XpressVerify.com, a private website, has unrestricted access to the National Identification Numbers (NINs) and personal details of every registered Nigerian, FIJ has found.
This website has monetised the recovery of NINs and personal information on the Nigerian identification database.
The website and the National Identity Management Commission (NIMC) are yet to tell FIJ what relationship both entities have.
Section 14 of the NIMC Act 2007 mandates NIMC to be the body that creates, manages, maintains and operates the National Identity Database.
NIMC has its specialised website and mobile application.
FIJ has found that XpressVerify, a standalone website, has been managing and using information from the National Identity Database.
Anybody can retrieve details such as phone numbers, full names, NIN, address and photographs of any Nigerian whose data is on the National Identity Database with as low as N200.
The website does not confirm what type of person can check what type of information. There were no restrictions to the number of NIN-related data that could be fetched when FIJ checked.
Vendors across different Nigerian cities have been checking the NINs and phone numbers of citizens from the same database NIMC ought to maintain and keep secure.
“I’ve found my (lost) NIN phone number… Everyone’s NIN information, including phone number and address, can be found here. That’s pretty scary,” a lady told FIJ on Friday.
She had gone to a kiosk, where private vendors promised to resolve countless NIN challenges in Lagos, to recover a NIN-linked phone number she had forgotten about.
The vendor asked for a N1,000 service fee to recover her phone number, but the unprecedented March network downtime forced the vendor to abort after several trials. A peep at his computer screen gave away the website: xpressverify.com.
When FIJ checked xpressverify.com, the website only asked the new user to register and sign in with a new profile.
The new user then had to buy units. A unit costs N200, and each unit can be used to make one verification at a time.
The user can use either a phone number, a NIN or a few demographic details to retrieve more data from any individual’s registration slip on the National Identity Database.
This reporter found his personal information and those of a colleague on xpressverify. For N200 each, our respective states of origin, phone numbers, cities of residence, home addresses, heights, central ID and tracking identifications were public information.
A random phone number search also brought up the full details of a random Nigerian whose data was registered by NIMC.
Xpressverify has no social media presence. NIMC never mentioned a partnership with Xpressverify or any other private website to manage the national database.
FIJ sent a mail on Friday to ask NIMC if it had third-party vendors gaining access to the National Identity Database. The commission had not responded at press time.
Xpressverify has only one phone number on which it receives complaints and inquiries. It had not told FIJ its relationship with NIMC at the time of this report.
After FIJ’s Story, Namecheap Suspends Private Website Selling Nigerians’ NIN, Other Data
Xpressverify, an identity verification website that makes money from selling out the personal information of Nigerians, has been suspended by its domain registrar, FIJ can report.
This development follows a report by FIJ detailing how Xpressverify had unrestricted access to the National Identification Database and personal details of Nigerians despite being a privately owned website.
Namecheap Incorporated, the domain registrar through which the website’s domain was bought, hinted at the domain suspension via its official social Media handle on Sunday.
However, FIJ found that this website might still be available to some individuals, despite the domain’s suspension. This, according to the domain registrar, might be due to a phenomenon called propagation.
Typically, requests to view websites do not go to host servers directly. Depending on the location of the person searching, requests to view a website go to the memory of the local internet service providers to source information.
It takes 24 to 72 hours for these internet service providers to update their caches. It could therefore take the same amount of time for the suspension to take effect for internet users in some locations.
Meanwhile, in response to FIJ’s story, Bosun Tijani, the minister of information and digital economy, has stated that the Nigeria Data Protection Commission will work with the National Identity Management Commission to investigate the situation.
Credit:FIJ
