INSIDE OPAY’S HOUSE OF CARDS - How phishing gangs, court orders and a ₦714 million software glitch exposed the cracks in Nigeria’s biggest fintech.

The push notification arrived at 2:11 a.m. on 4 March: “Your wallet has been credited ₦1,980,000.” By sunrise, the money was gone – withdrawn in four tranches from four different OPay accounts, none of which belonged to the man who received the alert.

That single ping is now exhibit A in a mushrooming legal file that accuses Nigeria’s largest fintech, OPay, of operating a system so porous it has become “a clearing house for digital heists.”

Over the past eight months, *Premium Express* and *TechCabal* have catalogued no fewer than nine separate court cases, two regulatory fines and one secret freezing order that, stitched together, paint a picture of a company racing for market share faster than it can bolt the doors.

1. THE ₦714 MILLION “GHOST MONEY”

Between 10 December 2023 and 4 March 2024, a coding error in OPay’s card-switch interface mis-labelled pending transactions as successful. Customers saw money hit their wallets; OPay’s ledger said the payments had actually failed.

Result: users spent or transferred ₦714 million that technically never existed.

When the glitch surfaced, OPay quietly mailed 312 high-value recipients demanding repayment. Only 10 % refunded.

In June, the company obtained a Federal High Court ex-parte order (FHC/L/CS/1275/2024) freezing 30 customer accounts in rival banks – a legal first for a Nigerian fintech.

*None of the account owners were joined as parties; many only discovered the freeze when POS withdrawals failed during a wedding or market run.*

OPay declined repeated requests for comment, citing “sub-judice constraints.”

2. “TIER-1” TRAP: OPEN AN ACCOUNT IN ANYONE’S NAME

In August, *Techpoint Africa* demonstrated that OPay’s “Verify-with-Bank-Account” backdoor lets fraudsters create Tier-1 wallets using stolen account numbers and a random selfie.

Within 24 hours, reporters had opened accounts in the names of:
- A popular Nollywood actress (without her knowledge)
- A deceased microfinance bank customer
- This journalist

Each wallet could move ₦50,000/day – small individually, but a money-mule army when scaled. Central Bank directives say all wallets must pass NIN/BVN verification; OPay’s workaround relies on bank-account name-matching only. CBN fined OPay ₦633,990 in Q2 2025 for “KYC lapses” – a fraction of its $570 million war-chest, but a public red flag.

3. COURT ORDERS? “WE’LL GET BACK TO YOU”

Last December, an Osun State High Court held that OPay breached a customer’s constitutional right to property when it froze his ₦3 million mosque-building donation without a court order. Justice F. A. Sodamade awarded ₦500,000 damages; OPay ignored the judgment for five weeks until the story broke on *FIJ.ng*. Even now, the damages remain unpaid.

Lawyers say the tactic is common:
“Freeze first, ask questions later. Most users lack the legal muscle to sue, so the money sits in float – earning overnight income for OPay,” says Barrister Tewogbade, who represented the mosque donor.

4. 5,000 COMPROMISED ACCOUNTS IN 12 MONTHS

Internal numbers leaked to *ThisDay* show 5,000 OPay wallets were hijacked through SIM-swap + phishing between January 2024 and October 2025. Customers wake up to emptied balances after receiving a “Dear user, upgrade your KYC to avoid blockage” SMS that mirrors OPay’s font and colour palette.

OPay blames “user negligence”, but a former staffer (name withheld – he signed an NDA) says one-time passwords (OTPs) are sometimes delivered in plain text via SMS, making them easy prey for swap fraud.

5. DIRECTORS IN THE DOCK

In May, the Economic and Financial Crimes Commission arraigned an OPay director of operations and two bank staff for allegedly converting ₦95 million in fraudulent inflows – money traced to suspected terror financiers.

The accused pleaded not guilty; trial resumes January 2026. Whatever the verdict, the charge sheet marks the first time a top-five fintech executive has faced criminal prosecution in Nigeria.

6. “TOO BIG TO FAIL, TOO FAST TO POLICE?”

OPay processes $6 billion monthly across 40 million wallets. Its microfinance licence was designed for village thrift societies, not super-apps moving the volume of a mid-tier commercial bank.

CBN’s 2024 suspension of new-customer onboarding – lifted after three months – was meant to force tighter KYC, but insiders say sign-ups are again outpacing compliance staff. A senior regulator who spoke off the record put it bluntly:
“We’re chasing a bullet train with a bicycle. By the time we issue a circular, they’ve added three new products.”

7. CUSTOMERS LEFT HOLDING THE BAG

- Maryam Sule, pepper seller in Kaduna, lost ₦470,000 to the March glitch. OPay reversed ₦83,000 – “the amount we could recover” – and closed her ticket.
- Emeka Okafor, POS agent in Onitsha, is ₦1.2 million in the red after funding his wallet with “ghost money,” then forwarding cash to clients. Police seized his terminal; OPay’s support chat ended with “We empathise, seek legal redress.”

BOTTOM LINE

OPay has democratised payments for millions, but the same rails are being ridden by fraud rings, ransom collectors and, allegedly, terror financiers. Court files, regulatory fines and internal leaks show a pattern:
- Product velocity outruns risk controls
- Customer assets are frozen or lost inside opaque compliance black boxes
- Legal consequences are slow, cheap or non-existent.

Until the Central Bank upgrades fintech supervision – or OPay voluntarily slows its growth to board up the loopholes – users bear the cost of every glitch, phishing wave or freezing order. As I left the Lagos headquarters last night, a new billboard blinked above the gate:
“OPay – Safe, Fast, Reliable.” Maryam Sule’s reply, delivered through cracked WhatsApp voice notes, was blunter: “Reliable until your life savings disappear.”

This has been The Red Hot Report from Pepper-Room. The news that bears it all.

www.pepperroom.com.ng #pepperroomnews #pepperroomng #pepperroom