GTBank Customer Alleges ₦2.59m Fraud in Dual Account Security Breach

A Guaranty Trust Bank (GTBank) customer, Stella Adepegba, has accused the institution of negligence after fraudsters allegedly siphoned ₦2.59 million from two separate family accounts within a 24-day period.
​The unauthorized transfers, which occurred on October 8 and November 1, 2026, targeted both a minor’s savings account and a personal account without triggering real-time security alerts or debit notifications, according to the customer.
​Sequence of Unauthorized Transfers
​The first breach occurred on October 8 around 8:00 PM, targeting a GTBank Child Saver’s account belonging to Adepegba’s daughter, Victoria. A total of ₦2.507 million was moved via the NIBSS Instant Payment (NIP) platform in four rapid transactions:
​Moniepoint (Account Name: Abdulmalik Idris): Three transfers totaling ₦1.017 million (₦399,000, ₦398,000, and ₦220,000).
​GoMoney (Account Name: Zainab Ibrahim): One transfer of ₦1.49 million.
​Adepegba stated that she only learned of the breach when a GTBank employee called to offer account-blocking services—after the funds had already been fully drained.
​Despite reporting the incident at GTBank’s Kubwa branch in Abuja on October 9 and updating her security credentials, a second attack occurred on November 1. An additional ₦80,000 was transferred from Adepegba’s personal account to a FairMoney account bearing the name Jamilu Ahmad.
​”GTB could not explain how the hackers successfully stole my money despite changing my account’s log-in details,” Adepegba said. She maintained that her SIM card, mobile phone, and debit cards remained in her physical possession throughout both incidents, and denying that she shared any One-Time Passwords (OTPs) or banking credentials.
​GTBank Denies System Failure, Cites Phishing
​Responding to the allegations, Chief Communications Officer of Guaranty Trust Holding Company Plc (GTCO), Mrs. Oyinade Adegite, confirmed that an internal investigation concluded the security breach originated on the customer’s end.
​”All the measures the bank has to put in place, including two-factor authentication (2FA), were active. The compromise came clearly from the customer,” Adegite stated.
​Adegite explained that cybercriminals increasingly use deceptive phishing links to install malware on mobile devices, capturing sensitive login data without the user’s explicit knowledge. While maintaining that institutional security protocols remained intact, she expressed sympathy for the victim and committed to reviewing the November 1 transaction for potential intervention.
​Heightened Regulatory Scrutiny
​The incident highlights ongoing concerns over consumer protection within the Nigerian banking sector.
​Audited financial reports reveal that GTBank’s parent company, GTCO, faced ₦383.65 million in regulatory penalties in 2024. Sanctions levied by the Central Bank of Nigeria (CBN) included:
​₦160.4 million following a CBN mystery shopping assessment.
​₦149.25 million for compliance failures and email return issues.
​₦56 million specifically for consumer protection violations.
​₦18 million stemming from foreign exchange compliance examinations.
​Adepegba has demanded a full refund and called on the bank to collaborate with law enforcement to track down the destination accounts.