Kano Bankers Accused of Selling Customer Data to Loan Sharks
Knotted Post has received allegations that staff at some Kano banking points secretly record customer interactions and pass identifiable details to informal lenders. This exclusive investigation examines the claim that bankers are selling data to loan sharks, using ordinary calls and transaction histories to build lists for coercive debt collection.
The allegations concern individual conduct rather than a proven industry-wide system, and no specific bank is named as operating a formal data-selling scheme. The unresolved question is whether sensitive customer information moved into an undisclosed arrangement and who benefited.
What the exclusive allegations describe
Accounts reviewed by Knotted Post describe an alleged sequence: a customer mentions a loan, salary advance or money problem; an employee keeps an unofficial audio clip; names, phone numbers, occupation and location are copied into a shared list; a collector receives the list and contacts the customer with a false or inflated debt.
Such a list would turn fragments that a customer disclosed in confidence into commercial intelligence. A home address or employer can support a convincing impersonation, while salary information lets collectors time pressure around payday or claim they know where the customer works.
The allegation remains an allegation, not a judicial finding. It requires scrutiny of original audio, transfer logs, staff devices, payment records and the accounts of collectors who bought the material. Because no individual institution has been named, this report avoids presenting suspicion as proof.
How customer records reach informal lenders
Call audio is only one layer of the alleged data trade. Staff may also know which accounts receive salary credits, which transfers are repeated and when a customer appears short of cash. Combined with phone numbers and workplace details, those signals can become a credit-scoring profile for an illegal lender.
The value to collectors lies in speed. A verified prospect can be called before applying for a conventional loan, offered an advance at a punitive rate, or shown a fabricated statement tied to a real balance. A customer who refuses may then face repeated calls, threats and pressure directed at relatives.
Once a name enters such a network, resale is easy. One contact may forward a spreadsheet to another agent, who adds complaints or screenshots and passes the expanded file onward. The originating bank employee may disappear from the trail, leaving the customer unable to establish where the disclosure began or which consent, if any, covered it.
The harm extends beyond a privacy breach
The immediate injury is not abstract data exposure; it is fear. Customers who receive calls quoting accurate details may believe their accounts, families or workplaces are under surveillance. Some may borrow again to silence the first lender, creating debt on top of the disputed amount.
Informal lenders often blur collection and intimidation. A caller may impersonate a bank officer, police official or court process, invent bailiff fees, or publish a debtor’s picture in a private messaging group. Nigeria’s WhatsApp-heavy communication environment allows these threats to spread quickly and cheaply.
Traders, civil servants, students and small businesses can lose income, workplace trust and sleep to the harassment. Voice samples may also be reused for impersonation, while a leaked customer list exposes relationships that extend beyond the original borrower. The commercial gain for data sellers can therefore dwarf the price paid for a single record.
Comparing safeguards and oversight
Under Nigeria’s Data Protection Act 2023, the processing of identifiable information is tied to lawful basis, transparency and purpose limitation. A bank may record calls for service quality, fraud prevention or dispute resolution when it tells customers and limits how the material is used. Secretly repurposing those records for debt targeting would require a separate assessment of consent, necessity and third-party disclosure.
Supervision should not stop at the privacy regulator. The Nigeria Data Protection Commission can examine data handling; the Nigeria Deposit Insurance Corporation can help establish which deposit institution was involved; and the Central Bank of Nigeria and police can examine governance, suspected fraud or extortion. A credible response needs evidence-sharing among those bodies without exposing complainants.
| Issue | Alleged Kano practice | Australian baseline |
|---|---|---|
| Call recordings | Unofficial clips and copied customer details used for targeting | Privacy law permits necessary recording in some circumstances when collection is transparent and reuse is proportionate |
| Secondary disclosure | Customer lists allegedly sold to informal collectors | APP 6 generally limits third-party disclosure without consent or a permitted legal basis |
| Debt collection | Coercive calls, false balances and threats to relatives | Debt collectors and credit reporters operate under licensing, conduct and complaint rules |
| Remedies | Internal complaints, regulator review and police reporting | Bank disputes, AFCA or IDR, privacy complaints to OAIC, and police for fraud |
The contrast is instructive, but it is not a shortcut to guilt. Australia’s framework does not prevent every misuse; it gives customers, watchdogs and courts defined routes for testing and redress. Kano’s response should be equally concrete: disclose the recording policy, investigate access logs, suspend implicated accounts and publish the outcome.
Lessons from Australian banking realities
Sydney and Melbourne are major Australian banking centres and home to sizable Nigerian communities whose members may send remittances through banks or licensed transfer services. Their daily banking is increasingly cashless, with salary deposits, card payments and transfers visible through mobile apps. That convenience also means a convincing call can exploit detailed transaction knowledge without an in-branch visit.
Australian institutions have built controls around this environment. The Office of the Australian Information Commissioner oversees how most large financial institutions handle personal information under the Privacy Act and Australian Privacy Principles, while ASIC supervises banks, credit reporters and other covered businesses. Call-back through the official app, rather than a number supplied by a caller, is a useful defence against spoofing.
AFP and Scamwatch warnings about authorised push-payment scams have made bank staff and digital-payment habits familiar to Australian consumers. If a debt caller claims to know an account balance or employer, customers can end the call, open the bank app independently and request a verified case number. AFCA and an institution’s external dispute-resolution scheme provide further routes when credit-reporting or financial-services complaints remain unresolved.
Australian consumers also encounter heavily promoted offshore betting offers online. An online casino deposit bonus can look valuable, yet its real terms sit in eligibility, expiry and wagering conditions. This is separate from the Kano case, but the principle carries over: hidden conditions can turn an apparent offer into a source of financial risk.
Reporting abuse and verifying suspicious calls
A customer approached through an alleged leak has several immediate options. Do not confirm a disputed balance, transfer a “verification” payment or meet a supposed collector in a secluded place. Record the number where lawful, keep messages and call records unaltered, and contact the bank through its official app or website rather than details supplied by the caller.
In Nigeria, a complaint to the named bank’s data-protection or compliance officer can trigger an internal preservation order and access review. Serious threats, impersonation of police, forged documents or extortion can also be reported to the police, while data-processing concerns can be sent to the NDPC. A complainant should retain copies of every submission and reference number.
Australian customers facing an equivalent impersonation can report fraud to their bank and seek guidance from Scamwatch. Credit-reporting or financial-services disputes may go to AFCA or the relevant external dispute-resolution scheme, while privacy complaints can be directed to the OAIC. The distinctions matter because one agency may restore money while another investigates data misuse.
Building a credible path to accountability
An independent review should begin with the evidence chain. Investigators need to compare official recording systems with unofficial files, examine whether staff accounts exported customer ledgers, and test whether identified collectors received payments or leads. Audio should be authenticated, access logs preserved and witnesses protected from retaliation.
Banks should provide customers with a plain-language recording notice and a route to challenge the purpose of collection. Regulators need a confidential whistleblower channel, a public enforcement timetable and statistics on complaints involving call recordings. Those measures would make misuse harder and help separate isolated misconduct from an institutional practice.
Readers with verifiable evidence should preserve original messages and files, avoid editing metadata, and send redacted copies through an official NDPC, police or secure newsroom channel. Share this investigation only through channels that protect complainants, and press the relevant institutions to publish a documented response.