A retired civil servant based in Ibadan has instituted a ₦50 million lawsuit against Moniepoint Microfinance Bank at the Oyo State High Court, alleging that the fintech company opened unauthorized bank accounts in her name without her knowledge or consent.
Filed in February 2026, the suit is among the first significant cases testing the enforcement of the Nigeria Data Protection Act 2023 against a Nigerian fintech institution.
Allegations of Unauthorized Account Creation
According to the statement of claim, the plaintiff became aware of the alleged unauthorized accounts only after her legitimate bank account was restricted pursuant to a garnishee order linked to a debt she denies incurring. The restriction reportedly prevented her from accessing funds needed for essential transactions.
The claimant alleges that Moniepoint opened two separate accounts in her name using her National Identification Number (NIN) and Bank Verification Number (BVN) without proper authorization or verification.
Following the discovery, she submitted a Data Subject Access Request (DSAR) under the NDPA 2023. Documents allegedly provided by the bank, according to the suit, revealed significant verification lapses. The plaintiff claims the accounts were opened using falsified documents, including what she describes as a fake NIN slip and contact information unrelated to her. She further alleges that the accounts listed a Lagos residential address where she has never lived.
Alleged Breach of Data Protection Obligations
The suit contends that Moniepoint failed to implement adequate identity verification and address confirmation procedures before creating and operating the accounts. It further alleges breaches of statutory obligations under the NDPA 2023, including:
- Failure to ensure personal data processed was accurate and lawfully obtained
- Failure to implement appropriate technical and organizational security measures
- Failure to prevent unauthorized or fraudulent processing of personal data
The claimant maintains that these alleged lapses resulted in serious personal and financial harm.
Damages Sought
The plaintiff is seeking ₦50 million in damages for emotional distress, health complications, and disruption to her financial life. She is also asking the court to order the permanent closure of the allegedly unauthorized accounts.
As of press time, Moniepoint Microfinance Bank has not issued a public statement in response to the suit.
Wider Implications for Nigeria’s Fintech Sector
Legal observers note that the case could clarify the scope of data controllers’ responsibilities under the NDPA 2023, particularly in relation to digital identity verification and Know Your Customer (KYC) compliance within Nigeria’s rapidly expanding fintech ecosystem.
With increasing digitization of financial services, the adequacy of verification protocols and data protection safeguards has become central to consumer protection and regulatory compliance.
The NDPA 2023 expressly permits an aggrieved data subject to seek judicial redress where unlawful data processing results in injury. As such, this matter is being closely watched by consumer rights advocates and data protection experts, as it may set an important precedent for corporate liability arising from identity theft allegedly facilitated by weak verification systems.
Should the court provide substantive guidance on these issues, the decision may significantly influence compliance standards across Nigeria’s fintech industry.