As Nigeria deepens its reliance on digital financial services, a growing cybersecurity challenge is demanding attention: the danger posed not only by external hackers but also by individuals who already have legitimate access to sensitive systems.
This was the central concern raised by the Inspector-General of Police, Olatunji Rilwan Disu, at the 2026 Cybersecurity Awareness Campaign of the Nigeria Police Force National Cybercrime Centre (NPF-NCCC), held on Thursday at the Nigeria Police Resource Centre, Jabi, Abuja.
Speaking under the theme, “Towards a Resilient Cyberspace: Think Before You Click,” Disu warned banks, fintech companies, payment service providers, telecommunications operators and other financial institutions against overlooking internal vulnerabilities while defending their systems against external attacks.
His message was clear: cybersecurity cannot be achieved through technology alone. It also requires accountability, effective supervision and a culture of security within organisations.
The threat within
For many financial institutions, cybersecurity investments often focus on firewalls, encryption systems and fraud-detection software designed to prevent unauthorised access. However, these measures may not be sufficient when threats originate from people who already possess authorised access to customer information, financial transactions and internal databases.
Disu identified malicious conduct, collusion, compromised credentials, abuse of privileged access, negligence and weak oversight as potential sources of insider threats.
Employees with access to sensitive systems could, through misconduct or compromised accounts, create opportunities for criminals that external attackers might struggle to exploit.
The implication is significant for a financial sector increasingly dependent on digital transactions. Weak internal controls could expose customers to financial losses, compromise confidential information and undermine public confidence.
To address these risks, the IGP urged financial institutions to strengthen employee screening, access controls, separation of duties, transaction monitoring, internal audits and independent oversight.
He also called for prompt investigations into suspicious access patterns, unauthorised data extraction, irregular transaction approvals and unexplained account changes.
“This is not a judgment on the integrity of our workforce. It is a recognition that institutional trust must be reinforced by verification, accountability and disciplined controls,” Disu said.
His remarks underscored a fundamental principle of cybersecurity: trust is essential, but it must be supported by safeguards that make abuse more difficult to conceal.
From reaction to prevention
Beyond insider threats, Disu called for a shift in the Nigeria Police Force’s approach to cybercrime, advocating proactive and predictive policing rather than waiting for attacks to occur before responding.
He said law enforcement agencies must identify early warning signs, understand emerging criminal methods, assess vulnerabilities and disrupt threats before they materialise or escalate.
Achieving this, he explained, would require intelligence-led policing, open-source intelligence, digital forensics, credible threat analysis and timely information sharing.
The approach, however, must remain within legal boundaries. Disu stressed that predictive policing should be based on reliable intelligence, human oversight, respect for fundamental rights and the rule of law.
He described personnel of the NPF-NCCC as the “Guardians of Nigeria’s Digital Frontier,” charging them to strengthen their capacity to investigate cyber-enabled offences, preserve digital evidence, support victims and work with relevant partners to dismantle criminal networks.
Cybersecurity is everyone’s responsibility
Disu also argued that securing Nigeria’s cyberspace cannot be left to the police or technology specialists alone.
Government agencies, financial institutions, regulators, telecommunications operators, technology companies, educational institutions, civil society organisations, the media and ordinary citizens all have roles to play.
He called for stronger cooperation in threat-intelligence sharing, incident reporting, digital-evidence preservation and coordinated responses to cyber threats.
For organisations, this means treating cybersecurity as a leadership responsibility rather than merely an information technology function. For citizens, it means recognising that everyday online decisions can either reduce or increase exposure to fraud.
The IGP urged Nigerians to verify links before clicking, confirm payment instructions through independent channels, protect passwords and one-time passwords, enable multi-factor authentication and keep their devices updated.
He also warned against sharing information without first establishing its authenticity.
These precautions may appear simple, but they can help prevent scams that rely on deception, impersonation and hurried decisions.
A different future for Nigerian youths
Disu also directed a message to young Nigerians, urging them to channel their digital skills into innovation and legitimate careers rather than criminal activity.
He noted that the same knowledge that could be misused for fraud, impersonation, harassment and exploitation could support careers in cybersecurity, software development, digital innovation and technology entrepreneurship.
“Choose creativity over criminality, integrity over shortcuts, and innovation over exploitation,” he urged.
He encouraged victims and witnesses of online fraud, cyberbullying, sextortion and other forms of digital abuse to seek assistance and report incidents through appropriate channels.
Building a resilient cyberspace
Ultimately, Disu’s address presented cybersecurity as a shared responsibility requiring more than sophisticated technology. Effective internal controls, ethical conduct, public awareness, professional policing and institutional cooperation must work together.
A resilient cyberspace, he argued, is not one in which threats never emerge, but one where risks are anticipated, vulnerabilities reduced, incidents detected early and responses coordinated.
As Nigeria’s digital economy expands, the challenge will be turning these principles into consistent practices across institutions and communities.
The campaign’s message therefore extends beyond a single event: Think Before You Click. Verify Before You Share. Report Suspicious Activity.
