AI Fraud Detection for Nigerian Businesses: Payments, Orders, Accounts and Staff

Fraud in a Nigerian business rarely looks like a Hollywood hack. It looks like a dispatch rider marking twenty orders "delivered" that never reached anyone, a customer who places a ₦180,000 pay-on-delivery order from a new number and vanishes when the rider arrives, a cashier reversing sales after close, or a wave of card payments from a compromised account that lands you with chargebacks weeks later. Each pattern is different, which is why a single "fraud tool" rarely solves the whole problem.

This article explains the fraud types that actually cost Nigerian businesses money, how AI detects each one, what data you need, the difference between rules and models, what changes in the Nigerian payment and delivery environment, a labelled hypothetical example, indicative costs and implementation steps. It is not legal advice: reporting obligations and regulator expectations for fintechs and lenders should be verified with the Central Bank of Nigeria and qualified counsel.

What AI fraud detection is and how it works

AI fraud detection is software that assigns a risk score to an event (a payment, an order, a login, an expense claim, a delivery confirmation) and triggers an action based on that score: approve, hold for review, ask for extra verification, or block. The score comes from a combination of business rules you define and models that learn what normal and abnormal look like from your own history.

The working loop is the same regardless of fraud type:

1. Capture the event with as much context as possible: amount, time, device, location, account age, history.
2. Score it against rules (hard limits, blocklists, velocity checks) and models (anomaly detection, supervised fraud classifiers).
3. Decide using thresholds: low risk passes, medium risk gets a check (OTP, a call, manual review), high risk is blocked.
4. Record the outcome: was it actually fraud? This feedback is what makes the model better next month.

Without step four, the system never improves. Many fraud projects fail not because the model is weak but because nobody records which flagged cases turned out to be genuine.

Which fraud types cost Nigerian businesses most?

The fraud types that most commonly hit Nigerian businesses are payment fraud (stolen cards, fake transfer alerts, chargebacks), order fraud (fake pay-on-delivery orders and address manipulation), account takeover (SIM swap, credential stuffing, OTP interception), promotional and refund abuse, and internal fraud by staff or agents. Each needs different signals and different responses.

Internal fraud deserves emphasis because it is under-discussed and often larger than external fraud for distribution, logistics, retail and agent-network businesses. AI is good at it because staff behaviour is consistent enough that outliers stand out: one rider whose "customer unreachable" rate is triple everyone else's, one cashier whose void rate spikes on the days a particular supervisor is off.

Rules vs machine learning: what is the difference?

The difference between rule-based and machine-learning fraud detection is that rules are fixed conditions you write ("block if more than three cards on one account in an hour"), while machine-learning models learn patterns from labelled history and can catch combinations no one thought to write a rule for. Rules are transparent and fast to deploy; models adapt and generalise. Effective systems use both.

Rules are the right starting point for most Nigerian SMEs because they need no training data, they are explainable to staff and auditors, and they encode knowledge you already have. Examples:

• First order over a set amount from a new account with pay-on-delivery: require prepayment or a confirmation call.
• More than two failed deliveries to the same phone number: no further pay-on-delivery.
• Payout details changed in the last 24 hours: hold withdrawals.
• Sale voided after close of business: alert the manager.

Models become worthwhile once you have a few thousand events and a few hundred confirmed fraud cases, or when fraudsters adapt faster than you can write rules. Two kinds matter:

• Anomaly detection (unsupervised): learns what normal looks like and flags outliers. Useful when you have few labelled fraud cases, and for internal fraud.
• Supervised classification: learns from confirmed fraud versus genuine cases to score new events. More accurate, but needs labels and retraining as patterns shift.

Large language models are not the core of fraud scoring, but they help around the edges: reading a disputed-delivery conversation and summarising it for a reviewer, extracting details from an uploaded bank statement, or drafting the customer verification message. Do not let a vendor sell you a chatbot as a fraud system.

