The Nigeria police have concluded plans to arrest 601 customers of various banks suspected to have received the proceeds of fraudulent transfers following a Flutterwave breach last year. According to court documents seen by People’s Gazette, the banks involved include Polaris Bank, Sparkle Microfinance Bank, Stanbic IBTC Holdings, Standard Chartered Bank, Union Bank, Unity Bank and Wema Bank.
Recall that the leading Nigerian financial technology company suffered a technical glitch which allowed its point of sale (PoS) agents to conduct transactions in excess of their available balances. Taking advantage of the glitch, hundreds of PoS operators transferred billions of naira to various bank accounts between October 12 and 13, 2023.
Following an investigation into the matter, the police arrested a number of point-of-sale merchants who took part in the fraudulent transfers. But now, the police are also seeking the arrest of bank account holders who were at the receiving end of the transfers as collaborators to the act. Authorities said the point-of-sale merchants exploited the breach by sending huge sums of money to family, friends and relatives.
The police have also asked the court for an order directing the banks involved to freeze the accounts belonging to those individuals who benefited from the breach.
Flutterwave’s multi-billion naira breach
Reports started making the round in February that Flutterwave had lost N11 billion due to a security breach. In response, the company released a statement confirming that the incident indeed occurred in April 2023 when it detected unusual activities on one of its platforms, used by a small number of customers for specific business transactions. The company also suggested that the heist was unsuccessful.
The company said it immediately informed law enforcement agencies and provided the IP address and details of the offenders. In a statement sent to Nairametrics, the company said it successfully blocked an “attempted network intrusion and reported the offenders to security agencies.”
Preliminary investigations by the police showed that fraudulent transactions were carried out using Flutterwave POS terminals on October 12 and 13, 2023.
Following this revelation, Flutterwave requested Wema Bank to immediately freeze its settlement account, from which large sums were been moved to various individual bank accounts.
Data from the Nigeria Inter-Bank Settlement System (NIBSS) also revealed that 9,633 erroneous transactions were conducted on the Flutterwave POS platform on October 12 and 13, 2023, by 814 Flutterwave POS agents during the system glitch.
According to NIBSS, Flutterwave’s total exposure at the time was estimated at N21.2 billion. However, Flutterwave worked with banks to restrict affected accounts, successfully preserving N7.2 billion.
Court documents, however, revealed that the company had sought police assistance to recover the stolen funds rather than bringing the offenders to book.
In August, a Federal High Court sitting in Abuja denied a motion by Nigeria’s Inspector General of Police (IGP) seeking to compel 12 banks and financial institutions to reverse billions of naira that were allegedly fraudulently withdrawn from Flutterwave’s Wema Bank account.
In the motion ex parte, dated July 17, 2024, and marked FHC/ABJ/CS/1015/24, the IGP’s lawyers argued that about 244 suspects criminally siphoned billions from Flutterwave’s account, transferring the funds to numerous bank accounts belonging to individuals who are either untraceable or difficult to locate.
During proceedings, the Inspector General of Police’s counsel, Victor Okoye, in his prayer, urged Justice Peter Lifu to grant his motion ex parte, in accordance with relevant laws, and order the reversal of funds to Flutterwave.
The judge, however, challenged the counsel to justify why the ex parte motion should be granted without hearing from the respondents, including the banks and suspects, in line with the constitutional provisions of fair hearing.
“Should I order them [the banks] to reverse the funds without hearing their side of the story, based on your one-sided account? If I grant the reversal, what is left of this case? You did not file a motion on notice. Once I reverse it, that is the end of the matter,” citing the necessity of a fair hearing, particularly from the banks involved,” Justice Lifu said.
To this end, the IGP’s counsel argued that the defendants were not traceable, but when they were ready they could approach the court at any time. But Justice Lifu countered the argument, noting that the banks at least should have been served with the legal processes so they could respond. This is because they are the entities responsible for reversing the funds.
The judge also pointed out that there was no motion on notice accompanying the ex parte motion, as required by the court’s rules.
“Who is to reverse it if not the banks? Serve them and let them come and tell me, ‘We surrender, we have no objection, and we are ready to comply with the court order,’” the judge said.
Subsequently, the judge refused the ex parte motion, describing it as a clear breach of Section 36 of the 1999 Constitution, which guarantees the right to a fair hearing.
Now, it seems the police have finally decided to go after the perpetrators. So far, they said that have been able to make arrests following their investigations into bank accounts and phone numbers of the 814 Flutterwave point-of-sale merchants involved in the unauthorised transactions. And now, rather than a reversal of funds by the banks, the police are seeking a freeze of the 601 accounts suspected of benefitting from the fraudulent transfers.
See also: Ghana elections: Nigeria is an example of how not to use the BVAS – analyst