The changing nature of financial fraud is prompting fintech companies and financial institutions to explore new ways of protecting digital transactions as more Nigerians manage their finances through mobile applications.

Fraudsters are increasingly using compromised SIM cards, devices, phishing, social engineering and stolen app sessions to gain access to customers’ accounts, shifting the focus beyond the theft of passwords and PINs.

The development has also increased attention on how financial institutions can establish that the person authorising a transaction is the legitimate account holder.

Biometric verification is among the measures being explored to provide an additional layer of authentication, particularly for transactions considered high-risk or high-value.

PalmPay, for instance, has introduced facial verification for high-value transactions through its Security Centre, allowing users to require an additional identity check before certain transfers are completed.

The feature is part of the fintech’s wider PalmPay Dey For You consumer campaign.

The development comes amid continued concerns over digital financial fraud in Nigeria, despite a significant decline in reported losses.

Data from the Nigeria Inter-Bank Settlement System showed that fraud losses fell from N52.26 billion in 2024 to N25.85 billion in 2025, although social engineering, phishing, SIM-related attacks and account compromise remain concerns.

For consumers, account takeover can have consequences beyond the loss from a single transaction, potentially affecting business revenue, access to funds and the ability to make routine payments

.

The challenge for financial institutions is to strengthen security without undermining the speed and convenience that have driven the growth of digital payments.

While customers expect transactions to be completed quickly, higher-risk transactions may require additional authentication to reduce the risk of unauthorised transfers.

As Nigeria’s digital payments ecosystem expands, the focus is increasingly shifting from protecting passwords and PINs alone to establishing who is actually authorising a transaction.