By Owolabi Ebunoluwa, Esq.
![](https://thenigerialawyer.com/wp-content/uploads/2026/09/NBBSPIDEL.png")
![](https://thenigerialawyer.com/wp-content/uploads/2026/05/2026-Summer-IDRI-Masterclass.jpg")
Nigerian courts are increasingly enforcing data protection as a fundamental right, awarding damages where organisations send unsolicited messages, reuse data beyond lawful purposes, or ignore objections. This legal shift matters today as a new wave of phishing scams, such as fake “FRSC speeding ticket” SMS messages with dubious links, are exploiting the same weaknesses in data handling and consumer trust that recent judgments like Araka v Ecart and Olatokun v Polaris condemn. This article links the litigation trend to the current scam, explains your rights under the Nigeria Data Protection Act (NDPA) 2023, and gives practical steps to avoid falling prey to scammers.
Unsolicited Messages Are Now Considered a Legal Breach
Recent Nigerian cases show that unsolicited communications are no longer a minor nuisance. They have become actionable breaches of privacy and data protection law.
● In Tokunbo Olatokun v Polaris Bank Limited, the court awarded ₦1 million in damages after the bank continued sending marketing messages despite the customer’s objection.
● In Onimisi v GTCO (2026), the Federal High Court ordered the bank to stop sending unsolicited messages to a non-customer, awarded ₦250,000, and compelled disclosure of the data source.
● In Chukwunweike Akosa Araka v Ecart Internet Services, the court held that using a phone number collected for service purposes to send promotional messages violated the constitutional right to privacy and NDPA duties on lawful, purpose-limited processing.
Nigerian courts now treat such breaches as violations of Section 37 of the 1999 Constitution (as amended), which has to do with the right to privacy, enforceable via fundamental rights procedures, with remedies including declarations, injunctions, and damages.
The Current Scam: Fake FRSC Speeding-Ticket Messages
Since mid-September 2026, Nigerians have reported receiving unsolicited SMS messages purporting to be from the Federal Road Safety Corps (FRSC), alleging new “road traffic offence records” and directing recipients to click suspicious links. [dailypost]
How the scam works:
Phone users are sent dubious messages informing them of a new road traffic offence record that requires handling. Then, the unsuspecting victims are instructed to click on dubious links that mimic the official FRSC site, such as frscgov.top/ng, fctevreg.cam, frsac-govt.cc, and similar fake links.
Victims are then prompted to pay a small “handling fee” or to enter personal details. These dubious sites harvest personal data, steal bank details and make use of one-time passwords (OTPs) to enable account drainage. [businessday]
Why Is This a Data Protection Issue?
Under the NDPA 2023, personal data includes any information relating to an identified or identifiable individual, and it includes phone numbers, vehicle details, names, and even metadata about message recipients.
The fake FRSC scam goes against laid-down NDPA principles. For example, Section 24 of the NDPA talks about lawful, fair and purpose-limiting processing. Scammers act contrary to this principle as they process data without any lawful basis for a fraudulent purpose.
An important aspect that one should consider is: what is enabling these unsolicited messages? Poor data and privacy management practices, such as poor consent, weak vendor controls, and unverified data sourcing, create the conditions these criminals exploit. Organisations that carelessly share or sell contact data, or fail to honour objections, indirectly fuel such scams and risk liability under the same legal principles courts are now enforcing.
Your Rights Under the NDPA: What Nigerian Law Says About Unsolicited Messages
The NDPA gives you concrete rights to protect yourself from unwanted communications. These rights include:
● Right to object to direct marketing (Section 36): You can object at any time, and processing of your data must stop immediately.
● Right to know the source of your data (Section 34): You can ask who provided your phone number or email and for what purpose.
● Right to restriction and withdrawal of consent (Section 35): You can demand that your data should not be used or that your data be deleted or erased where processing is unlawful.
● Right to lodge a complaint with the NDPC: If a controller or processor violates these rights, you can file a complaint with the Nigeria Data Protection Commission.
How to Spot and Avoid Fake FRSC (and Similar) Phishing Messages
Given the litigation trend and the sophistication of these scams, individuals should adopt a “verify before you click” mindset.
Red Flags to Watch For:
● Unexpected messages about fines or offences: Genuine FRSC communications do not arrive as surprise SMS alerts with payment links.
● Suspicious domains: Official Nigerian government sites end strictly in .gov.ng. Domains like .top, .cam, .click, and .cc are fraudulent.
● Urgency and small fees: Scammers use low “handling fees” to lower your guard before harvesting OTPs and bank details.
● Generic greetings and poor formatting: Look out for messages that lack specific vehicle or offence details or use awkward language.
What to Do If You Receive Such a Message
- Do not click the link. Treat any unsolicited message with a link as suspicious until verified.
- Verify through official channels: Visit frsc.gov.ng directly (do not use the link) or call the organisation’s toll-free line to confirm.
- Check the sender: Note the phone number or short code; report it if suspicious.
- Preserve evidence: Take screenshots of the message, link, and any interaction before deleting.
- Report the scam: You can report it to the EFCC, the Nigeria Police Cybercrime Unit, or the Nigeria Data Protection Commission via their portals or verified email addresses, or by writing a formal petition and submitting it physically at their offices.
- Alert your bank: If you clicked or entered details, contact your bank immediately to block transactions and reset credentials and passwords.
What Organisations Must Learn from This:
These types of scams thrive in an environment where phone numbers and personal data circulate without clear consent or oversight. Organisations such as banks, telcos, membership bodies, and service providers should take note of the following:
● Tighten consent and purpose limits: Do not share member or customer data for marketing or third-party use without explicit, specific consent.
● Audit data sources: Ensure you know where contact lists come from. Buying or scraping data without verification exposes you to NDPA liability.
● Honour objections instantly: Build systems to stop communications the moment a data subject objects. Continuing after an objection is a high-risk litigation trigger.
● Educate your customers: Proactively warn customers about phishing scams using your brand or government agencies. This builds trust and reduces victimisation.
Courts and regulators are watching. The same legal principles that led to damages in court cases like Olatokun, Onimisi, and Araka will apply where organisations enable or ignore unlawful data flows that facilitate fraud.
Awareness Is Key
The rise of data subject litigation in Nigeria is good news for Nigerians. This implies that courts are backing privacy rights with real remedies. But rights alone are not enough. In the face of sophisticated phishing scams like the fake FRSC speeding-ticket messages, Nigerians must combine legal awareness with practical caution.
● Know your rights under the NDPA to object, restrict, and demand transparency.
● Verify before you click, especially for messages about fines, offences, or payments.
● Report scams to the EFCC, the Police Cybercrime Unit, and the NDPC.
● Hold organisations accountable for careless data practices that enable such scams.
In a digital economy where data is power, privacy is not just a legal concept. It is your first line of defence against fraud.
*This article is for general information and does not constitute legal advice.
Owolabi Ebunoluwa is a legal practitioner with expertise in data protection and cybersecurity. Contact: ebunowolabi00@gmail.com
Interested buyers are encouraged to place their orders and enquiries via:
0704 444 4777, 0704 444 4999, 0818 199 9888
Website: www.alexandernigeria.com
