Cybersecurity laws Nigeria is reviewing are moving at pace, because artificial intelligence (AI) is fuelling a rise in internet scams.
Nigeria's government has begun a review of its cybersecurity laws, since artificial intelligence (AI) is making online scams, digital deception and assaults on vital national infrastructure ever harder to spot. The stakes are high for banks, public bodies and ordinary citizens alike, as cybersecurity laws in Nigeria struggle to keep pace with the technology.
Why Cybersecurity laws Nigeria has now are under strain
Last year, AI featured in 55% of recorded cybercrime incidents across Africa, and deepfake cases multiplied sevenfold from the second to the fourth quarter of 2024. Fraudsters now rely on AI to run their scams automatically, build believable false identities and find weak points in essential systems more quickly. In other words, criminals are using technology at a pace that institutions cannot match when reinforcing their defences, so current security systems and legislation lag behind.
This widening gap in capability is the main reason for the present legislative review of Cybersecurity laws Nigeria relies on today. The Nigerian government accepts that the frameworks now in place offer too few guardrails and do not match international best practice.
Officials are also weighing a nationwide cybersecurity structure that would fix baseline protection requirements for organisations across the country. However, unless the reforms improve enforcement, strengthen weak infrastructure and build up homegrown technical skills, they could end up expanding the state's surveillance powers while leaving Nigeria's digital economy no safer.
Three fronts of reform in Nigeria's cybersecurity laws
Nigeria's cybersecurity rules are being overhauled on three fronts simultaneously:
- One is a change to the Cybercrimes (Prohibition, Prevention. Act 2015, which came into force in February 2024; Lagos also played host to a wider review of policy, with lawmakers, officials of state agencies and industry representatives in attendance.
- Another is the National Cybersecurity Policy and Strategy, which first appeared in 2014 and was updated in 2021, and which has to be looked at again every five years, so the next review is due in 2026.
- The last is the National Digital Economy and E-Governance Bill 2025, introduced and then taken to a hearing open to the public in November 2025, which seeks to set up a complete legal framework covering electronic governance as well as online services, whether offered by government or by businesses.
Taken together, these efforts address the enforcement of cybercrime laws, the security of institutions and the oversight of Nigeria's growing digital economy.
Which problems are Cybersecurity laws Nigeria's authorities hoping to solve?
Officials report that they have advanced a proposed bill from the executive, intended to strengthen the country's legal defences against online threats.
Speaking to TechCabal in October 2026 at the International Cybersecurity Conference in Abuja, Adedeji Stanley Olajide, who chairs the House Committee on ICT & Cybersecurity, said that “the timeline is immediately after the election …”, since little can be done while political campaigning is under way.
Even so, the legislator voiced confidence that “the cybercrime, cybersecurity, and digital economy bills” would all become law sometime between January and June 2027.
In his view, once these laws are in force, they would help check cyberbullying and other online dangers, and would impose tougher compliance and security requirements throughout the financial sector.
The need for change is plain: nine out of ten Nigerian children are at risk of being cyberbullied, harassed or exploited on the internet.
Lenders and fintech firms could face serious exposure if Cybersecurity laws Nigeria passes go unenforced
Nigeria's financial sector is also exposed. Electronic payment fraud cost the country ₦25.85 billion ($19.2 million) in 2025. Later, in September 2026, the Central Bank of Nigeria (CBN) warned banks, fintech firms and operators of payment service providers alike that AI-driven cyber risks and vulnerabilities pose a direct threat to financial stability.
The report by TC Insights, “The Compliance Reckoning: Regulating Financial Services in the Age of AI”, points to the same. It observes that although total fraud losses fell in 2025, attacks powered by AI have become far more sophisticated, and that rising regulatory fines highlight deep-seated compliance risks across the system.
The Nigeria Data Protection Commission (NDPC) also penalised MultiChoice Nigeria in 2025, imposing a fine of ₦766.24 million ($568,630) over breaches of data protection rules and the unauthorised transfer of personal data across borders. The Commission further began probing 1,369 entities across the insurance, banking, gaming and pensions sectors.
Separately, the Economic and Financial Crimes Commission (EFCC) looked into a ₦3 billion ($2.23 million) scam in which customer accounts at First City Monument Bank were targeted through unauthorised access.
Taken together, these cases show how weaknesses in systems leave consumers vulnerable, put sensitive records at risk, and wear down confidence in public institutions.
Government is exposed too
Public bodies in Nigeria face cybersecurity dangers as well, since state systems have shown themselves to be open to attack if cyber laws are not enforced.
In the row over AI-generated photographs on the electoral roll of the Independent National Electoral Commission, questionable entries turned out to have reached the database via approved registration terminals run by the commission's own officers, not through an outside break-in.
The episode laid bare shortcomings in how public bodies manage who gets access, keep watch over what staff do, and check data before it is loaded onto their systems.
At the Corporate Affairs Commission, a major breach laid bare over 15 million company filings, alongside records revealing the ultimate owners of businesses. Remita, the principal payment gateway underpinning the Treasury Single Account, was also hit by a separate exposure of data: an incorrectly configured online storage container spilt close to 3 terabytes of money-related information.
