In 2014 I developed an app concept which won a Sprint-sponsored pitching competition. The app was meant for users to send(ping) money to one another across social media platforms. In the process of developing the app I realized that BlackBerry couldn’t release their API for such, then came WhatsApp which was impossible as well, so I rested the project which I called Ping Cash.
Later on, sometime in 2017, I raised it again, but this time to be used as one of the emerging loan and investment apps, both direct and peer-2-peer investment. I rested it again, having discovered the general apathy to such as a result of the crash of MMM.
During the last weeks of 2020, as the COVID-19 devastation was being lifted, I embarked on massive ads for my services, many of which involved app development of various sectors. I then moved on to give massive discounts for such services when it was clear that the economy then didn’t give a lot of people the capacity to embark on certain projects.
It was in the various promos that I initiated that I was approached by a lending company which is also a Micro-Finance Bank, to develop a more robust and sophisticated technology for the loan and investment sector. I introduced Ping Cash to them, with a totally different idea from what it was birthed for, and far better that what are in the market. They accepted the idea, we signed the deal for a partnership. They were not the only one who approached me for projects. I had already done a game app of mythological gods for a Kenyan firm. There were others, many others who saw the promo as a chance to launch their businesses on apps.
For the purpose of meeting up with the project requirements I installed 18 quick loan apps and started testing them, including pen testing. I borrowed about N21, 000 from 5 of them and repaid some, and in the process discovered the risks users have been facing. These risks hit me like a hammer after, not just discovering them, but experiencing them. Some of the apps make you fill in some forms which give them access to all parts of your mobile device, except your IM apps. Not only that, they also make you fill in your very sensitive card information in open and insecure forms. I mean, your Bank Card details like your Card name, the number, the expiry date, and the CVV! And of course your account number and BVN. They store these details in their own database, and then lead you to authorize them to take money from your account when they deem fit and necessary. At this stage, they will open another form to fill your Bank Card details again! This time, the secure payment gateway they are using will pop up. Then, you fill the form, authorize them to deduct a token from your account, most times, N50 which they pay back.
To my dismay, I realized that as soon as I authorized one of them to take the N50, few hours later, around 8.43pm, I got a debit alert of N5, 485.00! I thought it was a joke, at 9.48pm, another debit alert came, this time, it was N5, 187.00!!! I quickly rushed to my bank’s Facebook Page and website, and laid my complaints immediately, they responded quick, to my surprise, and informed me that I authorized the deductions myself. They asked if they should deactivate my bank card to stop the deductions and go to my branch to change the card, I turned that down. I went on to dig out where the leak was from. I went back to PlayStore and re-installed all the L&I apps I had uninstalled, I did my own thorough check and realized where the leak was from.
Now, this will shock you. One of the apps, *CycleCash* was one of the apps that deducted the N50, the others were *LCredit*, *Sokoloan*. I dug deeper, having also seen that the money was deducted through Flutterwave, I narrowed the mess to *LCredit* and *Sokoloan* both of whom deducted the N50, and used Flutterwave. While I was awake doing all these, I got another debit alert for N3, 128.00!!! This was early in the morning, around 2.52am. That was when I quickly opened my bank app to deactivate my card. If I didn’t do that, I was sure I’d have gotten such alerts several times over.
I then went to the website of FlutterWave and used their dispute feature, confirmed that the sums were deducted through them, then laid my dispute. I started with the first N50 that I authorized. That N50 had a merchant name: Awe Olakiti*(FIGURE 1)* The first deduction of N5, 485 had a merchant name: Awe Olakiti again (of the N50)!*(FIGURE 2)* the second one of N5, 187 had the Mr.Tunde Alabi(FIGURE 3). That was when I decided to access some of those apps again. I did some pen testing, and realized the links. Ok, the third one of N3, 180 had a merchant name: Adeniji Tun*(FIGURE 4)*. Hmm!
Later that morning, I got a response from Flutterwave, acknowledging the receipt of my dispute. They promised to look into it. I approached some of the app contacts who were already sending me messages for more loans. From there I realized that these people took my card details, shared them with their syndicate outside their offices, these syndicate then use their merchant accounts in Flutterwave, being that I had authorized them to take my money when they wished, and started stealing from me. I rushed to the Facebook Page of Flutterwave to post it openly and saw a lot of similar complaints, up the tune of $500 stolen from someone!
I had confirmed that the L&I apps I mentioned above had links with Mr. Tunde Alabi and that the AdenijI Tunde is the same person. I had insisted that I’d not give them attention until I got my money back!
Now, some of the things I discovered about these people are that they abuse the details of their users at their disposal, they sell or release users’ information to members of their crime group for use making scam calls, stealing money from people’s accounts as they did mine, for unsolicited sms ads, and for hacking into Social Media accounts of users.
I had gotten messages from Flutterwave, *(FIGURES 5, 6, 7)*that the refund of my stolen money had been initiated and that I’d get the money between 3-15 days period.
I was able to dig further and gotten the numbers associated with these fraudsters: +2349086279721, +2348132399881, +2349135038465, +2349136680973. These numbers are associated with the said Flutterwave accounts, and also used to create scam Gmail accounts.
Some of these apps are created for good purposes, and businesses, while some of them are outrightly fraudulent e.g SokoLoan, LCredit and CycleCash, or have very fraudulent staffers as associated with the listed numbers. Avoid the listed apps if you can’t bear the pain of losing your money.
And thanks for your time!
Tchidi Chiemeziem Is a Software Engineer, a Certified CyberSecurity Professional.