Ecobank warns customers about fake mobile apps stealing banking credentials and OTPs

Ecobank has issued a security advisory warning its customers about fraudsters using fake mobile applications to steal banking credentials and intercept one-time passwords (OTPs). The bank said cybercriminals are deploying fraudulent apps to gain unauthorised access to personal banking accounts.

How the fraud works

Ecobank said fraudsters are circulating fake advertisements and pop-up prompts across social media platforms, websites, and messaging applications to lure users into installing malware-loaded apps. In a message to customers seen by Legit.ng on Thursday, July 16, the bank said these applications typically masquerade as legitimate tools. Common disguises include sports betting platforms, live score apps, streaming services, utility programmes, banking support tools, and phone update installers.

Once a user installs one of these fraudulent applications, the malware can seize control of the device without the customer's knowledge. The bank explained that the software is capable of harvesting banking login credentials and transaction PINs, intercepting incoming SMS messages and OTPs, and executing unauthorised transactions through the customer's registered mobile banking profile. This happens without requiring the fraudster to change the registered device. That means account holders may not receive the usual alerts associated with a new device login, making the fraud harder to detect early.

Protective measures for customers

Ecobank outlined a series of protective measures customers should adopt immediately. The bank advised that banking applications must only be downloaded through official channels, specifically the Google Play Store or Apple App Store. No app should ever be installed via links shared through social media, emails, websites, or messaging platforms.

Customers were also told to treat any unexpected on-screen prompt requesting 'system updates,' 'security verification,' or similar actions with suspicion. These are common tactics used to trick users into granting dangerous permissions. The advisory further recommended that customers periodically audit the applications installed on their devices, removing anything unfamiliar or no longer in use. Keeping device operating systems and security software updated was also stressed as a critical line of defence.

For anyone who notices unusual account activity or a transaction they did not authorise, Ecobank directed customers to disconnect the affected device from the internet immediately, contact their bank without delay, and formally report the incident. The bank also requested that any suspected phishing messages or spam be forwarded to its dedicated reporting address at [email protected].

What this means for customers

This advisory comes as cyber threats targeting Nigerian bank customers grow more sophisticated. The ability of fraudsters to hijack accounts without changing the registered device means customers cannot rely solely on new device alerts for protection. Vigilance in app downloads and permissions remains the first line of defence for anyone using mobile banking in Nigeria.