Fake NCC device-verification portals such as verifymydevice.ng phish Nigerians for bank details and OTPs
MalwareTips reported on 1 November 2026, citing an NCC-CSIRT advisory, that fake NCC device-verification portals such as verifymydevice.ng ask Nigerians for bank details and OTPs. The NCC and its real service are not involved.
- First reported
- Reports
- 1
Source: malwaretips.com · published
What happened
MalwareTips reported on 1 November 2026 on a phishing campaign impersonating the Nigerian Communications Commission (NCC) and its legitimate device-verification service. It cites an advisory from the NCC's computer security incident response team (NCC-CSIRT), which says that lookalike websites copy the regulator's logos and page design, then ask visitors for banking information and one-time passwords (OTPs) and demand payments for services that do not exist. The domains named in the advisory are secure-verifymydevice.ng, verifymydevice.com.ng, embed-ncc.registrmydevice.ng and verifymydevice.ng. The NCC and its real device-verification service are not involved: MalwareTips says the warning concerns the fraudulent portals, not the genuine programme.
How the scam works
According to MalwareTips, the scam uses a real task as cover. Someone who expects to check a phone is more willing to cooperate, and a familiar logo gives the page authority. The lookalike addresses include words such as secure, verify, device or NCC so that they fit the task, but those words do not give the site any right to speak for the regulator. After the first step the form can add requests one at a time, such as bank details, a payment for the “verification” and an OTP sent by a bank or another service, and each request feels easier to accept once the visitor has decided the service is official.
MalwareTips notes that entering an OTP on such a page can help an attacker authorise a login, a transaction or an account change somewhere else, and that HTTPS on the page does not mean the regulator operates it, because a connection can be encrypted while the party receiving the data is an attacker. It also says the advisory does not establish that every visitor suffered the same compromise: which accounts need attention depends on what was entered and what was approved.
Its advice is not to enter bank details, OTPs or payments on these sites and to follow the NCC's own published instructions for device checks. A real device check does not ask for banking details, and an OTP should never be typed into a page you reached by a link.
Source
MalwareTips, “NCC Device Verification Scam: Fake Portals Ask for Bank Details and OTPs”, 1 November 2026, citing an NCC-CSIRT advisory.
Red flags
- A device-verification site on an address not published by the NCC, such as verifymydevice.ng or secure-verifymydevice.ng.
- A form that asks for bank details or one-time passwords during a phone check.
- A payment demanded for a supposed verification service.
- Copied NCC logos on a page whose address does not match the regulator's.
- A deadline or warning that pushes you to finish before checking the instructions.
If you were targeted
- 1Do not enter bank details, OTPs or payments on any of the sites named in the NCC-CSIRT advisory.
- 2Follow the NCC's own published instructions for device checks, reached by typing its address yourself.
- 3Never share an OTP with a website or caller, whatever the reason given.
- 4If you entered bank details or an OTP, call your bank at once and change your passwords and PINs.
- 5Report phishing portals to the NCC and your bank.