Customer KYC / BVN harvest (BOLA)

Increment an id and read any customer's full KYC, including BVN, address and balance.

Attack

Read profile id=3 (the MD).

Nemesis defense

Cross-tenant object reads are off-baseline and blocked.

Modelled on

Zenith Bank (2026): customer PII breach, phishing wave followed.

Endpoint

GET /api/profile