Cyber Liability: Mobile Banking Attack on a Commercial Bank
Overview
A man-in-the-middle attack on a commercial bank's mobile app allowed a rogue device to bypass device binding and make 136 fraudulent transfers from 26 customer accounts, totalling ₦587.4 million. The bank claimed under its cyber crime policy.
Our approach
Working with an independent IT forensic specialist, we reviewed the bank's internal and third-party forensic reports, met its information security team, and engaged the Police Special Fraud Unit on the investigation and recovery position.
Findings
The attack exploited known weaknesses in the app, including incomplete API encryption and the absence of server-side validation. A more secure version had been built but not deployed. We mapped the control gaps against ISO/IEC 27001 and the CBN Cybersecurity Framework.
Outcome
After ₦272.1 million of recoveries, we applied the policy limit and a 30% penalty for known, unremediated control lapses, and recommended a settlement of ₦120.96 million against a claim of ₦587.4 million.
Key takeaway
Alongside the adjustment, we gave the insured risk improvement recommendations and gave insurers policy wording recommendations for renewal, so the lessons of the loss carry into future cover.