What data does fraud detection need?

Before AI can detect fraud, a business needs event-level records of transactions, orders or actions with timestamps, the parties involved and the outcome, plus a way to record which cases turned out to be fraud. The richer the context captured at the moment of the event (device, location, account age, channel), the better the detection.

A practical data checklist:

• Transaction or order records with amount, time, channel, payment method and status.
• Customer or account attributes: creation date, verification status, order history, previous disputes.
• Device and session data for web and app: device ID, IP-derived location, browser, login history.
• Delivery records: rider, timestamps, delivery confirmation method, failed-delivery reasons.
• Staff and agent activity logs: who did what and when, from POS, ERP or field apps.
• Confirmed outcomes: chargebacks, refunds granted, disputes upheld, internal investigations concluded.
• Consent and privacy basis for using customer data in this way, consistent with the Nigeria Data Protection Act 2023.

If your orders come through WhatsApp and your payments are bank transfers confirmed by screenshot, the data is thin. The first improvement is structural: verify transfers through your payment provider's API or a virtual-account service rather than by eye, and capture orders in a system, not a chat. The articles on automating payments in Nigeria and building a customer database for an online business cover these foundations.

Where does fraud detection sit in your systems?

Fraud detection is a scoring service that your existing systems call at decision points. It rarely replaces anything; it plugs in. Typical integration points for a Nigerian business:

• Checkout and payment: the payment gateway's own fraud controls (Paystack, Flutterwave and Interswitch all provide some) handle card-level risk; your own layer adds order-level and customer-level context they cannot see.
• Order management: before an order is released to dispatch, especially for pay-on-delivery.
• Login and account changes: on new device, password reset, or payout-detail change.
• Back office: nightly analysis of POS voids, stock adjustments, expense claims and delivery confirmations, with a morning report to management.
• Lending: at application and before disbursement.

Real-time scoring (milliseconds, inline with checkout) is necessary for card payments and account takeover. Batch scoring (hourly or nightly) is enough for internal fraud and most order fraud, and is far cheaper to build and host. Decide per fraud type; do not build everything real-time.

What changes for Nigerian businesses

Fraud detection designs from card-dominated markets need adjusting for how Nigerians actually pay, receive goods and identify themselves. Five points stand out.

Bank transfer and screenshot fraud. Because so much commerce runs on transfers, the fake or edited "transaction successful" screenshot is a constant threat. No AI is needed to defeat it: confirm receipt via your bank or payment provider's API, or issue virtual account numbers per order. AI then adds value by spotting patterns among transfers that did arrive (unusual timing, repeated payer names across accounts).

Pay-on-delivery economics. Fake orders cost you the rider's trip, packaging and time, and in Lagos traffic that is expensive. Order-level scoring that requires prepayment from high-risk profiles is one of the highest-return uses of fraud detection in Nigerian e-commerce. Combine it with rider-side confirmation (photo, OTP from customer) to also control internal delivery fraud.

Identity and verification. BVN and NIN-linked verification services exist for higher-risk contexts such as lending and account opening, but their use must comply with NDPA 2023 and the rules of the relevant regulator. For an ordinary online shop, phone-number verification and delivery history are usually enough; do not over-collect identity data you cannot protect.

Regulated businesses. Fintechs, lenders, payment service providers and insurers have specific obligations around fraud monitoring, reporting and know-your-customer processes set by the Central Bank of Nigeria and other regulators. If you are in this category, the fraud system must produce the audit trail and reports those obligations require; verify current requirements with the regulator and your compliance adviser.

Agent and field networks. Businesses that run agents, distributors or riders (POS agent networks, FMCG distribution, logistics) face float misuse and fake activity at scale. Batch anomaly detection on agent behaviour is often more valuable than customer-facing fraud tools for these businesses.

Connectivity matters too: a real-time check that times out when the network is slow must "fail safe" in a way you decide deliberately (approve small amounts, hold large ones), not crash the checkout.

