Fintech expert weighs in on the CBN’s plans to combat PoS fraud in Nigeria

Few technologies have had as much impact on Nigeria’s financial system as point-of-sale (PoS) terminals.

In a bid to drive financial inclusion in the country, the Central Bank of Nigeria (CBN) turned to agent banking and PoS systems in 2013. With bank branches unable to adequately serve the growing population, PoS agents were mandated to provide last-mile financial services to the populace.

The initiative has been largely successful, with more than 1.8 million agents in the country as of 2022. It has also gone beyond providing financial services, with thousands of jobs created and birthing companies like Moniepoint, OPay, and PalmPay.

But this progress hasn’t come without its challenges.

PoS fraud on the rise 

PoS fraud has been on the rise in the last decade. There were nearly 2,000 reported cases of PoS fraud in Q2 2023, valued at ₦428 million ($555,844), although this was a reduction from the ₦450 million lost in the previous quarter.

While financial institutions combat PoS fraud in a variety of ways, there has been a clamour for industry-wide collaboration against fraud.

Recent reports have suggested that the Nigerian Electronic Fraud Forum (NeFF), the Association of Mobile Money and Banking Agents of Nigeria (AMMBAN), and the Nigeria Inter-Bank Settlement System (NIBSS) are collaborating on a plan to combat fraud in the country.

Expected to go into force by the end of Q1 2024, it includes a plan to recertify all PoS terminals in the country and provide them with unique terminal identification numbers. Currently, PoS terminals are not certified individually. Rather, specific device types are certified and then used as a touchpoint for the exact device types offered by a provider.

Furthermore, PoS operators may be required to request KYC documents to approve certain transactions, while PoS terminals would be geo-fenced.

Existing mechanisms for combating PoS fraud 

While Zainab Abu, Head of Merchant Business at Nigerian fintech, Hydrogen, acknowledges the prevalence of PoS fraud in Nigeria, she explains that most PoS terminals in the country use Europay, Mastercard, and Visa (EMV) chip cards rather than magnetic stripe cards.

This ensures that card details are not easily tampered with. Others also use tamper-proof terminals that automatically wipe data when PoS terminals are tampered with.

However, she welcomes the recertification of PoS terminals, which she says will ensure the harmonisation of standards for all stakeholders.

“From a merchant perspective, it would ensure that merchants have quality devices, and that would in turn ensure that the customer experience is a good one because there might have been instances where terminals find their way into circulation without having the proper certification done,” she said.

With more than 1.8 million PoS terminals in the country, the proposed six-month timeline for the recertification process may be hard to pull off. However, Abu points out that the CBN may be able to pull it off if necessary arrangements are made.

“It’s a change management process, so it has to be properly managed so that everyone is carried along and everyone’s on the same page. There’s going to be a learning curve with new processes and new features being introduced, and you might make mistakes.”

So far, there has been no official communication from all parties involved in this plan regarding the recertification of PoS terminals. However, Abu expects it to take the same form that has been employed in the past and expects a few hiccups.

“If we go with that same process flow, then it should not have a significant impact in terms of disruptions to a merchant’s business. If a cutoff time is given, then it’s really just for all parties involved to ensure that the recertification is concluded before the cutoff time,” she argued.

Geofencing PoS terminals could affect business models 

The second aspect of the plan to combat fraud will involve geofencing PoS terminals, and Abu explains that certain businesses may have to make adjustments to their business models or processes.

Geofencing is a cybersecurity feature that sets virtual boundaries for devices. If a device with this software feature leaves the environment it has been tagged to, a trigger is set off, alerting relevant parties. 

Today, PoS terminals can be used in any location, regardless of where they were acquired or registered. But should they be geofenced, their operations would be restricted.

On the surface, geofencing would help relevant authorities identify the specific regions or terminals responsible for PoS frauds. However, Abu points out that it would be useless without adequate and responsive enforcement protocols.

“If you look at businesses in the transportation or logistics sector, this could have a negative impact because, from day one, you are not able to tell where your devices will end up. It would adversely affect their business models because people that want to pay on delivery are no longer able to pay because the POS has most likely left its geo-fenced location.”