A new scam targeting Nigerians involves text messages claiming to be from the Federal Road Safety Corps (FRSC), stating that the recipient has committed a traffic offence and must pay a fine. The messages often appear urgent, prompting recipients to click on a link to pay the fine without verifying its authenticity. This urgency is what fraudsters are exploiting to steal from unsuspecting victims.
Several Nigerians have reported losing large sums of money after clicking on the links in these messages. Nollywood actor and filmmaker Adekanla Aderinola Desalu, popularly known as Deza The Great, lost $2,500 after clicking on a link in a message claiming he had exceeded the speed limit. He initially believed the message was a genuine FRSC notification and followed the link to pay the supposed ₦2,500 fine, only to discover that $2,500 had been deducted from his account.
Another victim, identified on Instagram as officialfunbi, received a similar message shortly after arriving in Abuja. Comedian MC Monica also alleged that he lost ₦1.8 million after interacting with a link sent to him over a supposed FRSC traffic violation. He clicked the link and paid what he believed was a small fine, only to discover the following morning that millions of naira had been taken from his account.
The Foundation for Investigative Journalism (FIJ) found that the messages were part of a wider operation involving fake FRSC websites designed to impersonate the agency and trick motorists into believing they had committed traffic offences. Some of the websites, including frsc-gov.sbs.ng and frsc.gov.eu.cc.ng, copied elements of FRSC's branding, layout, and service presentation, making them appear legitimate.
FIJ tested the websites by entering made-up vehicle plate numbers and found that they generated traffic offences and fines. The websites directed users to a third-party payment page called Payfast Now, where card details, including the card number and CVV, were requested. One version also requested the cardholder's PIN, potentially leading to financial theft.
The fake websites used spoofed domain names, such as frsc.gov.ng, to create the impression that they were government websites. However, these domains were not part of the Nigerian government .gov.ng namespace and were controlled outside that government namespace. One of the fake domains had been registered only on September 16, the same day the scam began receiving wider attention.
Experts believe that the scam uses a sophisticated phishing technique known as Adversary-in-the-Middle (AiTM), also called a Real-Time Phishing Relay. This technique allows scammers to capture and relay victims' information and OTPs during a live transaction, making it possible for a ₦5,000 fine to turn into a ₦1.8 million heist.
Key points
- The FRSC has warned motorists about fake websites being used to collect personal and financial information.
- Victims have reported losing large sums of money, including ₦1.8 million, ₦400,000, and $2,500.
- The scam involves fake FRSC websites and spoofed domain names designed to trick motorists into paying fines.
