₦3m USSD Fraud: Telecom Operator Under Fire Over Recycled Number as NCC Faces Questions on Regulatory Failure- The Press Nigeria

The alleged disappearance of about ₦3 million from an Access Bank customer’s account through USSD transactions has exposed what may be a serious weakness in Nigeria’s mobile-number recycling system, with the telecommunications operator involved and the Nigerian Communications Commission (NCC) now facing difficult questions over how a number linked to a customer’s financial identity was allegedly reassigned while she was abroad.

The customer, Rita Markenny Egba, reportedly alleged that transactions were carried out on her Access Bank account between October and December 2025, when she was living in Dubai.

Information currently under review indicates that the mobile number registered to her Access Bank account had allegedly been reassigned to another subscriber before the disputed transactions occurred.

That development fundamentally changes the character of the complaint.

This is no longer simply a question of whether somebody obtained unauthorised access to a bank account.

It raises a more disturbing question:

How can a telecommunications company transfer a mobile number to another person when that number remains connected to the former subscriber’s banking and digital identity?

Access Bank has commenced investigations into the matter.

But while the bank investigates the disputed transactions, the spotlight is increasingly shifting to the telecommunications side of the equation—and particularly to the regulator that is supposed to ensure that Nigeria’s numbering system does not become a gateway to identity theft and financial exposure.

TELECOM OPERATOR: HOW DID THE NUMBER END UP IN SOMEONE ELSE’S HANDS?

The telecommunications operator allegedly reassigned Egba’s registered number to another customer.

There may be nothing inherently unlawful about recycling an inactive mobile number.

The problem is what happens before, during and after that transfer.

A mobile number that has been connected to a bank account is not necessarily just an ordinary network resource.

It can be tied to:

– Bank transaction alerts;
– USSD banking;
– OTP authentication;
– Mobile banking applications;
– BVN-related services;
– NIN-linked services;
– Email recovery;
– Social-media accounts;
– Fintech platforms; and
– Other sensitive digital services.

That means the operator’s responsibility cannot simply end with saying that the number had become inactive.

The critical issue is whether reasonable safeguards existed to prevent the reassignment from creating foreseeable security risks for the previous subscriber.

Was Egba warned?

When was she warned?

Through what channel?

Was an alternative contact method available?

Was the number quarantined for the prescribed period?

Was the new subscriber subjected to the required identity verification?

Was the complete ownership history preserved?

These are not peripheral questions.

They go to the heart of the controversy.

NCC: WHAT EXACTLY IS THE REGULATOR MONITORING?

The more uncomfortable questions, however, are directed at the NCC.

The Commission is responsible for regulating Nigeria’s telecommunications industry and overseeing the country’s numbering resources.

It has also acknowledged the growing risks associated with mobile identity and recycled numbers through policy initiatives such as the Telecom Identity Risk Management System (TIRMS).

That acknowledgement creates an obvious accountability test.

If the NCC has known for years that recycled numbers can create identity and financial-security risks, what practical safeguards were in place when Egba’s number was allegedly reassigned?

If safeguards existed, did they work?

If they did not work, why not?

And if the regulatory system did not require telecom operators to sufficiently protect financial identities attached to recycled numbers, why was that gap allowed to persist as mobile banking became increasingly dependent on telephone numbers?

The NCC cannot simultaneously recognise recycled-number risks and then treat the consequences as purely a private dispute between a customer and a telecom company.

A NUMBER IS RECYCLED. WHAT HAPPENS TO THE IDENTITY ATTACHED TO IT?

This is where Nigeria’s telecommunications regulation appears to face a fundamental challenge.

A telephone number can be inactive.

But the identity associated with that number may remain very active.

A former subscriber may stop using a SIM card while the number remains registered with her bank, fintech platforms, email accounts and other services.

When the telecom operator eventually reallocates the number, the network sees a new subscriber—but other institutions may still see the old customer.

That is the dangerous disconnect.

The telecom operator knows the number has changed hands.

The bank may not.

The customer may not know.

And the new subscriber may have no idea that the number was previously associated with somebody else’s financial life.

That is precisely why number recycling cannot be treated as an ordinary administrative process.

WHERE WAS THE NCC’S WARNING SYSTEM?

If the NCC’s regulatory framework recognises the dangers of recycled numbers, Nigerians are entitled to ask whether operators are required to provide effective advance warnings to subscribers.

And if they are, where is the evidence that such warnings were issued in this case?

If notification was sent only through the same number being considered for deactivation, that raises another obvious concern.

How does a customer receive a warning on a number she is no longer actively using?

