19 sector rules, each grounded in a real 2024-2026 incident. 10 are live in this demo (the secured deployment blocks them now); the rest are the template a customer tunes to their data.

How it works

A user swaps another customer's account/transaction/BVN id in a request and the API returns an object they don't own.

Detection signals

On /accounts/{id}, /transactions/{id}, /statements?acct=: assert object.owner_id == session.subject; flag a session touching >5 owner-mismatched ids in 60s or sequential id walking.

Threshold

>5 owner-mismatched ids/session/60s, or any owner_id != session subject

Modelled on

Experian API credit-score exposure via IDOR, 2021 · source

How it works

Victim is socially engineered to authorize a genuine NIP transfer to a fraudster account never paid before.

Detection signals

Beneficiary <24h old to this payer AND amount >= NGN 100k, or beneficiary on the mule watchlist at any amount; escalate on paste-then-edit of the destination.

Threshold

first-time beneficiary + amount >= NGN 100,000, or mule-listed beneficiary

Modelled on

CBN APP Fraud Guidelines exposure draft, Nov 2025 · source

How it works

Proceeds land in a mule account and are split and forwarded rapidly to break the audit trail.

Detection signals

>=10 distinct payers inbound in 24h AND >=80% of value debited out within 1h to >=5 beneficiaries; boost for dormant-then-active and <30d account age.

Threshold

pass-through >=80% within 1h AND >=10 payers/24h AND >=5 out-beneficiaries

Modelled on

CBN orders NIBSS to debit banks receiving fraud proceeds, Jan 2025 · source

How it works

Attacker ports the number, intercepts OTP, logs in from a new device, adds a beneficiary and empties the balance.

Detection signals

SIM-swap age <72h correlated with new-device login, PIN reset, beneficiary add, and outbound transfer; suppress SMS-OTP as sole factor.

Threshold

SIM-swap <72h + new device + beneficiary add or debit > NGN 50,000

Modelled on

South Africa SIM-swap surge 2024 (~R5.3bn telecom-linked fraud) · source

How it works

Bots replay leaked credential pairs from combolists to take over logins at scale.

Detection signals

>30 login attempts/60s per IP/device or >20 distinct usernames/min, failure rate >90%, headless UA, credentials matching a breach set.

Threshold

>30 attempts/60s per IP, or >20 usernames/min, failure >90%

Modelled on

PayPal credential-stuffing ~35,000 accounts, 2022 · source

How it works

Fraudsters validate stolen PANs with many small or zero-value auths, often walking one BIN.

Detection signals

>10 card auths/60s per IP/device, BIN decline rate >60% over 10 min, clustered sub-NGN 200 amounts, sequential trailing PAN digits.

Threshold

>10 auths/60s per entity, or BIN decline rate >60%/10min

Modelled on

Visa enumeration attacks +134% 2022-2024 · source

How it works

Large sums are split into many sub-threshold transactions to stay under reporting limits.

Detection signals

Aggregate per BVN (not per account): >=3 sub-threshold (>=90% of limit) txns in a rolling window summing over the limit; repeated round just-below values.

Threshold

aggregate per BVN > reporting limit via >=3 sub-threshold txns in 7d

Modelled on

Nigeria single-entity NGN 31.1bn fraud drove 2024 losses to NGN 52.26bn (NIBSS) · source

How it works

Staff use back-office access to alter records, lift limits or seed mule beneficiaries outside their duties.

Detection signals

Operator acting on accounts outside their branch/portfolio, off-shift, overrides/beneficiary-adds > 3x peer baseline, access with no linked ticket.

Threshold

actions outside assigned portfolio, or overrides > 3x peer daily baseline

Modelled on

Nigeria insider staff fraud NGN 3.3bn Q1 2025, +137% QoQ (NIBSS) · source

How it works

Client injects extra properties (balance, is_admin, kyc_tier) into a write and the API binds them to the model.

Detection signals

On write endpoints reject any body field outside the per-endpoint allowlist, especially balance/role/is_admin/kyc_level/limit/status/verified/fee.

Threshold

any non-allowlisted or privileged property in the request body

Modelled on

OWASP API3:2023 BOPLA · source

How it works

Attacker brute-forces a short OTP or spams OTP/reset issuance because the endpoint lacks per-identity caps.

