Flutterwave, Africa’s largest payments platform, has reported a significant security breach in April 2024, with an estimated ₦11 billion ($7 million) diverted to multiple bank accounts. Insiders suggest the amount could be as high as ₦20 billion ($13.5 million). This breach follows a court order secured by Flutterwave in March to recover $24 million lost to unauthorized transactions earlier in the year.
The company acknowledged the breach in a statement, emphasizing that no customer funds or data were compromised and that the incident affected only a small subset of its customer base. However, sources reveal the stolen funds were transferred to accounts in five financial institutions over several days, with transactions carefully kept below fraud detection thresholds to avoid suspicion. The matter has been reported to law enforcement, and investigations are underway.
Unlike previous incidents, where funds were widely distributed across numerous accounts, this breach appears to involve an organized network using a closed-loop system. Funds were repeatedly transferred between the same accounts to obscure the money trail, a method distinct from earlier attacks.
This breach is the fourth security incident involving Flutterwave in the past 14 months, following unauthorized transfers in February, March, and October 2023. While Flutterwave continues to strengthen its security protocols, the frequency of these breaches raises questions about the robustness of its systems in the face of escalating cybersecurity challenges.
Recent regulatory mandates requiring financial institutions to link customer accounts to Bank Verification Numbers (BVNs) or National Identification Numbers (NINs) by March 2024 could aid investigators in identifying account holders involved in the breach. Flutterwave has also secured a Mareva injunction, enabling it to recover stolen funds and assets from the identified accounts, even if the funds have been spent.
The incident underscores the growing threat of cyberattacks in Africa’s digital economy, particularly for fintech platforms like Flutterwave. As investigations continue, the company faces mounting pressure to implement more effective measures to safeguard its systems and maintain trust in its operations.
