How an Illegal Website Was Exposed Selling Nigerians’ NIN Data for ₦150

An unlicensed website, nimcverify.ng, is offering Nigerians’ sensitive National Identification Number (NIN) details to anyone for as little as ₦150, despite having no official link to the National Identity Management Commission (NIMC).

An investigation by the Foundation for Investigative Journalism (FIJ) revealed that the privately run platform, operated under the name Timzytech Developers, allows users to retrieve another person’s NIN record using only their phone number. Payments can be made either to a unique account generated for each buyer or directly to the administrator’s account. The site also advertises unauthorised services such as NIN modification, Bank Verification Number (BVN) retrieval, and other identity alterations, with charges ranging from ₦150 to ₦280.

FIJ tested the platform using phone numbers of three consenting journalists, and it successfully produced their NIN slips — despite nimcverify.ng not appearing on NIMC’s list of licensed verification partners, which includes only approved banks, telecom companies, and other authorised entities.

Domain records show that the website nimcverify.name.ng was registered on May 22, 2025, and is set to expire in May 2026. The registration, done via Kenya-based Truehost Cloud, lists Nigeria as the registrant’s country but conceals the owner’s personal details under privacy protection. The site is hosted on Cloudoon’s infrastructure and remains active as of Tuesday.

This is the latest in a string of illegal data vending platforms in Nigeria. FIJ previously reported cases where NINs, BVNs, photographs, and other personal identifiers were openly sold online — with four complete identity profiles bought for just ₦560.

Experts warn that stolen identity details can be exploited for crimes such as fraud, unauthorised bank withdrawals, loan applications, phishing attacks, and social engineering scams. Victims may also face harassment, stalking, kidnapping, or reputational damage, and in some cases, could be blacklisted from banking systems.

Under the NIMC Act 2007, only the commission is authorised to maintain and share data from the National Identity Database. Accessing, selling, or using personal identity data without consent or lawful authority carries penalties of at least ₦1 million in fines and/or a minimum of three years in prison.

The Nigeria Data Protection Act 2023 also mandates that personal data be processed lawfully, fairly, and transparently. Breaches must be reported to the Nigeria Data Protection Commission within 72 hours, with non-compliance attracting fines of up to ₦10 million or 2% of a company’s annual revenue.

For now, nimcverify.ng continues to operate behind a wall of domain privacy, leaving Nigerians’ most sensitive personal data exposed to the highest bidder.