The phenomenal rise of fintech in Nigeria has revolutionised access to credit, enabling millions to secure quick loans through mobile applications with minimal paperwork.
These loan apps have become a lifeline for many, particularly in a country where traditional banking services are often inaccessible to low-income individuals. However, this convenience comes with significant risks to user privacy and data security.
A particularly concerning practice is the creation of “ghost accounts” or “shadow profiles” for applicants whose loan requests are rejected.
These profiles, which contain sensitive personal data, are often retained and potentially misused without the applicants’ knowledge or consent.
Technext explores the phenomenon of ghost accounts in Nigerian loan apps, examining how these shadow profiles are created, their implications for rejected applicants, and the regulatory efforts to address these practices.
Loan apps in Nigeria and data collection practices
The proliferation of loan apps in Nigeria has been driven by the demand for accessible credit in a country where economic challenges, such as high unemployment and inflation, have left many citizens financially vulnerable.
According to a 2024 report, the number of approved digital lenders in Nigeria reached 320 by September, up from 284 in May, reflecting a surge in demand for quick loans. These apps offer loans with minimal documentation, often requiring only a smartphone and internet connection, making them an attractive option for individuals and small businesses.
Data collection by loan apps
To assess creditworthiness and manage risk, loan apps collect extensive personal data from applicants. This includes:
- Biometric Verification Number (BVN): A unique identifier linked to an individual’s bank accounts.
- National Identification Number (NIN): A government-issued ID number.
- Bank account details: For loan disbursement and repayment.
- Phone data: Access to contacts, call logs, location data, and sometimes photos or videos.
Several reports have detailed how apps like Branch, FairMoney, and Renmoney require BVN, employment details, and access to phone data to build credit scores. For approved applicants, this data facilitates loan processing and repayment monitoring. However, for those whose applications are rejected, the data collection does not necessarily cease.
Creation of shadow profiles
Many loan apps likely retain the personal information of rejected applicants, creating what can be termed “ghost accounts” or “shadow profiles.”
These profiles are digital records containing detailed personal data that may be used for purposes beyond the initial loan application, such as targeted advertising, future loan offers, or credit scoring.
While the term “ghost accounts” is not explicitly used in regulatory or investigative reports, the practice of retaining data is well-documented.
For instance, a 2021 Quartz Africa report noted that the National Information Technology Development Agency (NITDA) fined Soko Lending Company 10 million naira ($24,000) for abusing user data, including unauthorised disclosures.
Similarly, a 2022 report by S.P.A. Ajibade & Co revealed that some loan apps – in this case, Soko Loan – embed trackers to share data with third parties without user consent, violating the Nigerian Data Protection Regulation (NDPR).
The retention of rejected applicants’ data is often justified by loan apps as necessary for improving credit scoring models or for future marketing purposes. However, this practice raises significant ethical and legal concerns, particularly in a context where data protection laws are still evolving.
The NDPR, enacted in 2019, mandates that personal data be collected only for specified, explicit, and legitimate purposes and processed fairly and lawfully. Yet, many loan apps exploit loopholes, claiming that users consent to data collection by downloading the app and applying for a loan, even if the loan is not approved.
This consent is often buried in lengthy terms and conditions that users may not fully read or understand, leading to a lack of transparency and accountability.
Common data collected by Nigerian loan apps:
| Data Type | Purpose | Used for rejected applicants? |
| Biometric Verification Number (BVN) | Verify identity and bank details | Likely retained for credit scoring |
| National Identification Number (NIN) | Confirm identity | Likely retained for future use |
| Bank account details | Loan disbursement and repayment | Possibly retained for marketing |
| Phone contacts | Risk assessment and debt collection | May be used for unsolicited offers |
| Location data | Verify applicant’s location | Potentially shared with third parties |
| Call logs/photos | Additional risk profiling | Risk of unauthorised sharing |
The implications of shadow profiles for rejected applicants
Privacy and data misuse risks
The creation of shadow profiles poses significant risks to rejected applicants, many of whom are unaware that their data is being retained.
One major concern is data misuse, including identity theft, fraud, or unauthorised sharing with third parties. The S.P.A. Ajibade & Co. report highlighted how Soko Loans violated NDPR provisions. Such practices could expose rejected applicants to financial scams or other malicious activities.
Unsolicited marketing
Rejected applicants may receive unsolicited loan offers or advertisements based on their stored data. A 2024 PIJAlance Magazine article described how a user received unsolicited messages from the Alend loan app, despite never providing her details, suggesting that her data was obtained through questionable means. This invades privacy and perpetuates financial vulnerability, as rejected applicants may be repeatedly targeted despite ineligibility for loans.
