An alleged insider effort to sell bank-access credentials has drawn fresh attention to one of the financial industry's most difficult cybersecurity problems: stopping people with knowledge of internal systems before they can cause harm. The case involving First City Monument Bank (FCMB) has been described in some reports as a successful "$25,000 server hack," but the available information points to a different sequence of events.

The allegation concerns an attempted unauthorised entry using legitimate credentials. The activity was detected and stopped before the attacker reached the bank's server or database. No customer funds were lost, and there is no evidence that customer data was accessed or compromised.

The $25,000 figure cited in reports refers to an alleged payment offered in exchange for access credentials — not money taken from FCMB or its customers. A server administrator and a former employee have been charged before the Federal High Court in Lagos in connection with the matter. The allegations have not been proven, and the defendants are entitled to the presumption of innocence.

Beyond the criminal proceedings, the case illustrates how insider threats differ from conventional cyberattacks. Banks must defend their systems not only against external hackers but also against employees, contractors and former workers who may understand internal processes or hold legitimate credentials. That reality makes early detection critical.

An attacker attempting to break through an external security barrier may be easier to identify than someone trying to enter with valid or recently compromised credentials. Security systems must therefore assess both the user's identity and whether the person's activity matches their assigned role.

This approach relies on layers of protection. Access should be limited to the information and systems each job requires. Sensitive activities may require additional approval or authentication. Duties should be divided so that no single person can complete a high-risk process without oversight. Continuous monitoring is also needed to flag unusual behaviour, including attempts to enter restricted systems, access data outside normal responsibilities, or activity at unexpected times. These controls align with widely used security frameworks, such as the principle of least privilege and segregation of duties, that banks globally apply to reduce insider risk.

The FCMB incident did not progress to a completed breach. The bank detected the alleged compromise, contained the attempt, and referred the suspects to the Economic and Financial Crimes Commission (EFCC) for investigation and prosecution. That sequence matters, because an attempted attack does not necessarily mean a security system failed.

Financial institutions are continually targeted. Cyber resilience is measured in part by how quickly an institution detects suspicious activity and whether it can stop a threat before money or information is lost. For Nigerian banks, which operate under the Central Bank of Nigeria's supervisory framework and have expanded digital banking channels in recent years, maintaining that resilience is central to customer trust.

The case also raises a wider question about how cybercrime is reported. Terms such as "hack," "breach" and "fraud" are sometimes used interchangeably, even though they describe different events. An attempted intrusion means someone tried to gain access. A breach means the person succeeded in entering a protected system or obtaining information. Financial loss requires evidence that money was actually taken. These distinctions affect how customers, regulators and investors assess the severity of an incident.

The institutional test is what happens next: whether monitoring systems identify the activity, whether access is blocked, whether the threat is contained, and whether the matter is escalated for investigation. In this matter, the charges before the Federal High Court in Lagos will determine the legal outcome, and the proceedings remain ongoing.

FCMB's decision to report the suspects to the EFCC highlights another dimension of cyber-risk management: the need for cooperation between financial institutions and law enforcement. Internal controls may prevent immediate harm, but prosecution can establish accountability and help deter similar conduct.

Banks also need to preserve evidence and share relevant intelligence about the methods used to obtain credentials or bypass controls. Such cooperation can strengthen defences across the financial system, particularly as criminal networks increasingly combine social engineering, insider knowledge and digital tools.

The FCMB case is therefore more accurately understood as an alleged insider-access attempt that was detected before it became a breach. No successful server intrusion or financial loss has been established, and no customer impact has been identified. Its broader lesson is that insider threats cannot always be prevented at the point of intent: employees can be approached, credentials can be compromised, and trusted access can be misused. The stronger defence is a system that limits access, monitors behaviour, and intervenes before an attempt becomes a loss.

Source: TechNext24, FCMB