Example (hypothetical): an online electronics store in Lagos

Example (hypothetical): an online electronics retailer in Lagos sells phones, laptops and accessories through a website and WhatsApp, with about 60% of orders on pay-on-delivery within Lagos and prepayment elsewhere. Its losses come from three sources: fake pay-on-delivery orders (rider trips wasted, occasionally goods handed over against fake transfer alerts), chargebacks on card payments for high-value phones, and two suspected cases of riders reporting "customer unavailable" then selling the goods.

A proportionate fraud detection programme:

1. Structural fixes first. All transfers verified via the payment provider's API; virtual account per order; riders confirm delivery with a customer OTP.
2. Rules layer (month 1). New account plus pay-on-delivery over ₦150,000 requires 20% prepayment; more than one failed delivery per phone number disables pay-on-delivery; card orders where the delivery address is far from the billing region are held for a confirmation call.
3. Batch anomaly reports (month 2). Nightly job compares each rider's failed-delivery rate, delivery times and OTP-failure rate against the fleet; outliers appear in the operations manager's morning report.
4. Order-scoring model (month 4 onwards). Once a few hundred confirmed outcomes are recorded, a supervised model scores new orders using account age, basket composition, address and phone history, and time of day. It replaces some blunt rules with finer thresholds.
5. Feedback loop. Customer service marks every held order as genuine or fraudulent after resolution; chargebacks are linked back to orders.

The store keeps a human in the loop for anything the system holds, and reviews false positives weekly so genuine customers are not driven away. This is a hypothetical scenario, not a Linestech client result.

How much does AI fraud detection cost in Nigeria?

For a Nigerian business, the main cost drivers of AI fraud detection are the number of integration points (checkout, orders, logins, back office), whether scoring must be real-time, data readiness, and whether you rely on rules, a vendor scoring service or a custom model. Indicatively, a rules-and-alerts layer on existing systems costs ₦1,500,000 to ₦4,000,000; a custom scoring model with real-time integration ₦5,000,000 to ₦15,000,000 or more; plus recurring costs.

All figures are indicative 2026 ranges; actual quotes vary with scope, vendor and exchange rate. Separate one-off build from recurring verification fees, hosting and tuning. Compare two or three written quotations on identical scope, and ask each vendor how false positives will be measured, because a system that blocks 5% of genuine customers can cost more than the fraud it stops.

Payment gateways include basic card-fraud controls at no extra development cost, and for a small shop that plus a handful of order rules may be all that is needed. Custom AI fraud detection is justified when losses are material, patterns are specific to your operation, or you are regulated.

Step-by-step: building a fraud detection capability

The first step is to quantify losses by fraud type from the last six to twelve months; the second is to fix structural weaknesses that need no AI; the third is to deploy rules with outcome recording; and only then do you train models on the labelled history those rules produce.

1. Quantify. List fraud incidents by type, amount and how they were discovered. This decides where to start.
2. Close structural gaps. API-verified transfers, delivery OTPs, segregation of duties, access controls.
3. Write rules with owners. Each rule has a threshold, an action and a person who reviews its alerts.
4. Build the outcome log. Every flagged case gets a final label: fraud, genuine or unresolved.
5. Deploy batch anomaly reports for internal and operational fraud; cheap and quick to value.
6. Add real-time scoring only where the decision must happen inline (card checkout, payouts, logins).
7. Train a model when you have enough labelled cases; run it in shadow mode alongside rules for several weeks before letting it block anything.
8. Review monthly: fraud caught, fraud missed, false-positive rate, customer complaints, and new patterns from customer service and operations staff.

For the integration mechanics, the articles on connecting AI to your business database and connecting AI to your business APIs are useful companions.

