THE Nigeria Financial Intelligence Unit (NFIU) has uncovered an emerging crowdfunding network being exploited to raise and channel funds for terrorist operations, while also exposing increasingly sophisticated methods being used by terrorist financiers to conceal the identities of beneficiaries and move illicit funds through Nigeria’s financial system.
News Point Nigeria reports that the agency said terrorist financiers were opening bank accounts in women’s names, as well as using telephone numbers for mobile banking or account alerts that were not registered to the account holders or the actual beneficiaries of the accounts.
The disclosures are contained in the NFIU’s 2025 Annual Report, obtained by this newspaper from a top official, with the report detailing how foreign-based facilitators, social media platforms, proxy accounts, remittance channels and mobile banking systems are allegedly being exploited to finance terrorist operations.
According to the report, the emerging crowdfunding scheme involves foreign-based facilitators using social media platforms to solicit donations under the guise of humanitarian relief or educational support before moving the funds through multiple layers to terrorist operatives in Nigeria.
The NFIU said hundreds of sympathisers were typically encouraged to make relatively small donations, ranging from $50 to $500, through PayPal pages or conventional bank accounts, with the amounts deliberately kept low enough to evade automated anti-money laundering alerts.
“The following is a case study on Crowdfunding Network identified during the year: A foreign-based facilitator runs social-media campaigns claiming humanitarian relief or educational support and uses encrypted apps (Telegram, Signal) to share links to convincing PayPal pages or standard bank accounts.
“Hundreds of sympathiser donors contribute $50–$500 each, amounts small enough to avoid most automated AML alerts,” the report read.
The funds are subsequently pooled into a “master account” controlled by a senior member of the group living legally abroad.
“When the pool reaches a threshold, that account becomes the hub for onward movement,” the report stated.
The NFIU said the funds were then fragmented into dozens of smaller payments and transferred through International Money Transfer Operators and remittance applications to a network of money mules in Nigeria.
It identified students, small-business owners and relatives among those used as mules, noting that the strategy was designed to avoid reporting thresholds while obscuring the origin and destination of the funds.
“Rather than sending one large transfer, the senior member fractures the funds and sends dozens of sub-threshold payments through IMTOs and remittance apps to a network of money mules in Nigeria; students, small-business owners, or relatives, avoiding reporting triggers.
“Upon receipt, the money was either converted to cash, used to purchase dual-use items such as motorcycles, fertilisers and satellite internet equipment, or transferred through mobile banking channels to logistics managers and field operatives,” it added.
The report described the final stage as the “integration” of the funds into terrorist operational financing, indicating a structured process through which seemingly legitimate donations are transformed into resources available to terrorist networks and their field operatives.
The Unit also identified the use of gender-based proxy accounts as another emerging terrorist financing technique, with terrorists allegedly opening bank accounts in women’s names while male commanders or logistics managers secretly control them.
“Terrorist financiers are opening bank accounts in women’s names while male commanders and logistics managers secretly control them.
“They exploit cultural norms that make women less likely to be suspected by authorities, using wives, sisters, or female associates as fronts to distance illicit funds from the true operatives.
“This tactic functions as identity laundering: women’s accounts are managed by men who hold ATM cards, mobile-banking credentials, and PINs, while the women often remain unaware of the transactions and volumes,” the report stated.
The report further revealed that terrorist facilitators were using telephone numbers that were not registered to account holders or actual beneficiaries for mobile banking and transaction alerts.
It said pre-registered SIM cards, numbers registered to deceased persons and SIMs linked to gender-based proxies were being used to break the connection between bank accounts, SIM cards and Bank Verification Numbers.
“Terrorist facilitators use phone numbers for mobile banking or account alerts that are not registered to the account holder or the true beneficiary.
“They bypass the security link between SIM cards and BVNs by using pre-registered SIMs, SIMs registered to deceased people, or SIMs tied to gender-based proxies. This severs the audit trail: when a transaction is flagged, investigators trace the phone to an unrelated person, letting the real facilitator stay anonymous and continue operations,” it stated.
The NFIU also uncovered sophisticated methods of disguising terrorist transactions through detailed or coded narrations.
It said cells, particularly those linked to the Islamic State West Africa Province, used precise transaction descriptions to maintain what analysts described as an internal accounting system.
According to the report, frequent logistics-related payments with detailed narrations were often sent from a single source to multiple recipients, reflecting a structured financial system within the terrorist network.
“Terrorist cells, particularly those linked to ISWAP, routinely use precise, professional-sounding transaction narrations to maintain internal accounting. Operating like ‘shadow states’ with strict bureaucratic controls, they require detailed descriptions so field commanders can justify expenses to central financial controllers.
“Although truthful narrations appear counterintuitive, they create an internal audit trail; analysts repeatedly observe high-frequency, logistics-related payments with accurate narrations sent from a single source to multiple recipients,” the report said.
However, the NFIU said some facilitators used innocuous words, secret codes and alphanumeric strings in transaction descriptions, sometimes switching between languages, to conceal the purpose of payments and evade automated bank filters.
“Transaction descriptions employ innocuous words, secret codes, or alphanumeric strings to conceal intent. Facilitators use this coded language, often switching languages to evade banks’ automated keyword filters that flag terms like ‘Jihad,’ ‘Arms,’ or ‘Boko.’
“This practice obscures the true purpose of transfers, preventing detection and enabling continued financing,” it said.
Fraud, Fintech Gaps, Public Funds Also Raise Concern
The NFIU said its risk and crime analysis during the year identified an increasingly interconnected threat landscape involving financial crime, technology and cross-border activity.
It noted that fraud remained a dominant predicate offence, with growing cases of Ponzi schemes, fraudulent crowdfunding arrangements, cryptocurrency-enabled investment scams and hacking-related fraud.
The Unit said the schemes increasingly exploited fintech onboarding gaps, including tiered accounts requiring minimal identification, while digital platforms were being used to rapidly recruit victims and move funds.
The report also highlighted persistent vulnerabilities in public-sector financial management, including the diversion of state and local government funds through accounts belonging to finance officers and associated third parties.
It identified procurement processes and cash transactions as significant risk areas, saying the latter complicated audit trails and efforts to trace illicit assets.
The NFIU said its findings were translated into targeted advisories, executive alerts and strategic intelligence products to support competent authorities, reporting entities and policy responses.
“Financial Fraud and Investment Scams: Fraud remains a dominant predicate offence, with notable growth in Ponzi schemes, fraudulent crowdfunding arrangements, cryptocurrency-enabled investment scams, and hacking-related fraud (including compromised social media and messaging accounts).
“Analytical reviews during the period examined these trends and informed internal advisories and alerts, some of which remained restricted for operational purposes.
“These schemes increasingly exploit fintech onboarding gaps, including tiered accounts with minimal identification requirements, and leverage digital platforms to rapidly scale victim recruitment and fund movement.
“Corruption and Misappropriation of Public Funds Analysis highlighted persistent vulnerabilities in public sector financial management, including the diversion of state and local government funds through accounts of finance officers and associated third parties.
“Procurement processes remain a significant risk area, while utilisation of cash transactions complicates audit trails and asset tracing efforts,” the report said.