Terrorists using dead persons’ accounts, crowdfunding – NFIU

The Nigeria Financial Intelligence Unit has uncovered an emerging crowdfunding network being exploited to raise and channel funds for terrorist operations.

This is as the agency said terrorist financiers were opening bank accounts in women’s names as well as using phone numbers for mobile banking or account alerts that are not registered to the account holder or the true beneficiary.

The disclosures are contained in the NFIU’s 2025 Annual Report, obtained by The PUNCHfrom a top official.

According to the report, the crowdfunding scheme involves foreign-based facilitators using social media platforms to solicit donations under the guise of humanitarian relief or educational support, before moving the funds through multiple layers to terrorist operatives in Nigeria.

The NFIU said hundreds of sympathisers were typically encouraged to make relatively small donations, ranging from $50 to $500, through PayPal pages or conventional bank accounts, with the amounts deliberately kept low enough to evade automated anti-money laundering alerts.

“The following is a case study on Crowdfunding Network identified during the year: A foreign-based facilitator runs social-media campaigns claiming humanitarian relief or educational support and uses encrypted apps (Telegram, Signal) to share links to convincing PayPal pages or standard bank accounts.

“Hundreds of sympathiser donors contribute $50–$500 each, amounts small enough to avoid most automated AML alerts,” the report read.

The funds are subsequently pooled into a “master account” controlled by a senior member of the group living legally abroad.

“When the pool reaches a threshold, that account becomes the hub for onward movement,” the report stated.

The NFIU said the funds were then fragmented into dozens of smaller payments and transferred through International Money Transfer Operators and remittance applications to a network of money mules in Nigeria.

It identified students, small-business owners and relatives among those used as mules, noting that the strategy was designed to avoid reporting thresholds and obscure the origin and destination of the funds.

“Rather than sending one large transfer, the senior member fractures the funds and sends dozens of sub-threshold payments through IMTOs and remittance apps to a network of money mules in Nigeria; students, small-business owners, or relatives, avoiding reporting triggers.

“Upon receipt, the money was either converted to cash, used to purchase dual-use items such as motorcycles, fertilisers and satellite internet equipment, or transferred through mobile banking channels to logistics managers and field operatives,” it added.

The report described the final stage as the “integration” of the funds into terrorist operational financing

The Unit also identified the use of gender-based proxy accounts as another emerging terrorist financing technique, with terrorists opening bank accounts in women’s names while male commanders or logistics managers secretly control them.

“Terrorist financiers are opening bank accounts in women’s names while male commanders and logistics managers secretly control them.

“They exploit cultural norms that make women less likely to be suspected by authorities, using wives, sisters, or female associates as fronts to distance illicit funds from the true operatives.

“This tactic functions as identity laundering: women’s accounts are managed by men who hold ATM cards, mobile-banking credentials, and PINs, while the women often remain unaware of the transactions and volumes,” the report stated.

The report further revealed that terrorist facilitators were using telephone numbers that were not registered to the account holders or actual beneficiaries for mobile banking and transaction alerts.

It said pre-registered SIM cards, numbers registered to deceased persons and SIMs linked to gender-based proxies were being used to break the connection between bank accounts, SIM cards and Bank Verification Numbers.

“Terrorist facilitators use phone numbers for mobile banking or account alerts that are not registered to the account holder or the true beneficiary.

They bypass the security link between SIM cards and BVNs by using pre-registered SIMs, SIMs registered to deceased people, or SIMs tied to gender-based proxies. This severs the audit trail: when a transaction is flagged, investigators trace the phone to an unrelated person, letting the real facilitator stay anonymous and continue operations,” it stated.

The NFIU also uncovered sophisticated methods of disguising terrorist transactions through detailed or coded narrations.

It said cells, particularly those linked to the Islamic State West Africa Province, used precise transaction descriptions to maintain what analysts described as an internal accounting system.

According to the report, frequent logistics-related payments with detailed narrations were often sent from a single source to multiple recipients, reflecting a structured financial system within the terrorist network.

