Olufemi Ajayi
When Rita Markenny Egba publicly alleged that approximately ₦3 million was withdrawn from her Access Bank account through USSD transactions between October and December 2025 while she was living in Dubai, the dispute appeared at first glance to be another digital-fraud complaint. But on a deeper examination, the matter has evolved into something far larger: a test of whether Nigeria’s telecommunications and financial sectors have properly adapted to a world in which a mobile phone number is no longer merely a communications tool but a critical element of personal identity and financial authentication. The bank has since commenced investigations into the fraud, and according to records currently under review, the customer’s registered mobile number that was linked to her account was reassigned to another user by her telecommunications provider while she was in Dubai – before the disputed transactions occurred. With her line reallocated to another user, Ms Egba was no longer receiving transaction notifications on her account. It’s even possible that those notifications were now accessible to the new assignee of the phone line which implies that Ms Egba was unaware of the withdrawals on her accounts.
But the central question is not whether the telecom operator committed wrongdoing in allocating her phone line to another user. No documentary evidence currently available establishes that conclusion. Rather, the question is this: When a mobile number has become a financial identity credential, what duty does a telecom operator have to ensure that reassigning that number does not expose a former subscriber’s bank account, digital identity; personal information or authentication mechanisms to a new user?
That question extends far beyond one customer, one bank or one telecom operator.
Mobile Numbers Are No Longer Just Telephone Numbers. For decades, telecom regulators treated telephone numbers as finite network resources. Operators assign them, manage them and eventually recycle them when customers abandon them.
But the function of a mobile number has changed dramatically. Today, a Nigerian phone number may be linked to Bank accounts; Bank Verification Number (BVN); National Identity Numbers (NINs); Mobile banking profiles; USSD banking services; One-time passwords (OTPs); E-mail recovery systems; Social-media accounts; Government services; and Digital-wallet platforms.
The Nigerian Communications Commission (NCC) has itself recognized this evolution, noting that mobile numbers now underpin financial transactions and digital authentication across multiple sectors. Recent NCC initiatives, including the Telecom Identity Risk Management System (TIRMS), were specifically introduced because recycled, reassigned and swapped numbers have become recognized vectors for fraud and identity theft. That makes the lifecycle of a mobile number a matter of financial security rather than merely telecommunications administration.
Unlike banking credentials, telephone numbers are not controlled by banks.
The NCC allocates numbering resources and regulates their use, while telecom operators manage subscriber numbers throughout their lifecycle. According to reports describing the NCC’s Telecom Identity Risk Management Policy, mobile lines that remain inactive may eventually be deactivated and become eligible for reassignment by network operators.
Reports on the policy indicate that a number may be classified as inactive after prolonged non-use and subsequently entered into a recycling process, eventually allowing reassignment to a new subscriber.
That means telecom operators possess records showing: When a line became inactive; when it was deactivated; when it entered any recycling or quarantine process; when it was reassigned; and to whom it was reassigned through Know Your Customer (KYC) procedures. Determining whether those processes were followed in the Egba case will be central to understanding how the disputed transactions became possible.
The Questions Telecom Records Must Answer
At the heart of this controversy are several factual questions that only the telecom operator’s records can conclusively answer. Among them: Was the customer notified?
One critical issue is whether the former subscriber received advance notification that the number would be deactivated or reassigned. Recent NCC proposals have contemplated mandatory notifications before reassignment, recognizing the risks associated with recycled numbers. Proposed amendments discussed by the regulator would require telecom operators to notify subscribers through alternative contact channels before reassignment. Whether such notification occurred in this case remains unclear.
What inactivity period applied?
Another important question concerns the applicable period of inactivity before recycling.
Publicly reported NCC frameworks have referenced inactivity thresholds and recycling timelines tied to the telecom identity risk management regime.
Investigators will likely need to establish: Whether those timelines applied; whether the line qualified for reassignment; whether all regulatory conditions were satisfied; and whether the reassignment occurred in accordance with the rules then in force.
Who received the number?
The telecom operator would also possess records showing the identity of the new subscriber; documents used for registration; NIN verification records; Registration dates; and Audit trails establishing ownership transitions. Without such records, determining who controlled the number during the disputed period becomes significantly more difficult.
The Missing Link between Telecoms and Banking
Even if a number is legitimately reassigned, another challenge emerges.
How are banks supposed to know?
Historically, telecom operators and financial institutions have operated separate databases.
A number may be disconnected by a telecom company while simultaneously remaining the registered banking contact number for transaction alerts; Password resets; USSD access; Transaction authorizations; and Mobile applications.