What happens to Nigerians living abroad?

What happens to customers who have temporarily stopped using a line?

What happens when the number is still attached to their bank account but is no longer their primary communication channel?

These are practical questions that a regulator overseeing a modern digital economy should already have robust answers to.

THE OPERATOR HOLDS THE AUDIT TRAIL

The telecom operator is uniquely positioned to establish what happened.

Its records should reveal the complete lifecycle of the disputed number.

That includes the date it became inactive, the date of deactivation, the period it remained out of circulation, the date of reassignment and the identity of the new subscriber.

It should also be possible to establish the KYC documents used in registering the new subscriber and whether the NIN verification process was properly completed.

The question is whether the operator can produce a clear and verifiable audit trail demonstrating that every stage complied with the applicable regulatory requirements.

If it can, that evidence should be made available to investigators and regulators.

If it cannot, the NCC has an even bigger problem.

THE NCC MUST NOT HIDE BEHIND “COMPLIANCE”

The regulator’s responsibility should not end at asking whether an operator technically followed an existing rule.

Regulation must also respond to emerging risks.

Nigeria’s financial system has changed dramatically.

USSD, mobile banking, fintech and digital identity services have transformed the mobile phone into a financial access device.

Yet if number-recycling rules were designed primarily around telecommunications administration rather than financial identity protection, then the regulatory framework may simply have failed to keep pace with reality.

That is the deeper issue.

A regulator that knows the risk exists must demonstrate that its safeguards are capable of preventing or mitigating the risk.

Otherwise, policies become paperwork while Nigerians bear the consequences of regulatory gaps.

WHAT ABOUT ACCESS BANK?

Access Bank is also facing questions, particularly about how its USSD security and transaction-alert systems handled the alleged change in ownership of the registered mobile number.

The bank’s investigation should establish what authentication was used for each disputed transaction and whether the transactions showed unusual patterns.

It should also establish whether alerts were generated and where those alerts were delivered.

But Access Bank’s investigation alone cannot resolve the telecom side of the matter.

The bank can explain what happened inside the account.

Only the telecom operator can conclusively establish what happened to the number.

And only the NCC can explain whether the regulatory framework governing that number’s transfer was adequate and properly enforced.

THE MOST DAMNING QUESTION FOR THE REGULATOR

If the number was legally reassigned, the NCC must answer a straightforward question:

What safeguards prevent the new owner of a recycled number from inheriting access to the former owner’s digital life?

If those safeguards exist, Nigerians need to know whether they were activated in this case.

If they do not exist, then the regulator must explain why.

And if the safeguards exist only on paper, the NCC must explain how many other Nigerians may be exposed to the same vulnerability.

THIS IS BIGGER THAN RITA E GBA

The Egba complaint could ultimately be resolved through evidence from Access Bank, the telecommunications operator, regulators and law-enforcement authorities.

But regardless of the eventual finding, the case has exposed an uncomfortable reality.

Nigeria has allowed the mobile number to become a critical financial identifier without creating a sufficiently seamless system for transferring the security responsibilities attached to that identity when the number changes hands.

That is a regulatory problem.

It is an industry problem.

And it is a consumer-protection problem.

The NCC cannot wash its hands of the issue simply because a telecom operator allegedly followed a number-recycling procedure.

The question is whether the procedure itself provides adequate protection in today’s digital economy.

NCC MUST ANSWER NIGERIANS

The Commission owes Nigerians clarity.

It should explain:

What rules governed the reassignment of Egba’s number?

Was the required inactivity period observed?

Was she properly notified?

Was the new subscriber fully verified?

What mechanisms existed to identify financial accounts linked to the number?

Was the operator required to warn banks or other critical service providers?

Does TIRMS currently prevent or detect this type of identity mismatch?

And perhaps most importantly:

How many other recycled Nigerian numbers remain connected to former owners’ bank accounts and digital identities?

These are questions that cannot be dismissed as technicalities.

For a regulator entrusted with protecting the integrity of Nigeria’s telecommunications ecosystem, they go directly to the issue of accountability.

Until satisfactory answers emerge, the alleged ₦3 million USSD fraud involving Rita Markenny Egba should be viewed not merely as an isolated banking complaint, but as a warning signal about the dangerous intersection between recycled telephone numbers, financial authentication and regulatory oversight.

A telecom operator may own the network infrastructure.

A bank may control the account.

But the NCC controls the rules of the road.

And when that road allegedly leads from a recycled telephone number to a customer’s bank account, Nigerians deserve to know whether the regulator was asleep at the wheel—or whether the system itself was never properly designed to protect them.