What actually happens when your NIN or BVN is verified?

A transaction that taught me something

Earlier this year I bought shares in a major Nigerian IPO through one of the authorised agents. The process was smooth. I handed over my NIN, my BVN and a list of personal details (right down to my mother's maiden name), and the agent completed the purchase. They even opened a bank account in my name with a partner bank to hold my leftover balance.

Everything was legitimate, and it worked. But afterwards, one thing stayed with me: nothing I control told me my identity had been used. No alert that my NIN had been checked. No notice that a new bank account now existed in my name. I knew only because I was the one who started it.

At one point I'd considered letting a family member handle the purchase for me. If I had, the first I'd have known was a message saying "done", with no real-time view of where my details went or what was opened with them. And if someone with bad intentions ever had those same details, they could use them to open an account, take a loan or do anything else a NIN or BVN allows. Any confirmation would go to their phone number and their email, not mine.

That experience is a big part of why Verath exists.

Why a check feels like nothing

Open a bank account, apply for a loan or register a SIM in Nigeria and, within seconds, someone checks your NIN or BVN. It happens so quickly that it feels like nothing happened at all. In fact, several organisations were involved, and some of them now hold information about you.

In our first article we asked a simple question: when was your identity last checked, by whom, and why? This article explains what a check actually is, so you know what to look out for and what to ask.

The people in the room

A typical identity check involves up to four parties:

• You, the person whose identity is being checked.
• The institution you're dealing with: a bank, fintech, digital lender, mobile network or government office.
• A verification provider in some cases. Many smaller companies don't connect to the national systems directly; they use a specialist company that does.
• The source of truth. For your NIN, that's the National Identity Management Commission (NIMC), which keeps the national identity database. For your BVN, it's the BVN system run by the Nigeria Inter-Bank Settlement System (NIBSS) for the banking industry.

What happens, step by step

1. You start something. You fill in a form or an app asks for your NIN or BVN, usually with your consent to check it.
2. The institution sends a request. Your number goes, directly or through a verification provider, to the relevant system.
3. The system replies. Depending on the type of check, the reply can confirm that the number exists and return details such as your name, date of birth, phone number and sometimes your photo.
4. The institution compares. They check the reply against what you entered, and may compare the photo with a selfie you take there and then.
5. A decision is made. The account is opened, the loan moves forward, or the institution asks for more information.

The whole thing can take a few seconds. And you'll usually only see step 5.

Who learns what

Every party in that chain learns something:

• The institution learns your verified details and keeps a record of the check, often for several years, because regulators require customer records to be kept.
• A verification provider, if one was used, may keep a log that a check happened and when.
• The national system typically keeps a record that your number was queried, and by which organisation.

None of this is wrong in itself. Records make fraud easier to investigate. But it means your identity leaves traces in several places, and most people never find out where.

Where it goes wrong

Fraud tends to slip in at step 1. If someone has your number and enough of your personal details, they can start an application pretending to be you. Steps 2 to 5 then work exactly as designed: the system confirms that the number is real and returns your details. The check succeeds. It just succeeds for the wrong person.

That's why a correct NIN or BVN alone isn't proof that you are the one applying, and why the extra steps (a selfie matched to your photo, a code sent to your phone) matter so much. It's also why stolen phone numbers and SIM swaps are so damaging: they defeat the codes.

What you agreed to

When you enter your NIN or BVN, you usually agree, often in a tick box, to the institution checking it for a stated purpose. Under Nigeria's Data Protection Act 2023, organisations need a lawful basis to process your personal data and must use it only for the purposes they told you about.

You also have rights. Among them, you can ask an organisation what personal data it holds about you and how it uses it, and ask for incorrect data to be corrected. The Nigeria Data Protection Commission (NDPC) oversees how organisations meet these obligations.

Ways to share less

You don't always have to hand over your full NIN. NIMC introduced the virtual NIN (vNIN): a temporary code, generated through NIMC's official channels, that you give to an organisation in place of your actual number. Where an organisation accepts it, it limits how widely your real NIN is spread. Use only NIMC's official app or channels to generate one, never a link someone sends you.

A few more habits help:

• Share your NIN or BVN only when you started the process, and only with the organisation you meant to deal with.
• Be wary of anyone asking for your NIN, BVN and a one-time code together. That combination is what fraudsters need.
• Treat answers like your mother's maiden name as secrets. Many banks still use them as security questions, so giving them away alongside your NIN and BVN hands over a key.
• Keep a simple note of where you've used your NIN or BVN recently. If something unfamiliar appears later, you'll know.

What was missing

Look again at the steps above. Every party learns something, except the person the check is about. You see the result of your own applications, but if someone else starts one in your name, nothing tells you.

That's the gap Verath is built to close. When a bank, lender or fintech connected to Verath checks your NIN or BVN, you get an alert, and you can answer "This was me" or "Not me" while it still matters. Verath is in an invite-only pilot, and alerts come from institutions connected to it, so coverage grows as more of them join.

In our next article we'll look ahead: what would it take for Nigeria to move from identity verification to identity protection?