This disconnect is precisely the risk NCC’s newer cross-sector initiatives were designed to address. The regulator has proposed and developed platforms intended to allow telecom operators, financial institutions and regulators to share information regarding recycled numbers. The fact that such systems are now being introduced suggests regulators recognize a longstanding gap.
Could a Recycled Number Still Receive Financial Messages?
Cyber security specialists have repeatedly warned that recycled numbers can continue receiving communications intended for former owners.
This can occur when Banks are not informed that ownership has changed; Customers fail to update account information; Third-party digital platforms retain outdated contact records; or Authentication systems continue treating the number as a trusted credential.
Industry reports examining SIM recycling in Nigeria have identified ongoing risks involving banking alerts, OTPs, digital identities and account recovery systems that remain attached to recycled numbers. Whether any of these vulnerabilities were exploited in the Egba matter remains a question for investigators rather than journalists.
Responsibilities Beyond the Telecom Operator
Although telecom operators are likely to face scrutiny because they control number reassignment, responsibility does not automatically rest with them alone.
*Customers*
Customers have obligations to:
• Maintain active lines linked to financial services;
• Update contact information when numbers change;
• Monitor account activity; and
• Promptly report suspicious transactions.
Banks
Banks also carry significant responsibilities.
Financial institutions determine:
• How USSD services are secured;
• What authentication mechanisms are required;
• Whether dormant-risk indicators exist;
• How account alerts are generated; and
• How unusual transaction patterns are detected.
Where warnings or safeguards were available but not triggered, regulators may seek explanations from banks as well.
Regulators
The NCC regulates numbering resources and telecom operators.
The Central Bank of Nigeria regulates payment systems and financial institutions.
Where a fraud scenario crosses both sectors, effective consumer protection depends on coordination between the two regulatory frameworks.
What Investigators Need to Establish
Law-enforcement agencies and regulators will likely seek answers to several unresolved questions:
1. Was the number actually reassigned before the disputed transactions?
2. If so, when precisely did reassignment occur?
3. Was the former subscriber notified?
4. What KYC documentation was used to register the new subscriber?
5. Did the operator maintain a complete ownership audit trail?
6. Was any bank or financial institution informed of the changes?
7. Did USSD authentication rely primarily on possession of the reassigned number?
8. What records identify the subscriber controlling the number during the disputed period?
9. Were transaction alerts or authentication messages delivered to the recycled line?
10. Were any regulatory requirements breached?
At present, many of these questions remain unanswered publicly.
A Systemic Issue, Not Just One Dispute
The broader policy concern extends well beyond this individual case.
Across Nigeria’s increasingly digital economy, millions of phone numbers are connected to financial and identity systems. Industry discussions, legislative proposals and NCC initiatives in 2025 and 2026 demonstrate growing concern about the risks created when recycled numbers remain linked to previous owners’ financial lives.
The traditional telecom view treats a phone number as a reusable network resource.
The modern digital-economy treats that same number as an identity credential.
The tension between those two realities sits at the heart of the problem.
The Reforms Now Being Considered
Experts in telecommunications regulation, cybersecurity and consumer protection increasingly advocate reforms that address the entire lifecycle of mobile numbers.
Among the most frequently proposed measures are:
• Advance churn notifications before deactivation or reassignment;
• Mandatory cross-sector recycled-number databases accessible to banks, fintechs and regulators;
• Immediate notification to financial institutions when ownership changes;
• Mandatory cooling-off periods before recycled numbers can access banking services;
• Enhanced KYC and audit-trail requirements for reassigned numbers;
• Real-time recycled-number verification services for banks and fintechs;
• Automated delinking procedures for banking and authentication systems; and
• Stronger customer education regarding the risks of abandoned numbers.
Notably, several of these concepts have already appeared in NCC policy discussions and TIRMS-related initiatives.
*The Unanswered Question*
The dispute involving Rita Markenny Egba may ultimately be resolved by investigators, regulators, courts or the institutions involved. The facts remain under examination, and no conclusion should be drawn before the relevant evidence is reviewed.
Regardless of the outcome, the case exposes a pressing issue for Nigeria’s digital economy.
If a phone number has become the key that unlocks banking, payments, identity verification and digital services, can telecom operators continue to manage number recycling as if those numbers were merely communications assets?
Or must the industry, regulators, banks and consumers begin treating telephone numbers for what they have become: critical financial identities whose transfer from one person to another carries risks far beyond making a phone call?
Ajayi, a cyber security analyst, lives in Abuja
