This incident occurred just one month after Flutterwave secured a court order to recover $24 million lost due to unauthorized POS transactions, TechCabal reported.
According to a financial services insider with direct knowledge of the incident, perpetrators illegally transferred ₦11 billion ($7 million) to several accounts in April 2024. However, another insider claimed the amount involved was at least ₦20 billion ($13.5 million).
Flutterwave’s Response:
“As is common in the financial services industry, there will always be attempts by bad actors to compromise the security of systems set up to protect and monitor services,” Flutterwave told TechCabal in a statement. “In April, we detected unauthorized activities inconsistent with usual customer behavior on one of our platforms used by a small subset of our customer base.”
Flutterwave did not disclose the exact amount involved but stressed that “no customer funds were lost or compromised, and the confidentiality of our customers’ data remains secure.”
However, a highly-placed individual with insight into the incident revealed that the stolen funds were transferred to multiple accounts across five financial institutions over four days. The incident likely went unnoticed as the perpetrators ensured the deposits stayed below thresholds that would prompt fraud checks.
Breach issues are not new to Flutterwave. In February 2023, hackers transferred over ₦2.9 billion from Flutterwave accounts. In October 2023, about 6,000 account holders across 35 banks and financial institutions received ₦19 billion ($24 million) illegally transferred through unauthorized transactions by POS merchants.
The matter has been reported to law enforcement, and investigations have commenced, stated the same individual who requested anonymity. Two executives in the financial services industry confirmed the incident, noting that Flutterwave had reached out to request KYC details of the accounts involved. They also claimed the accounts related to the incident have been temporarily restricted.
