Skip to content
fraudinvestigating

Flutterwave unauthorized-transfer incidents

Nigeria's largest fintech suffered a series of unauthorized-transfer incidents in 2023, including a ₦2.9 billion ($4.2M) diversion across 28 accounts and a later ₦19 billion ($24M) loss via abused POS-merchant access, prompting Mareva injunctions to freeze thousands of beneficiary accounts.

Victim
Flutterwave
Loss
$24.0M
users
6.0K

Across 2023 and into 2024, Flutterwave — Africa's most valuable fintech and a dominant payments processor in Nigeria — was hit by a recurring pattern of unauthorized-transfer incidents that drained billions of naira from its platform and forced repeated court action to claw back funds.

What happened

The most prominent 2023 episode began around 19 February 2023, when roughly ₦2.9 billion (~$4.2 million) was moved out of Flutterwave through 63 transactions across 28 accounts. By early March, court filings — seeking Post-No-Debit restrictions on 107 beneficiary accounts across 27 financial institutions — had become public. Online analysis suggested the funds were accessed after merchant API keys were compromised through social engineering, though the exact vector was never officially confirmed. Flutterwave publicly denied being hacked, insisting "no user lost any funds" and attributing the event to customers who had not enabled recommended security settings.

A larger incident followed. On 10 October 2023, Flutterwave discovered that point-of-sale merchants had abused their platform access — which it described as a "technical glitch" — to execute illegal transfers totalling roughly ₦19 billion (~$24 million).

Response

In February 2024, Flutterwave obtained a Mareva injunction compelling 35 financial institutions — including Access Bank, Zenith Bank, OPay, and Moniepoint — to disclose the KYC details of more than 6,000 beneficiary account holders so the company could pursue recovery via email, SMS, and WhatsApp. A further breach reported in May 2024 saw approximately ₦11 billion (~$7 million) moved through five institutions over four days using laundering-style "round-trip" transfers designed to stay below fraud-detection thresholds. Nigerian police later arrested bank customers tied to that case.

Impact

The cumulative incidents underscored deep weaknesses in Nigeria's payments ecosystem: weak merchant-key hygiene, inconsistent KYC enforcement across banks, and the ease with which beneficiary accounts could be opened and emptied before detection. While Flutterwave maintained that customer funds and data were never compromised, the episodes inflicted reputational damage on a company then preparing for a potential IPO and operating across more than 30 African markets.

Why it matters

Flutterwave's 2023 troubles became a reference case for fraud and insider/merchant abuse risk in high-growth fintech. They helped drive tighter scrutiny of POS-merchant onboarding and pushed the Central Bank of Nigeria's BVN/NIN verification mandates to the centre of the regulatory conversation, illustrating that at fintech scale, the most damaging losses can stem not from a database breach but from abused legitimate access and porous downstream KYC.

Timeline

  1. An estimated ₦2.9 billion (~$4.2M) is diverted from Flutterwave through 63 transactions across 28 accounts; the company says it detected the anomaly via routine monitoring.

  2. Court filings seeking to freeze 107 beneficiary accounts across 27 financial institutions surface publicly; Flutterwave denies being hacked and says no user lost funds.

  3. Flutterwave discovers that POS-device merchants abused their platform access via a 'technical glitch,' illegally transferring roughly ₦19 billion (~$24M).

  4. Flutterwave obtains a Mareva injunction to recover the ~$24M, compelling 35 institutions to disclose KYC details of more than 6,000 beneficiary account holders.

  5. A separate breach reported in 2024 sees a further ₦11 billion (~$7M) moved through five financial institutions over four days in laundering-style 'round-trip' transfers.

  6. Nigerian police reportedly arrest bank customers linked to the ₦11 billion fraud case.

Sources

  1. techcrunch.comhttps://techcrunch.com/2023/03/05/alleged-security-breach-leaves-millions-of-dollars-missing-from-flutterwave-accounts/
  2. techcabal.comhttps://techcabal.com/2024/02/08/flutterwave-to-recover-missing-24million/
  3. techpoint.africahttps://techpoint.africa/news/flutterwave-plans-recover-lost-funds/
  4. techcabal.comhttps://techcabal.com/2024/05/16/exclusive-flutterwave-loses-%E2%82%A611-billion-in-security-breach/

Related incidents

Data breachResolved

Blooms Today data breach (2023)

In April 2024, 15M records from the online florist Blooms Today were listed for sale on a popular hacking forum. The most recent data in the breach corpus was from November 2023 and appeared alongside 3.2M unique email addresses, names, phone numbers physical addresses and partial credit card data…

Victim
Blooms Today
Records
3.2M
RansomwareContained

ICBC Financial Services LockBit ransomware (2023)

LockBit ransomware disrupted the U.S. broker-dealer arm of the world's largest bank, ICBC, jamming settlement of over $9 billion in U.S. Treasury trades. Bank staff sent critical settlement details by USB stick via a messenger across Manhattan. $62 billion of Treasuries failed to deliver in one day.

Victim
ICBC Financial Services (U.S. broker-dealer of Industrial and Commercial Bank of China)
Loss
$9.00B
Data breachResolved

Manipulated Caiman data breach (2023)

In July 2023, Perception Point reported on a phishing operation dubbed "Manipulated Caiman". Targeting primarily the citizens of Mexico, the campaign attempted to gain access to victims' bank accounts via spear phishing attacks using malicious attachments.

Victim
Manipulated Caiman
Records
39.9M