Mistakes to avoid

• Buying a model before fixing the basics. If transfers are confirmed by screenshot, no scoring engine will save you.
• Blocking silently. Genuine customers who are blocked with no explanation leave and complain publicly. Use step-up verification and a clear path to resolution.
• Ignoring false positives. Measure them. A tight system that rejects real ₦200,000 orders is a revenue leak.
• No outcome labels. Without recording what was actually fraud, the model cannot learn and you cannot prove the system works.
• Treating internal fraud as an HR matter only. It is a data problem first; the patterns are visible if you look.
• Over-collecting identity data. Holding BVN, NIN or ID scans you do not need creates NDPA 2023 liability and a breach target. Collect the minimum.
• Static rules. Fraudsters learn thresholds quickly; review and vary them, and let models catch what rules miss.
• Building everything real-time. Batch reports catch most internal and order fraud at a fraction of the cost.

Conclusion

The businesses that control fraud well in Nigeria are not the ones with the most sophisticated models; they are the ones that fixed the structural holes (screenshot payments, unverified deliveries, unlogged staff actions), wrote clear rules with owners, and recorded outcomes so their systems could learn. AI fraud detection then earns its cost by scoring the cases rules cannot catch, spotting internal patterns nobody was watching, and doing so without turning away genuine customers. Quantify your losses by type, start where the money is leaking, and keep a human reviewing whatever the system holds.

If you are losing money to fake orders, chargebacks or activity you cannot see across riders, agents or branches, Linestech can help you map the fraud signals in your existing systems, design the rules and anomaly reports, and integrate scoring into your checkout and operations.

Frequently asked questions

Can AI stop fake bank transfer alerts?

The reliable fix is not AI: confirm every transfer through your bank or payment provider's API, or use virtual account numbers so each payment is matched automatically. AI then helps with patterns among genuine transfers, such as the same payer name funding many customer accounts, or timing anomalies that suggest a compromised account.

Does my payment gateway already do fraud detection?

Nigerian gateways such as Paystack, Flutterwave and Interswitch apply their own card-level fraud controls and 3D Secure or OTP checks. They cannot see your order context, delivery history or staff behaviour. A business-side layer adds those signals and covers pay-on-delivery, transfers, refunds and internal fraud, which gateways do not address. Verify each provider's current controls in its documentation.

How many fraud cases do I need before machine learning is useful?

As a rough guide, a supervised model needs a few hundred confirmed fraud cases and several thousand genuine events to learn reliable patterns. Below that, use rules and anomaly detection, which need no labels, and record outcomes carefully so a model becomes possible later. Small businesses often stay on rules indefinitely and do fine.

Will fraud detection slow down my checkout?

Real-time scoring is designed to return within a fraction of a second, and only card and account-change decisions need it. Order and internal fraud checks can run in batches with no effect on checkout. Always define fail-safe behaviour for when the scoring service is slow or unreachable, so the customer is not stuck.

Is using customer data for fraud detection allowed under the NDPA?

Fraud prevention is a recognised legitimate purpose, but you still need a lawful basis, transparency in your privacy notice, data minimisation and appropriate security. Sensitive identity data such as BVN or NIN should only be processed where genuinely required and, for regulated activities, in line with the relevant regulator's rules. Confirm your approach with the Nigeria Data Protection Commission's guidance and a qualified adviser.

Can AI detect fraud by staff and dispatch riders?

Yes, and it is often the most valuable application. Anomaly detection compares each person's behaviour (void rates, failed-delivery rates, adjustment timing, float balances) against peers and their own history, and flags outliers for management review. It works best when POS, delivery and inventory systems log actions by user, and it should feed an investigation process rather than automatic sanctions.

Sources and further reading

Figures, platform rules and regulations change. These are the primary references behind this article and the places to check before you act on it.

• Nigeria Data Protection Commission (NDPC)
• Central Bank of Nigeria (CBN)
• Paystack developer documentation
• Flutterwave developer documentation
• OpenAI platform documentation
• Anthropic developer documentation
• Baymard Institute e-commerce UX research