From identity verification to identity protection: what Nigeria needs next

Over the past decade, Nigeria has built some of the most widely used identity infrastructure in Africa. The BVN arrived in 2014. Tens of millions of people now have a NIN, and linking NINs to SIM cards brought millions more into the system. Today, a bank or fintech can confirm who you are in seconds.

That is a real achievement. But verification answers only one question: is this identity real? It doesn't answer the question that matters most to the person who owns it: is this really me?

In our first article we described the visibility gap, and in the second we walked through what happens during a check. This article looks ahead.

Verification protects institutions. Protection needs the owner.

Verification was designed to help institutions meet know-your-customer rules and reduce their risk. It does that well. But when fraud happens, the costs often land on the individual: a loan they never took, a frozen account, a damaged credit history, months spent proving they weren't involved.

The person best placed to spot misuse of an identity is the person it belongs to. Yet in most of today's systems, they're the only one who isn't told.

Five principles for identity protection

We think the next stage should rest on five principles.

1. The owner is told. When an identity is checked for something significant, such as a new account, a loan or a SIM change, the owner should be able to find out quickly, through a channel they control. Not every routine check needs an alert, but the ones that create obligations in your name do.

2. The owner can object, and someone listens. An alert without a response is just anxiety. There should be a simple way to say "this wasn't me", and that answer should reach the institution in time to stop the account or loan, with a clear process for what happens next.

3. The owner can say "not now". People who aren't applying for anything should be able to lock their identity against new accounts, and unlock it for a specific institution when they need to. Credit freezes work this way in other countries; Nigerians deserve the same control.

4. Privacy by design. Protection must not become another database of sensitive information. Identity numbers should be stored encrypted, shared as little as possible, and handled in ways that stop organisations linking a person across companies. Telling the owner about a check should never mean telling more people about the owner.

5. Shared responsibility, shared benefit. Institutions gain too. A "not me" reported in minutes is cheaper than a fraud investigation months later, and an owner's "this was me" is strong evidence that an application is genuine. Protection should make good institutions look better, not add friction.

What it will take

None of this happens through a single app. It needs:

• Institutions willing to connect. Banks, lenders, fintechs and verification providers choosing to share check events with the owner, in a privacy-preserving way.
• Clear rules and recourse. Consistent expectations on how quickly a dispute is acknowledged and what an owner can expect, building on the rights the Data Protection Act 2023 already gives people over their data.
• Trust in the channel. Alerts only work if people believe them, so they must be easy to tell apart from phishing: no requests for codes or passwords, ever.
• Reach beyond smartphones. Protection should work for people on basic phones too, through SMS, voice and USSD, not only through apps.

Where Verath fits

This is the future we're building towards at Verath. Our first product puts the first three principles into practice: when an institution connected to Verath checks your NIN or BVN, you're alerted. You can answer "This was me" or "Not me", and a "Not me" opens a dispute with that institution. You can also lock your identity so connected institutions that check locks need your approval for new accounts. It's built with the fourth principle at its core: numbers are encrypted, and institutions never see who an alert went to.

We're in an invite-only pilot, and coverage grows with every institution that connects. That last principle, shared responsibility, is the part we can't do alone.

An invitation

If you work at a bank, fintech, lender or verification provider, we'd like to hear from you, whether to connect, to challenge our approach, or to help shape how owner-confirmed signals should work in Nigeria. And if you simply want to know whenever your identity is used, join the waitlist.

Nigeria has built the foundations of verification. Now we can build protection on top of them, with the owner in the loop.