There is also a BCC messaging format which agents of popular loan apps send to ill-got contacts.
Impact on credit scoring
Some loan apps use data from rejected applicants to build credit scores, which can influence future loan applications. This practice can unfairly penalise individuals who were initially denied credit, as their data may be used to reinforce negative credit profiles without their knowledge.
The Techpoint Africa article noted that apps like Kuda use automated eligibility checks that consider personal information and income, which could include data from rejected applicants.
Psychological and social consequences
The knowledge, or suspicion, that one’s data is being stored in a shadow profile can cause anxiety and a sense of loss of control. This is particularly concerning in Nigeria, where trust in digital platforms is low due to widespread reports of harassment and blackmail by loan apps.
A 2023 Rest of World article described how Nigerians formed Facebook groups to counter “debt-shaming” by loan apps, indicating a broader culture of mistrust.
While these tactics are often directed at approved borrowers who default, the retention of rejected applicants’ data suggests that similar abuses could extend to those who never received a loan.
Lack of transparency
The lack of transparency surrounding data retention practices exacerbates these issues. Many users are unaware of the extent to which their data is collected and used, leading to a breach of trust between loan apps and their customers.
A 2024 Mondaq article criticised loan apps for deploying unethical recovery tactics, such as cyberbullying, which violate data privacy and consumer rights.
This lack of trust is further compounded by the aggressive debt collection tactics employed by some apps, which include sending harassing messages to borrowers’ contacts or publicly shaming defaulters on social media.
Regulatory efforts and challenges
In response to growing concerns about data privacy, Nigeria enacted the NDPR in 2019, which provides a legal framework for protecting personal data.
The NDPR requires that data be collected only for legitimate purposes and that users be informed about how their data will be used.
The Nigerian Data Protection Act (NDPA), signed into law in 2023, further strengthens these protections. The Federal Competition and Consumer Protection Commission (FCCPC) has also been active in regulating digital lenders, requiring them to register and comply with guidelines for ethical lending practices.
Despite these regulations, enforcement remains a significant challenge. Many loan apps operate in a regulatory grey area, exploiting ambiguities in the law to continue unethical practices.
For example, some apps claim that users consent to data collection by downloading the app, even if the loan is not approved. This interpretation of consent is questionable, as users may not fully understand the implications of their actions when applying for a loan.
The Executive Vice Chairman and Chief Executive Officer of the Commission, Babatunde Irukera, said loan platforms thrive because they use wallets on Payment Solution Service Providers (PSSPs) to execute their illegal transactions.
The rapid pace of technological innovation also means that regulatory frameworks often lag behind the practices of fintech companies. As a result, new practices like the creation of shadow profiles may not be explicitly addressed by existing laws, allowing loan apps to continue these practices with impunity.
The FCCPC has acknowledged these challenges and plans to engage approved loan apps to develop a more robust compliance framework.
Public awareness and reporting mechanisms
Another challenge is the lack of awareness among users about their data protection rights. Many Nigerians are unaware of the NDPR or how to report violations, leaving them vulnerable to exploitation by unscrupulous lenders.
The FCCPC encourages consumers to patronise only approved digital money lenders and provides a mechanism for reporting complaints via email. However, greater public education is needed to empower users to protect their data and seek redress when their rights are violated.
Regulatory actions against loan apps in Nigeria
| Regulatory Body | Action Taken | Impact |
| NITDA | Fined Soko Lending Company 10 million naira for data abuse in 2021 | Increased scrutiny of loan apps’ data practices |
| FCCPC | Approved 173 loan apps by 2023, banned others for unethical practices | Reduced operations of illegal apps, but enforcement remains challenging |
| NDPR/NDPA | Mandates lawful data collection and user consent | Provides a legal framework, but compliance is inconsistent |
| Google Play Store | Removed apps like Sokoloan, Maxi Credit for unethical behaviour | Limits access to predatory apps, but some operate via unofficial platforms |
Recommendations for users to protect themselves:
- Choose approved apps: Only use loan apps approved by the FCCPC, as listed on their website here: FCCPC.
- Read terms carefully: Review the terms and conditions to understand data collection practices.
- Check reviews: Look for user reviews on platforms like Google Play Store to identify apps with unethical practices.
- Report violations: Contact the FCCPC or NITDA if they suspect data misuse, using the provided channels like [email protected].
NB: Attempts to get responses on this topic from loan platforms prove abortive.
Technext Newsletter
Get the best of Africa’s daily tech to your inbox – first thing every morning.
Join the community now!
