The Fake NCC Device Verification Portal: How to Recognise the Scam and Protect Your Information
A fraudulent website impersonating Nigeria's device verification portal is attempting to exploit public trust. Here is what users need to know before sharing personal information online.
Digital services have made it easier for Nigerians to access information, verify devices and complete important processes online. However, the growing reliance on these services has also created opportunities for cybercriminals to impersonate trusted institutions and exploit unsuspecting users.
On 30 October 2026, the Nigerian Communications Commission's Computer Security Incident Response Team (NCC-CSIRT) issued a high-probability, high-impact security advisory warning about an active phishing campaign impersonating the Commission's official device verification portal.
The campaign uses fraudulent websites designed to resemble the legitimate NCC platform, with the intention of deceiving visitors into submitting sensitive information or making payments for services that do not exist.
For users who may be trying to verify their mobile devices, the distinction between a genuine government service and a convincing imitation could be significant.
How the fake NCC verification campaign works
According to NCC-CSIRT, threat actors are registering deceptive domain names that closely resemble the official device verification website, verifymydevice.gov.ng.
The fraudulent websites imitate the appearance and branding of the legitimate portal, including the use of NCC's logo and similar website layouts. They may present fake verification prompts or urgent notifications designed to encourage visitors to act without checking the website address carefully.
Some of the deceptive domains identified in the advisory include:
These websites are designed to create the impression that users are interacting with an authorised government service.
Once a visitor is persuaded to proceed, the fraudulent platform may request sensitive information such as one-time passwords (OTPs), banking details and other personal data. Users may also be prompted to make payments for non-existent device registration or verification services.
The advisory further identifies the possibility of malware distribution through malicious redirects.
Why this type of phishing attack is particularly concerning
Phishing attacks are often associated with suspicious emails, unusual messages or links containing obvious spelling mistakes. However, modern phishing campaigns can be considerably more convincing.
In this case, the attackers are exploiting trust in a recognised Nigerian institution and a legitimate public service.
A website displaying an official-looking logo, familiar colours and a professional layout may appear credible at first glance. The presence of HTTPS encryption can also create a misleading sense of security.
However, HTTPS alone does not establish that a website belongs to a legitimate organisation. It primarily indicates that the connection between the browser and the website is encrypted.
This distinction is important. A fraudulent website can also use HTTPS.
The campaign demonstrates how cybercriminals can exploit familiar brands and public interest in official services to make fraudulent websites appear trustworthy.
How to identify a fake device verification website
Before entering personal information into any online portal, users should take a moment to verify its authenticity.
The following precautions can help reduce exposure to phishing attempts:
1. Check the complete website address
Do not rely on the website's appearance or the name displayed in a search result. Carefully examine the address bar and confirm that the domain matches the institution's official website.
For the NCC device verification service, the official portal is:
2. Avoid links from unsolicited messages
Be cautious when receiving unexpected verification links through SMS, WhatsApp, email or social media. Rather than clicking directly, access the service through the institution's official website or verified communication channels.
3. Never disclose your OTP or banking details
The NCC has explicitly stated that it will not request a user's OTP or banking details during device verification. Any request for this information should be treated as suspicious.
4. Be cautious of unexpected payment requests
Fraudulent websites may introduce urgent payment instructions to pressure visitors into completing a transaction. Verify any payment requirement directly through the institution's official channels before proceeding.
5. Do not assume that HTTPS means a website is legitimate
A secure connection does not automatically make a website trustworthy. Always verify the domain and the organisation operating the service.
What should you do if you have already submitted your information?
If you suspect that you have entered sensitive information on a fraudulent website, take action immediately.
Contact your bank through its official customer support channels if you have disclosed banking information or authorised a suspicious transaction.
Contact your mobile network operator if your account or SIM may have been exposed.
Change affected account passwords, especially where the same password is used across multiple services.
Revoke suspicious account sessions and enable multifactor authentication where available.
If you downloaded a file or application from the suspicious website, avoid opening it and arrange for the device to be checked for malicious activity.
Report the suspicious website to the relevant authorities through their official reporting channels.
Acting quickly can help reduce the consequences of credential theft, financial fraud and potential device compromise.
How can security technology help?
User awareness remains essential, but individuals and organisations can also strengthen their protection with appropriate cybersecurity solutions.
ESET's Anti-Phishing technology is designed to protect users against fraudulent websites that attempt to obtain sensitive information. When a user attempts to access a webpage, ESET checks the address against its database of known phishing websites. If a match is identified, access is blocked and a warning is displayed.
ESET Internet Security includes Anti-Phishing protection, alongside other layers of protection against online threats.
However, no security solution should be treated as a guarantee that every newly created fraudulent website will be detected immediately. Users should continue to verify website addresses, avoid suspicious links and exercise caution before sharing sensitive information.
Stay informed. Verify before you trust.
The NCC's warning is a reminder that digital trust can be exploited, particularly when cybercriminals impersonate institutions and services that people recognise.
A convincing website is not necessarily a legitimate one. Before submitting personal information, making payments or responding to urgent verification requests, take the time to confirm the source.
For official device verification, use the NCC's recognised channels:
Official portal: https://verifymydevice.gov.ng/
NCC website: https://www.ncc.gov.ng/devicechecker
USSD: *315#
NCC support: 622
At ESET, we believe stronger digital security begins with informed decisions and the right protection. Stay alert, verify every request and protect your digital identity.
Comments