Account name exposure: Renowned security expert petitions CBN over weakness in nation’s domestic bank transfer system

A respected information security expert and global financial technology leader, Dr. Kingsley Chibuzor Aguoru, has petitioned the Central Bank of Nigeria (CBN) over what he describes as a serious privacy weakness in Nigeria’s domestic bank transfer system that exposes the personal data of millions of bank customers.

Dr. Aguoru, a Doctor of Information Security, a European Chartered Software Engineer, and a globally recognised technology leader with a focus on financial technologies, raised the concern in a formal submission to the apex bank, warning that the current system poses avoidable risks to citizens and the financial sector.

At the centre of the petition is the Nigeria Inter-Bank Settlement System Plc (NIBSS) feature that automatically displays the full legal name of a bank account holder once a sender inputs a valid account number during a transfer. While the feature was designed to reduce transfer errors, Dr. Aguoru argues that it has unintentionally created a nationwide data exposure problem.

According to him, the system allows anyone with an account number to retrieve a verified personal identity without the consent of the account holder, a practice he says runs counter to modern data protection standards.

Dr. Aguoru is widely regarded as a pioneer in secure digital payments, notably for his early work in deploying One-Time Passwords (OTP) to protect card-not-present transactions, a security measure that later became a global standard in online payments. His experience spans payment systems architecture, fraud prevention, and large-scale financial infrastructure security.

“Exposing full customer identities simply to confirm a transfer is an outdated approach,” he said. “Security systems should validate information internally, not broadcast personal data to unrelated third parties.”

He warned that the current practice increases the risk of identity theft, impersonation, phishing attacks, and social engineering fraud, particularly as digital banking adoption continues to grow across Nigeria.

The petition also highlights possible conflicts with the Nigeria Data Protection Regulation (NDPR), which requires organisations to minimise personal data exposure and embed privacy-by-design into systems that process sensitive information.

Drawing from international experience, Dr. Aguoru referenced the United Kingdom’s Confirmation of Payee system, which verifies recipient details without revealing account holder names. Under that model, senders enter the intended recipient’s name, while banks confirm a match internally and return only a confirmation status.

“Fraud prevention does not require revealing people’s identities,” he said. “Countries that take privacy seriously have already solved this problem.”

As part of his recommendations, Dr. Aguoru proposed that Nigerian banks require senders to enter the recipient’s full account name, while backend systems apply matching logic to confirm accuracy. Instead of displaying names, the system would return aggregate results such as a match, partial match, or no match, allowing transactions to proceed without exposing personal data.

He urged the Central Bank to mandate a uniform, privacy-preserving confirmation framework across all banks and payment service providers, alongside regular audits and public education.

“Nigeria’s journey toward a cashless economy must be anchored on trust,” Dr. Aguoru said. “Trust is built when citizens know their personal data is protected by design, not exposed by default.”

The petition has sparked renewed discussion among industry observers about privacy, consumer protection, and regulatory oversight in Nigeria’s financial system, with many watching closely to see how the CBN will respond to the concerns raised by one of the country’s most prominent information security figures.