One month after obtaining a court order to recover $24 million lost to unauthorised POS transactions, Flutterwave suffered another security breach that allowed unknown persons to divert billions of naira to several bank accounts.

The perpetrators illegally transferred ₦11 billion ($7 million) to several accounts in April 2024, one financial services insider with direct knowledge of the incident said. A second insider claimed the amount involved was at least ₦20 billion ($13.5 million).

“As is common in the financial services industry, there will always be attempts by bad actors to compromise the security of systems set up to protect and monitor services,” Flutterwave said in a statement to TechCabal.

“In April, we detected unauthorized activities inconsistent with usual customer behavior on one of our platforms used by a small subset of our customer base.”

Flutterwave did not specify the amount involved but insisted that “no customer funds were lost or compromised, and the confidentiality of our customers’ data remains intact.”

However, one highly-placed person with knowledge of the incident said that the stolen funds were moved to several accounts in five financial institutions over four days. The incident likely went undetected because the perpetrators ensured the deposits remained below limits that would trigger fraud checks.

The matter has been reported to law enforcement and investigations have begun, said the same person who asked not to be named.

Two executives in the financial services industry confirmed the incident and said Flutterwave reached out to request KYC details of the accounts involved. They also claimed that the accounts related to the incident have been temporarily restricted.

In similar system breaches, perpetrators conceal the movement of funds by sending money to the bank accounts of several hundred unsuspecting users. The details of those users are typically obtained online or using social engineering and fed into programs that automate bulk transfers.

However, April’s breach appears distinct. An organised network may have been involved in the distribution, said a highly placed staff at a financial institution.

“The perpetrators appeared to transfer the money to random accounts but these same accounts would also transfer money to other accounts who then sent it back to the first beneficiary account, [in a sort of round trip].”

This closed-loop approach differs from past attempts to hide the trail using unconnected outsider accounts.

This is the fourth incident of unauthorised transfers at Flutterwave reported in the last fourteen months. In October 2023, about 6,000 account holders across 35 banks and financial institutions received ₦19 billion (*$24 million) illegally transferred through unauthorised transactions by POS merchants.

In March 2023, about 107 bank accounts in 27 banks received ₦550 million. In a February 2023 breach, ₦2.9 billion was diverted to 107 bank accounts in 27 banks, according to court documents seen by TechCabal.

Identifying the account owners involved in the latest incident may be easier than before since the Central Bank mandated all financial institutions to require all customers to provide their bank verification number (BVN) or a national identification number (NIN) for account or wallet opening by March 2024. In February, Flutterwave received a court order—a Mareva injunction— that lets it recover the funds and assets of the identified account holders, even though they have spent the funds, with the KYC details provided by these financial institutions.

https://techcabal.com/2024/05/16/exclusive-flutterwave-loses-₦11-billion-in-security-breach

Flutterwave is the Nigerian version of coca-cola. No matter how try to bring them down, Dey go still find way survive and bounce back like nothing happened. If you are a man that wears shirts, see my thread now. I have something amazing for.

Investment in cybersecurity is paramount

Hnnm

Opoor

Who go credit me from this funds bayiiiiii

So..........

Probably Flutterwave management are laundering money on a low-key

Bad actors will always test your system

Omoawoke:
Investment in cybersecurity is paramount

You have no knowledge about what you are talking about

It's high time for court to grill flutterwave & let them speak the truth

It’s personal business , they need to secure their server. Though the news is old. Why reporting it now? Is this a justification of the cyber security levy?

This is mind boggling.
I'm sure the perpetrators will be caught in no time.

Insider job.

It's everytime they experience security breach. It's up to like 3 times since 2020. Severe hacks for that matter.

The EFCC should shine light on that company. It's also likely they are laundering money.

Na fo ols still dey use flutterwave sha.

Hackers cashing out.

Omo! See as them just dey call money anyhow 🥵🥵🥵

Wicked Sabotage. That I suspect.

Inside job.

Omo

yesloaded:



You have no knowledge about what you are talking about

It's high time for court to grill flutterwave & let them speak the truth

God bless you.

How many times will these guys loose funds to scammers?

.

are these bad actos customers of flutterwave. do dey login to their flutterwave accts b4 doing the transfers?

Inside job

wtf

asset in cybersecurity is paramount ... Sorry, need help with your academic papers? Contact us.

I no even see one naira from the security breach chai

Lip service to information security/cybersecurity.

yesloaded you are correct. What are the regulators doing about it? By now Flutterwave should have their licenses suspended especially their PCI DSS certification. No two ways.

Clearly cybersecurity problems.

Insider job.

You sent N11 billion to 6,000 random bank accounts, you no see my own account? Wey my share?

ha.

Cybersecurity is a real thing in today's world.