NFIU Report Exposes Female Proxies and Digital Schemes in Terror Financing
By Patience Ikpeme
Terrorist groups operating across Nigeria have adopted increasingly sophisticated financial tactics, using female proxies, disconnected mobile phone lines, and corporate-style bookkeeping to move illicit funds under the radar of law enforcement.
According to the 2025 Annual Report of the Nigerian Financial Intelligence Unit, terrorist financiers are deliberately exploiting cultural norms to evade scrutiny by opening bank accounts in the names of women, which are then covertly operated by male operatives.
The report reveals that this method functions as a form of identity laundering. Male commanders and logistics managers retain control of the accounts through ATM cards, mobile-banking credentials, and personal identification numbers, while the female account holders—often wives, sisters, or associates—frequently remain completely unaware of the transaction volumes passing through their names.
Investigators also identified a systemic gap in mobile banking security, noting that facilitators routinely link bank accounts to phone numbers that belong neither to the registered account holder nor the ultimate beneficiary.
By utilizing pre-registered SIM cards, lines belonging to deceased individuals, or numbers tied to female proxies, syndicates effectively sever the audit trail. When suspicious transactions are flagged, investigative trails lead to unrelated third parties, leaving the actual operators free to continue their activities.
In a surprisingly structured operational shift, terrorist networks, particularly those affiliated with the Islamic State West Africa Province, have instituted rigorous internal accounting practices. The intelligence agency noted that these cells function like shadow states with strict bureaucratic controls, requiring field commanders to input precise, professional-sounding transaction descriptions to justify expenses to central financial controllers.
While accurate narrations might seem counterintuitive for criminal enterprises, the unit observed that these precise descriptions serve as an internal audit trail. Financial analysts regularly detect high-frequency, logistics-related payments originating from single sources and dispersing to multiple recipients, accompanied by clear operational descriptions.
To bypass automated bank filters designed to detect terms associated with terrorism and weapons, facilitators frequently mix standard transaction notes with innocuous code words, alphanumeric strings, or alternating local languages. This strategy effectively masks the true intent of the transfers and neutralizes automated keyword monitoring systems.
The intelligence report further detailed a dynamic four-phase international crowdfunding scheme used to siphon money directly into operational cells.
The process begins with a foreign-based facilitator launching social media drives under the guise of humanitarian relief or educational causes, directing sympathizers on encrypted platforms to PayPal pages or standard bank accounts. Small donations, typically ranging between fifty and five hundred dollars, are collected to prevent standard anti-money laundering threshold alerts.
These small contributions are subsequently pooled into a consolidated master account controlled by a senior member residing legally abroad. Once a substantial balance is accumulated, the funds are fractured into smaller amounts and sent into Nigeria through international money transfer operators and digital remittance applications.
By routing these transfers to network mules—comprising students, small business owners, and relatives—the syndicates avoid mandatory reporting triggers.
Once inside the domestic banking system, the mules withdraw cash or purchase dual-use goods, including motorcycles, fertilizers, and satellite internet equipment, before transferring the remaining balances to field managers to complete the financial integration cycle.