Over 2,000 attempted cyberattacks were fended off by the NDPC's portal in just one week, according to Vincent Olatunji, the agency's National Commissioner.
In June, he revealed the figure at a hands-on cybersecurity course lasting five days, which brought together technical personnel from federal MDAs (the government's ministries, its departments and its agencies).
Such cases underline the rising danger to the very institutions charged with safeguarding Nigerians' personal data, at a time when e-governance keeps growing.
How AI is changing attacks across Africa
Across the continent, the story is much the same: artificial intelligence is making intrusions tougher to spot, since it lets common internet crime run as automated reconnaissance, fake-identity fraud and the takeover of stolen login credentials.
A joint report by Esentry and Darktrace, a cyberthreat intelligence alliance that focuses on enterprise threats, shows that today's attackers seldom break in by exploiting software weaknesses. Instead, they get in using stolen credentials and by turning internal trust against organisations, which lets them glide past standard security alerts.
The report states that in the first six months of 2026 alone, West Africa lost more than ₦1 billion ($742,104) to fraudulent transactions that got through older security controls.
Nigeria feels the impact out of proportion to its numbers. South Africa made up 45% of the incidents Darktrace observed (with ransomware in 20% of them), Kenya made up 6% (ransomware in 33%), and Nigeria contributed just 5% of the regional total.
Even so, ransomware featured in 80% of the Nigerian cases that were investigated, and the theft of data through exfiltration in 40%. This suggests Nigeria's cyber risk is far greater than what is visible, with serious extortion activity hidden behind small detection figures.
Instead of smashing through perimeter defences, threat actors now use behavioural evasion powered by AI to copy the actions of genuine users and quietly take over authorised workflows, a shift that leaves manual compliance audits and static government firewalls outdated.
Breaches on this scale erode public confidence in state-run registers and put at risk the data on which the enforcement of rules against money laundering and corporate verification depend.
Such failures point to an urgent need for fresh cybercrime legislation that sets out clear accountability and compels sound standards of configuration across critical data infrastructure.
As the body of legislation expands, lawmakers must balance the state's powers of supervision against the protection of personal privacy and civic freedoms. These reforms will ultimately be judged on whether they produce more prosecutions, fewer breaches of core systems, and stronger protection for data.
See: How Clea handles cross-border payments in car importation
Home-grown expertise over reliance on outsiders
If Nigeria is to invest seriously in cybersecurity sovereignty, it has to develop its own ability to protect critical infrastructure, keep citizens' data safe, probe cybercrime and keep essential digital services running. Just as importantly, the country must lessen its dependence on outside vendors to maintain its systems and respond to incidents.
The National Digital Cloud Policy is the government's response to these problems. To draw in private investors, it waives taxes and duties on servers and on the infrastructure of data centres. In return, federal agencies are directed to move their outdated systems onto cloud platforms, and critical national information, such as healthcare and biometric records, has to be stored within Nigeria.
Official reports indicate that over ₦4.5 trillion ($3.34 billion) was set aside for Nigeria's IT industry between June 2023 and June 2026.
The country is also hoping to draw $250 million from private investors within a year, and $750 million within two years. Even so, funding goals by themselves do not build security capacity. The real test is whether the money delivers resilient infrastructure, capable institutions and a pool of homegrown, skilled professionals.
Abdul-Hakeem Ajijola, chairman of the African Union Cybersecurity Expert Group, responded to the global cybersecurity event mentioned earlier. In his view, the test of any security spending is the expertise it leaves in place after vendor contracts have run out.
Software purchased from overseas suppliers, he noted, shields an organisation for only a limited period. If there are no locally trained engineers able to run and defend such systems, Nigeria might merely trade one technological weakness for dependence on one supplier, a trap known as vendor lock-in.
Measuring the success of Cybersecurity laws Nigeria is drafting
For attackers, artificial intelligence is no longer merely an edge; it is becoming a routine element of their toolkit. Forecasts from Essentia and Darktrace covering the latter half of 2026 anticipate a surge in executive fraud powered by deepfakes, compromises of the software supply chain, and ransomware that is automated and aimed at cloud assets.
The yardstick for progress, then, should be what actually happens on the ground:
- threats spotted more quickly;
- vulnerabilities fixed promptly;
- compulsory disclosure of breaches;
- swift restoration of services;
- firm penalties for those who fall short of minimum standards.
Revised legislation may make it clearer which agency is responsible for what, and may widen the powers of investigators. Even so, such reforms ought to be judged less by how much authority they hand the state than by whether people's data is kept safe, whether the financial infrastructure stays resilient, and whether public services can survive determined, sophisticated attacks.
In the end, Nigeria will succeed not because it enacts tougher cybersecurity laws, but because it builds a digital ecosystem that can defend itself, bounce back after security incidents, and keep the public safe.
See: Dear Ajayi Oscar submission lets Nigerians judge film this week