Detection signals

>5 wrong OTP submissions per identity, verify after TTL, or >3 OTP/reset issuances per identity in 10 min; bind attempts to a sealed session id.

Threshold

>5 OTP failures per identity, or >3 issuances/identity/10min

Modelled on

Instagram OTP brute-force account takeover, 2019 · source

How it works

A stolen token or credential is used from a location the user could not have reached since last activity.

Detection signals

Implied travel speed >900 km/h between events, mid-session country/ASN change without re-auth, or device-fingerprint change under one session cookie.

Threshold

implied travel >900 km/h, or mid-session country + device change

Modelled on

Snowflake customer account takeovers, 2024 · source

How it works

After takeover the attacker logs in from a new device, disables alerts, adds a beneficiary and moves the balance out.

Detection signals

In one 24h window: new device + recovery-detail change + new beneficiary + outbound > NGN 50k; tighten if alerts disabled or daily limit just raised.

Threshold

new device + recovery change + new beneficiary + debit > NGN 50,000 / 24h

Modelled on

African SIM-swap ATO drains balance in 15-30 min, 2024-2026 · source

How it works

Attackers script legitimate flows (signup bonuses, referrals, refunds) at machine speed to extract value.

Detection signals

>3 promo/referral/refund claims per device or BVN in 24h, one device farming many accounts to one payout wallet, sub-human step timing.

Threshold

>3 claims per device/BVN/24h, or shared payout account across >5 'distinct' users

Modelled on

Revolut payment-flow logic flaw, ~$20M loss 2022 · source

How it works

Attacker supplies a server-fetched URL pointing at internal services or cloud metadata.

Detection signals

Block fetch targets resolving to private/link-local (10/8, 169.254.169.254, ::1), non-http schemes, or DNS-rebinding where resolved IP differs from allowlist at fetch time.

Threshold

fetch target resolves to private/link-local/metadata IP or non-http scheme

Modelled on

Capital One SSRF breach, 106M records, 2019 · source

How it works

Cardholders dispute legitimate transactions as unauthorized to reclaim funds while keeping value.

Detection signals

Chargeback rate >0.9% (30d) or >2 disputes/customer/90d, disputes shortly after delivery, unauthorized claim despite 3DS/AVS/CVV pass.

Threshold

chargeback rate >0.9% (30d) or >2 disputes/customer/90d

Modelled on

Interswitch NGN 30bn fraudulent-chargeback losses, 2023 · source

How it works

AI voice/video deepfake or spoofed executive email instructs a payout-detail change or large wire.

Detection signals

Vendor bank details changed <30d + instruction > NGN 1m arriving from a lookalike/fresh domain, skipping maker-checker, without on-file callback.

Threshold

vendor detail change <30d + amount > NGN 1,000,000 without out-of-band callback

Modelled on

Arup Hong Kong deepfake-CFO call, $25M transfer, 2024 · source

How it works

Concurrent or replayed requests against non-idempotent ledger endpoints credit an account twice.

Detection signals

>=2 requests sharing one idempotency-key produce distinct ledger postings, sub-second concurrent debits/reversals, credit without matching debit.

Threshold

duplicate reference with 2+ postings, or credit without matching debit

Modelled on

NIBSS NIP accounting-logic glitch, NGN 13.66bn mis-posted, Sept 2024 · source

How it works

Attacker forges or replays a payment-success callback to mark unpaid orders as paid.

Detection signals

Reject callbacks lacking valid HMAC over the raw body, with stale/missing timestamp-nonce (>5 min skew or reused = replay), or amount/reference mismatch vs the originating charge.

Threshold

invalid signature, >5 min skew, reused nonce, or amount/reference mismatch

Modelled on

Flutterwave NGN 11bn unauthorized-transfer breach, 2024 · source

How it works

An endpoint returns more fields than the caller's role should read (the exposure side of BOPLA).

Detection signals

Response contains sensitive fields (PAN, BVN, full DOB) beyond the caller's role scope; strip or block over-broad responses.

Threshold

response includes fields outside the caller role's read scope

Modelled on

OWASP API3:2023 (excessive data exposure) · source