Why SMS Is Becoming The Favourite Fraud Channel Targeting Nigerians

We recently came across these two suspicious messages appearing in the same SMS conversation. Although the messages addressed completely unrelated issues, they shared something important: both attempted to get the recipient to visit an unfamiliar website.

Different stories. Different links. Same sender: AFRLINK. First, a message about an unpaid traffic violation. Then, another claiming that a courier couldn't locate your delivery address.

The fraudsters are reportedly impersonating GIG Logistics, using a failed-delivery story to direct unsuspecting Nigerians to a website where they are asked to provide delivery information and pay a ₦500 fee using their bank cards.

What appears to be a minor delivery charge could become an opportunity for criminals to steal sensitive payment information and attempt unauthorised transactions.

This raises two important questions: Why are fraudsters increasingly using SMS to reach Nigerians, and could recent personal data breaches be making their work easier?

Your Phone Number May Already Be Exposed

In August 2026, Zenith Bank confirmed that unauthorised individuals had accessed limited customer information, including phone numbers and email addresses, during a cyberattack.

The bank maintained that its banking systems remained secure but warned customers to remain vigilant against suspicious calls, emails and text messages.

Earlier in April, the Nigeria Data Protection Commission (NDPC) announced an investigation into an alleged data breach involving Remita, Sterling Bank and other entities.

The problem extends beyond individual institutions. According to cybersecurity company Surfshark, approximately 281,500 Nigerian accounts were compromised in the first quarter of 2026. Its analysis also identified approximately 1.9 million phone numbers exposed in Nigerian data breaches over the years.

These incidents raise concerns about what happens to personal information after it falls into the wrong hands. A phone number might seem harmless compared to a banking password, but it can give criminals a direct way to contact potential victims.

Why SMS?

Think about how much of your digital life is connected to your phone number. Your bank account, delivery orders, online shopping profiles, social media accounts and other digital services may all be associated with it. Now imagine that your phone number, possibly alongside your name or other personal information, becomes accessible to criminals.

They don't necessarily need your banking password to attempt fraud. They can start by sending a convincing message that encourages you to provide it yourself. And SMS offers certain advantages to attackers. Unlike WhatsApp, Instagram or Telegram, receiving an ordinary text message doesn't require an internet connection, a friend request or membership in a group. The message simply arrives in your inbox.

SMS phishing, also known as smishing, is not new. However, exposed contact information can make it easier for criminals to distribute phishing messages or tailor their stories to particular recipients.

This doesn't establish that the AFRLINK messages originated from any of the recently reported breaches. Phone numbers can also be obtained through public listings, data brokers, previous leaks and other sources.

Nevertheless, the connection between exposed personal data and phishing risk deserves attention.

Let's return to the AFRLINK messages.

The first claimed that a traffic violation record had not been processed. The second claimed that a delivery attempt had failed because the courier couldn't locate an address. Both included shortened links.

What makes this interesting is that the two messages appeared under the same sender identity.

SMS sender names can sometimes be spoofed or misused, depending on the telecommunications network and its verification arrangements. Consequently, messages appearing under one sender name do not necessarily originate from the same organisation or individuals.

The AFRLINK messages do not establish who sent them. However, they demonstrate how unrelated suspicious messages can appear in a single conversation.

Imagine receiving the traffic violation message and deleting it. Days later, the delivery message arrives. Without the earlier message for comparison, you might have fewer reasons to question the sender. The second message might also seem more believable if you recently placed an online order.

The story doesn't have to convince everybody. It only needs to convince the person whose circumstances make it believable.

From Data Exposure to Financial Fraud

A data breach does not automatically mean that money has been stolen. However, exposed information can become useful in subsequent fraud attempts. For example, criminals with access to phone numbers may send bulk phishing messages. If additional details are available, such as names or service relationships, they may be able to make their messages more convincing.

A recipient might then be directed to a fake website requesting payment information, banking credentials or other confidential details. This is why protecting personal information matters even when the exposed records do not include account passwords or transaction PINs. The information can still help criminals initiate contact and attempt further deception.

What Should Nigerians Do?

You may not be able to control every institution holding your personal information, but you can control how you respond to unexpected messages.

• Don't automatically trust the sender name. A familiar name in your SMS inbox is not sufficient proof of authenticity.

• Avoid unfamiliar links. If a message concerns a delivery, bank account or government service, verify the claim through the organisation's official website or independently confirmed contact details.

• Never enter banking credentials through an unexpected SMS link. Be particularly cautious of requests for passwords, PINs, OTPs or payment card information.

• Report suspicious messages. Preserve useful details, such as the sender name and message content, and report them through appropriate channels like GoWaly.

If you have already disclosed sensitive financial information, contact your bank immediately.

The Bigger Problem

The AFRLINK messages illustrate one way fraudsters may attempt to exploit everyday situations. The recent data breach reports raise another concern: personal information exposed today could potentially be used in fraudulent campaigns tomorrow.

We cannot conclude that the same criminals are responsible for both AFRLINK messages or that they obtained the recipient's phone number through a breach.

What we can say is that the exposure of personal data creates opportunities for criminals, and SMS remains a convenient way to reach potential victims.

The next message you receive might concern a package, an unpaid fine, your bank account or something entirely different. Whatever the story, verify it before acting.

Move smart before your money moves

Disclaimer: The origins of the AFRLINK messages and the destinations of their links have not been independently verified. No direct connection has been established between these messages and the reported data breaches.