“Terrorist cells, particularly those linked to ISWAP, routinely use precise, professional-sounding transaction narrations to maintain internal accounting. Operating like “shadow states” with strict bureaucratic controls, they require detailed descriptions so field commanders can justify expenses to central financial controllers. Although truthful narrations appear counterintuitive, they create an internal audit trail; analysts repeatedly observe high-frequency, logistics-related payments with accurate narrations sent from a single source to multiple recipients,” the report said.

However, the NFIU said some facilitators used innocuous words, secret codes and alphanumeric strings in transaction descriptions, sometimes switching between languages, to conceal the purpose of payments and evade automated bank filters.

“Transaction descriptions employ innocuous words, secret codes, or alphanumeric strings to conceal intent. Facilitators use this coded language, often switching languages to evade banks’ automated keyword filters that flag terms like ‘Jihad,’ ‘Arms,’ or ‘Boko.’

This practice obscures the true purpose of transfers, preventing detection and enabling continued financing,” it said.

The NFIU said its risk and crime analysis during the year identified an increasingly interconnected threat landscape involving financial crime, technology and cross-border activity.

It noted that fraud remained a dominant predicate offence, with growing cases of Ponzi schemes, fraudulent crowdfunding arrangements, cryptocurrency-enabled investment scams and hacking-related fraud.

The Unit said the schemes increasingly exploited fintech onboarding gaps, including tiered accounts requiring minimal identification, while digital platforms were used to rapidly recruit victims and move funds.

The report also highlighted persistent vulnerabilities in public sector financial management, including the diversion of state and local government funds through accounts belonging to finance officers and associated third parties.

It identified procurement processes and cash transactions as significant risk areas, saying the latter complicated audit trails and efforts to trace illicit assets.

The NFIU said its findings were translated into targeted advisories, executive alerts and strategic intelligence products to support competent authorities, reporting entities and policy responses.

Financial Fraud and Investment Scams: Fraud remains a dominant predicate offence, with notable growth in Ponzi schemes, fraudulent crowdfunding arrangements, cryptocurrency-enabled investment scams, and hacking-related fraud (including compromised social media and messaging accounts).

“Analytical reviews during the period examined these trends and informed internal advisories and alerts, some of which remained restricted for operational purposes.

“These schemes increasingly exploit fintech onboarding gaps, including tiered accounts with minimal identification requirements, and leverage digital platforms to rapidly scale victim recruitment and fund movement.

“Corruption and Misappropriation of Public Funds Analysis highlighted persistent vulnerabilities in public sector financial management, including the diversion of state and local government funds through accounts of finance officers and associated third parties.

“Procurement processes remain a significant risk area, while utilisation of cash transactions complicates audit trails and asset tracing efforts,” the report said.

A security expert, Chidi Omeje, called on Nigeria’s security and financial intelligence institutions to enhance their operational strategies to counter the rising sophistication of non-state actors in the country.

Omeje noted that criminal elements are constantly devising new methods to circumvent existing security architecture.

He urged key agencies, including the Nigeria Police Force, the Department of State Services, and financial regulatory authorities tasked with monitoring banking transactions, to step up their efforts, stay ahead of criminal networks, and track illicit financial flows.

“Every single day, these guys grow in sophistication and desperation, and we must also devise means to bring them to their knees.

“The state must ultimately deal with them. They must follow the money trail to monitor these movements and effectively tackle the situation,” he said.

Omeje emphasised that the government and security apparatus cannot afford to yield ground to criminal groups, insisting that intelligence-driven operations and financial tracking remain critical to safeguarding national security.

Another security analyst, Lawrence Alobi, urged security agencies to step up intelligence sharing and work closely with financial institutions to curb the trend.

Addressing the issue, Alobi emphasised that security agencies must enhance their information gathering to outsmart criminals attempting to evade detection through fraudulent account setups.

“It behoves us now, the security agencies, to intensify their intelligence sharing and information gathering, because it is through information that we can get some of these things.

Security agencies need to work with the banks and also warn them. Any bank found to have connived or aided this act should be sanctioned,” he said.

He further stressed the need for strict compliance and verification procedures within the banking sector to prevent proxies from being used to run illicit accounts.

“The banks themselves must sit up and ensure they properly verify every individual’s identity so that there is a real, verifiable person behind every account, not just someone acting by proxy. Intelligence agencies must go the extra mile to hold banks accountable for any loopholes exploited within their system,” he added.