also taken steps to strengthen the legal and institutional framework governing national identity management.
President Bola Tinubu signed the NIMC Act 2026 into law on June 26, 2026, repealing the previous 2007 Act.
According to NIMC, the new legislation strengthens the commission’s mandate in identity authentication, interoperability, data protection and the development of Nigeria’s digital public infrastructure.
The law also establishes NIMC as the Root Certification Authority for Nigeria’s National Public Key Infrastructure, a development expected to support secure digital identity authentication and trusted electronic transactions.
The government has presented the strengthened identity infrastructure as an important part of its digital transformation agenda.
The Interior Minister, Olubunmi Tunji-Ojo, also attributed the arrest of seven suspected Boko Haram and ISWAP commanders returning from Mecca in Katsina to the integration of NIMC and immigration databases. That claim was made by the minister in the government’s announcement on the new law.
However, as the national identity infrastructure expands, the need for strong safeguards becomes even more important.
Interoperability allows different government agencies and service providers to verify information across systems. But it also makes access management, data protection, cybersecurity and accountability critical.
The objective must be to ensure that the expansion of digital identity services does not create new opportunities for unauthorised access, impersonation or exploitation.
NIMC has encouraged Nigerians to use its NINAuth application for identity authentication and consent-based sharing of personal information.
The platform is designed to give NIN holders greater control over how their identity information is authenticated and shared. It also provides features such as QR codes and share codes for verification purposes.
The commission has urged Nigerians to rely on its official website, verified social media accounts and authorised channels for information about identity services.
It has also provided a toll-free contact line for public enquiries.
While these measures can help improve public access to legitimate identity services and reduce dependence on unofficial intermediaries, they cannot independently address every vulnerability within the identity ecosystem.
Effective protection requires strong institutional controls, regular security audits, clear accountability for licensed partners, staff training and prompt investigation of suspected misuse.
Citizens also need to understand that they should not disclose their NIN information, verification codes or other sensitive personal details to individuals or platforms whose authority they cannot establish.
Also reacting to the development, Jide Awe, Chief Executive Officer, Jidaw Systems Limited pointed out that the latest arrests provide an opportunity for NIMC and the NDPC to offer greater transparency about the risks facing the country’s identity infrastructure.
“How many individuals have been arrested in connection with illegal NIN enrolment, unauthorised modification of identity records and extortion? What specific activities were uncovered during the investigations, and how many identity records, if any, were affected?
Were the arrested operators connected to licensed enrolment partners, sub-agents or independent operators working outside the approved NIMC network? Has the commission established whether any personal information was accessed, copied, altered, sold or transferred to unauthorised persons?”
“What measures are in place to monitor the activities of licensed enrolment partners and ensure that their staff and sub-agents comply with NIMC’s security requirements?”
Continuing, he said, “The NDPC also needs to explain how it is monitoring the processing of NIN information by third-party verification providers and what enforcement measures are available when organisations or individuals misuse personal data.”
“The commission’s role is particularly important because the security of identity information is not exclusively a technical issue. It is also a data protection and accountability issue.
NIMC must ensure that the individuals and organisations handling citizens’ information are properly authorised and supervised, while the NDPC must ensure that personal data is processed in accordance with the law”, Awe said.
The latest arrests should therefore not be treated merely as an isolated enforcement operation. They should lead to a wider assessment of the controls governing the collection, verification, modification and sharing of Nigerians’ identity information.
“Nigeria’s national identity programme is central to the country’s digital transformation ambitions. A reliable identity system can improve access to financial services, strengthen public administration, support social protection programmes and make digital transactions more secure.
But public confidence in that system depends on more than the number of people enrolled or the number of arrests announced”, he stated
Citizens need to know that their personal information is protected, that only authorised individuals can access or modify their records, and that institutions will act promptly when misuse is detected.
The earlier controversy involving XpressVerify demonstrated the importance of monitoring third-party access to identity verification services. The NIN-SIM linkage exercise exposed the consequences of verification problems for legitimate subscribers, while the growing threat of SIM-swap fraud shows how compromised identity and telecommunications credentials can create financial risks.
The latest arrests have brought these concerns together again.
For NIMC, the task is not only to identify and prosecute individuals allegedly involved in illegal enrolment activities. It is also to demonstrate that the systems, partners and processes responsible for managing Nigerians’ identities are secure and accountable.
As the country moves towards a more interconnected digital public infrastructure, the protection of citizens’ identities must be treated as a fundamental security responsibility, not simply an administrative requirement.
