For about ₦100, roughly seven cents, a stranger can buy the record that the Nigerian government treats as proof of who you are.
That is not a hypothetical. In June 2024, Paradigm Initiative, a digital rights group in Lagos, bought the National Identification Number slip of Bosun Tijani, then the minister in charge of the country’s digital economy, from a website called AnyVerify. It paid ₦100. It bought the slip of Vincent Olatunji, who ran the commission responsible for enforcing data protection law, for the same price. The group’s executive director, Gbenga Sesan, said afterward that the point was to find out whether anyone in government would care once the data belonged to people in government.
The National Identity Management Commission, known as NIMC, holds the biometric and demographic records behind more than 120 million Nigerians. A NIN is now required to open a bank account, buy a SIM card, get a passport, register to vote, pay tax, and collect welfare. The Bank Verification Number, issued by the banking system, is the other half of that lock. Together they are enough for someone to borrow money in your name.
Both have been for sale online, repeatedly, for at least two years.
The Sites
The first one to be named publicly was XpressVerify. In March 2024, the Foundation for Investigative Journalism, an outlet known as FIJ, reported that the private site had access to the records of registered Nigerians and was charging for them.
Three months later, AnyVerify appeared. Its menu, as FIJ described it, read like a government filing cabinet: NIN, virtual NIN, driver’s license, international passport, company records, tax identification number, voter’s card and phone numbers. Records went for ₦100 each. FIJ bought the NINs of two of its own journalists, who agreed to it, for ₦150 apiece.
The traffic was not marginal. FIJ cited figures showing AnyVerify was visited about 568,000 times in February 2024 and about 118,000 times in April. Analytics from Semrush put it among the top 3,400 websites in Nigeria, with at least 68,000 visits in May.
When those sites went dark, others took their place. FIJ later traced one operation, NimcVerify, through a chain of names. It kept its original business name for a while, became Bexlo, then Nuvra. The logo and the interface changed each time. The system behind them did not.
The trade is not only online. A reporter who went to Ikeja, where NIMC agents work from booths outside the office, was quoted ₦1,000 for the home address of a man he named. The agent had first declined when told the details were for someone else, then changed his mind when the request got specific.
“Not compromised”
NIMC’s public position has been consistent. On June 22, 2024, it distanced itself from AnyVerify and a list of similar sites and warned Nigerians not to use them. Days later, it told the public that Nigerians’ data had not been compromised and that it had authorized no website to sell or misuse the NIN.
Mr. Sesan’s answer was that the records on those sites were NIMC’s own, and that ordinary Nigerians had not handed them over.
Later reporting complicated the commission’s account differently. An FIJ investigation by Timileyin Akinmoyeje found that some Front End Partners, private firms licensed by NIMC to carry out enrollment and verification, were sub-leasing their access to operators running the black-market sites. On that account, the database was not breached in the way the word usually suggests. The doors were opened from inside, by people who had been given keys.
FIJ has also said its own website was hit by repeated coordinated cyberattacks that it traced to NIMC’s headquarters in Abuja. The commission did not answer the reporters’ calls or a text message before publication, FIJ said. NIMC has not publicly addressed that accusation.
The case
Paradigm Initiative took the matter to court. Working with the law firm Vindich Legal, it served pre-action notices and then filed a public-interest suit naming NIMC as first respondent, along with the Central Bank, the Nigeria Inter-Bank Settlement System, the immigration service, the tax authority, the road safety corps, the electoral commission, the Nigeria Data Protection Commission and the attorney general.
The group asked the court to order compensation for Nigerians whose records were sold through AnyVerify, and to require a published inquiry, within a month of judgment, into other leaks and into who is behind the sites still trading in personal data, licensed and unlicensed alike.
The purchases of the minister’s and the regulator’s slips went in as evidence. By the end of 2024, the case was still moving through hearings, with another date set for January.
More Power, Fewer Checks
On June 26, 2026, President Bola Tinubu signed the NIMC Act 2026, repealing the 2007 law that created the commission.
The government presented it as a fix. The Act names NIMC the root certification authority for Nigeria’s public key infrastructure, putting it at the center of digital authentication across banks, telecom operators and government services. It makes the NIN mandatory for a longer list of transactions. At the signing, Mr. Tinubu said he would not allow Nigerians’ data to be treated carelessly, and that the law aligns identity management with the Nigeria Data Protection Act, meaning personal information cannot be accessed without consent.
The Act also expands the commission’s governing board to include representatives of 14 federal institutions. The Nigeria Data Protection Commission is not among them.
The NDPC is the agency created under the 2023 data protection law to regulate how personal data is handled, investigate breaches and enforce compliance across public and private bodies. It is also a respondent in the Paradigm Initiative case. Its absence from the board of the agency whose records have been turning up for sale is the part of the new law that its critics keep returning to.
What that produces is a commission with a wider mandate, a larger board, more statutory authority over the machinery of digital trust, and no seat at its own table for the regulator meant to hold it to account.
What it Costs
The practical risk is not abstract. With a NIN and a BVN, someone can open accounts, take out loans, register property, claim benefits and move through systems that were built to trust those numbers precisely because they were supposed to be hard to obtain.
Mr. Sesan has said the data of the President, the Vice President, the National Security Adviser, senior military officers and ministers is also available to anyone who knows a full name and a date of birth. The numbers cannot be reissued the way a stolen card is replaced. Once a NIN is on the market, it stays there. The sites keep changing names, the commission keeps saying it was not breached, and the file with your face in it keeps selling for less than the cost of a bus fare.
Recent Events
On September 22, a video posted by GST showed a man pulling up a stranger’s NIN and BVN, with name, date of birth, phone number, and photograph. The next day, NIMC’s head of corporate communications, Kayode Adegoke, issued a statement calling the claim “false and unfounded.” He said the National Identity Database had not been breached or compromised at any point, and that the video was a recycled report from 2024 that the commission had already disclaimed.
The man in the video, according to FIJ, was Timothy Ebi, the operator whose platform it had traced through its chain of names. FIJ reported in July that he was offering to train people to carry out NIN modifications for ₦60,000. A flyer from his outfit promised to help buyers launch their own verification website for the same price.
NIMC’s statement also pointed to NINAuth, a new authentication service that it said requires the explicit consent of the NIN holder before any verification takes place. Separately, the commission has ordered an investigation into whether some authorised verification agents violated the terms of their access. It did not say how long that would take.
