Did you know there was a time when different bank cards had different number lengths? Or that banks were customising their own cards with all sorts of funny features? Yes, it was done in good faith, and that era came with many new products and so-called innovations. I know some OGs here will remember the gymnastics banks were doing during that period.

It was a chaotic time. It felt like the banks were in a fierce card design war. But in the middle of all that noise, there was one major Nigerian card issuer behind the scenes. Yes, Mastercard and Visa were already around, and some banks even adopted Amex. But that’s not the story I want to share today.

What I really want to talk about is how fraudsters took advantage of cards that had only magnetic stripes.

So, how does a magnetic stripe card work? It stores card information on the stripe. And funny enough, the machine used to read and write this information onto any card could be bought online and delivered to Nigeria.

Oya, follow me.

Fraudsters were always looking for clever ways to steal people’s ATM PINs and card details. Once they had the information, they would write it onto a blank card with just a magnetic stripe. Then they would head to the ATM, and the withdrawals would begin.

Banks did their best to educate customers not to share their PINs, but to be honest, the scammers were smarter.

Here’s the bigger trick they used. Fraudsters would clone the websites of well-known companies. They only needed to tweak the web address a little, for example turning it into something like www.bigfirmreward.com. Then they would send bulk SMS messages using the real name of the company. That’s actually one of the reasons the NCC introduced the DND policy. I’ll talk more about that and how it affected businesses in one of my other series.

These messages would include a link that claimed the company was giving out rewards as part of its CSR programme or something along those lines.

Innocent people would visit the fake site, see the familiar colours and branding, and think it was genuine. They would then fill in their usual details, thinking they were about to receive a reward. And here comes the twist. They would be asked to enter all their card details, including the PIN, because that’s supposedly how the reward would be sent.

You can already guess what happened next.

The fraudsters would take that information, print it onto a blank magnetic stripe card, and walk into any ATM. While the victim waited for a reward alert, they would start getting withdrawal notifications.

The problem became so widespread that banks began reporting jammed ATMs filled with blank cards. It was a nightmare.

The Central Bank of Nigeria understood that the real problem wasn’t the ATM technology itself, but the ease with which anyone could produce cards. So they decided to step in. The CBN told banks to focus on their core job of keeping money safe and handed over card production to licensed card-issuing companies. These companies were then placed under much stricter regulation.

So, what has changed?

Now, all cards are required to have a chip. Chip cards, also known as EMV cards, are difficult for the average person to duplicate because they come with advanced security features that go far beyond the simple magnetic stripe.

Today, you can see the difference in the financial space. We now have only three common types of cards in Nigeria, or at least those are the ones I’m aware of. One of them even has a longer number than the other two.

If you’re building a fintech product, you’ll notice that you can charge two of the card types using a single API, but for the third one, you’ll need to work with the issuer separately. That’s another conversation for another day.

To everyone reading this, take your lessons. Sometimes technology created to solve problems ends up causing new ones that regulations must fix with yet more technology. Wahala! 🤣

Please help me share this post with your friends. You never know who might find this information helpful.