FRANCIS ONYEMACHI reports that the bank’s advisory comes as Nigeria’s banking sector marks a 51% year-on-year drop in digital payment fraud losses to ₦25.85 billion in 2025, even as regulators warn that social engineering and increasingly sophisticated malware remain the industry’s toughest fraud vectors.
Fidelity Bank Plc has issued a customer advisory warning of a rise in Remote Access Trojan (RAT) malware attacks, in which fraudsters disguise malicious software as legitimate mobile applications to gain remote control of victims’ phones and steal banking credentials.
In a notice titled “Everything You Need to Know About Random Access Trojan (RAT) Malware,” the bank said cybercriminals are increasingly relying on fake adverts, pop-up prompts and fraudulent links circulated on social media, websites and messaging platforms to trick users into installing the malware.
Once installed, the bank said, a RAT can grant fraudsters remote access to a device, enabling them to steal banking credentials, intercept one-time passwords (OTPs), monitor user activity and carry out unauthorised transactions.
How the Malware is Disguised
According to Fidelity Bank, the malware is typically packaged to resemble ordinary, everyday applications, including sports betting and live-score apps, streaming platforms, utility and device-optimisation tools, fake banking support applications, and fraudulent system or phone update apps.
The choice of disguise is notable: betting and streaming apps in particular are among the most widely downloaded categories on Nigerian app stores, giving fraudsters a large, habitual user base to target through familiar-looking install prompts.
Bank’s Recommended Safeguards
The bank listed six steps for customers to protect themselves: download apps only from the Google Play Store or Apple App Store; verify the developer before installing any application; avoid downloading apps from links shared via social media, messaging platforms, emails or pop-up adverts; never enter banking PINs, passwords or other sensitive information into unknown applications; review installed apps regularly and remove suspicious ones; and keep devices and security software up to date.
Customers who suspect their device has been compromised were advised to disconnect it from the internet immediately and contact the bank through its TrueServe channel at TrueServe@fidelitybank.ng or its customer line, 0700 343 35489.
The Wider Fraud Picture
The advisory lands at a moment of mixed signals for Nigeria’s electronic payments security. Data presented by the Nigeria Inter-Bank Settlement System (NIBSS) at the 2026 Nigeria Electronic Fraud Forum (NeFF) showed that digital payment fraud losses fell 51% to ₦25.85 billion in 2025, down from ₦52.26 billion in 2024, while reported fraud cases declined to about 67,515, continuing a five-year downward trend from 123,918 cases in 2021.
NIBSS attributed the improvement to identity-management initiatives such as Bank Verification Number (BVN) and National Identification Number (NIN) integration, alongside tighter monitoring across the payments ecosystem.
Even so, NIBSS chief executive Premier Oiwoh cautioned at the same forum that internet banking and e-commerce remain the fraud channels most exploited, and that social engineering — including insider involvement, SIM-swap fraud, account compromise and phishing — continues to be the most prevalent technique used against customers. Lagos alone accounted for roughly 63% of reported fraud activity in 2025, reflecting its concentration of digital transaction volume as Nigeria’s commercial hub. Separately, the Central Bank of Nigeria’s Deputy Governor for Financial System Stability noted that the elevated 2024 figure had been significantly distorted by a single ₦31.1 billion fraud incident at one banking institution, underlining how sensitive year-on-year comparisons can be to isolated large-scale breaches.
Fidelity Bank’s warning suggests that as institution-level and infrastructure-level fraud controls tighten, attackers are shifting more of their effort toward the device layer — exploiting ordinary customers’ phones directly through disguised apps rather than attacking bank systems head-on. That shift mirrors a pattern regulators have flagged globally: as payment-system defences mature, fraud tends to migrate toward the weakest remaining link, typically the end user’s device and behaviour.
