Last updated: 14 October 2026. This is general information, not legal advice. Laws are amended and interpreted by the courts, so speak to a lawyer about a specific case. We rewrote this guide to reflect the 2024 amendment.
Nigeria’s main cybercrime law is the Cybercrimes (Prohibition, Prevention, etc.) Act 2015, amended by an Amendment Act that President Bola Tinubu signed on 28 February 2024. The amendment changed 12 sections of the original Act. Here is what matters for ordinary internet users.
What the law covers
- Unlawful access and hacking: breaking into computers, networks, accounts or data without permission.
- Identity theft and impersonation: using someone’s identity, card or account details to deceive or steal.
- Online fraud: including romance scams, fake investments and phishing. The Act has tougher penalties for identity theft and data breaches after the amendment, according to summaries.
- Cyberstalking and threats: using computer systems to threaten, harass or intimidate. See below.
- Child sexual abuse material and exploitation offences.
- Attacks on critical national information infrastructure.
- Duties on organisations: the 2024 amendment requires cybersecurity measures, including sectoral computer emergency response teams.
Cyberstalking and free speech
Section 24 of the 2015 Act, which dealt with offensive or false messages sent online, drew heavy criticism for vagueness and was used against journalists and critics. In 2022 the ECOWAS Court of Justice ruled that section 24 violated freedom of expression and told Nigeria to amend it. The 2024 amendment rewrote sections 24(1)(a) and (b), and scholars say the new version is clearer but does not fully resolve the concerns. In practice, threatening or harassing someone online can still be a crime, while merely criticising a public figure should not be. If you are charged or threatened over a post, get a lawyer. See our guide on cyberbullying.
The cybersecurity levy controversy
Section 44 of the Act provides for a National Cybersecurity Fund funded partly by a 0.5% levy on electronic transactions by businesses listed in the Act. In May 2024 the CBN issued a circular telling banks to collect it, which caused public outrage. The levy was suspended within days after a Federal Executive Council meeting, while lawmakers argued over whether the levy should fall on businesses or on customers. Because the position can change, check the current status with your bank or the CBN. See our guide on the cashless policy for other charges.
Enforcement in practice
The EFCC, the police and other agencies enforce the law. On 10 December 2024, the EFCC arrested 792 suspects, including 193 foreigners, in a single operation in Lagos over crypto-investment and romance scams. The agency said it deported 102 foreign nationals convicted of cyber-terrorism and internet fraud in 2025. The police cybercrime centre reported 751 arrests in 2024. Courts have also convicted internet fraudsters in several states. The Nigerian Communications Commission has estimated that Nigeria loses around $500 million a year to online fraud, though estimates differ. For other protections, see our guides on data privacy and internet scams.
How to report cybercrime
- Collect evidence: keep screenshots, links, phone numbers, account details and receipts. Do not delete messages.
- Secure yourself: change passwords, turn on two-step login and contact your bank immediately to stop or trace transfers.
- Report to the EFCC, the Nigeria Police Force cybercrime unit or the relevant agency, and to the platform where it happened.
- Keep records of reference numbers and follow up.
How to stay on the right side of the law
- Do not hack, access or use other people’s accounts, even “just to test”.
- Do not take part in “Yahoo” schemes or let others use your account to move money. Lending an account can make you an accomplice.
- Do not share intimate images of anyone without consent.
- Think before you post threats or false claims about people.
Offences and Penalties at a Glance
The Cybercrimes Act covers offences such as unauthorised access, computer-related fraud, identity theft, cyberstalking, child sexual abuse material and interference with critical infrastructure, with penalties that range from fines to imprisonment. The 2024 amendment changed several sections, including the cyberstalking provision after a regional court ruling. A levy of 0.5% on electronic transactions that was announced in 2024 was suspended within days.
Your Rights and Limits
- Criticism is lawful, but threats, harassment and false claims can lead to a case.
- Do not share intimate images without consent, which can be an offence.
- If you are arrested, you have rights, including the right to a lawyer.
Practical Advice
- Think before you post, and keep evidence if you are harassed.
- Report cybercrime to the police, the EFCC or the relevant regulator.
- Get legal advice if you are summoned.
See cyberbullying and data privacy.
Frequently Asked Questions
What is the Cybercrimes Act?
It is the main Nigerian law that defines and punishes computer and internet crimes, as amended in 2024.
Is cyberstalking still an offence?
Yes, but the wording of section 24 was changed after the ECOWAS Court ruling, and its limits are still debated.
Is the 0.5% cybersecurity levy being charged?
Implementation was suspended in May 2024. Check with your bank for the latest.
Where do I report online fraud?
To the EFCC, the police cybercrime unit and your bank, and to the platform concerned.
Sources
- Mondaq: The Cybercrime (Prohibition, Prevention, Etc) (Amendment) Act 2024
- PLAC: Cybercrimes Amendment Act exposes lapses in the legislative process
- Mondaq: Cybersecurity levy beyond suspension
- Godfrey Okoye University: Cyberstalking in Nigeria, section 24 study
- Al Jazeera: Nigeria deports 60 Chinese and 39 Filipinos convicted in crypto romance scams
- Global Voices: Cybercrime schools in Nigeria
Related: How to report cybercrime in Nigeria: police, EFCC and your bank
