CBN card fraud rules for Nigerian merchants
What the CBN's card fraud measures mean for a Nigerian business taking cards online and on a POS terminal, and how card sales reach the books.
By Achekam · · 5 min read · For Running a business businesses in Nigeria
A customer in Abuja taps "pay" on your invoice link and is suddenly asked for a code from their bank. Another customer at your shop counter enters the wrong PIN a few times and walks away with a blocked card and no goods. Neither moment is your system misbehaving. Both come from fraud measures the Central Bank of Nigeria has put around card payments.
Most of those measures are aimed at banks, switches and acquirers rather than at the shop or the online seller. They still decide what your customers experience, what your bank asks of you before it hands over a terminal, and how you should train the people who take the money. This article walks through them from the merchant's side of the counter.
The extra step on card-not-present payments
A card-not-present payment is any sale where the card is not physically at your terminal: a website checkout, a pay link sent with an invoice, an order taken by phone and keyed in by a payment provider. Under the CBN's card fraud prevention measures, these payments require second-level authentication. In practice the customer is asked to prove it is really them, usually with a one-time code or an approval in their banking app, before the card is charged.
For a business, three things follow:
- Some payments will start and never finish. A customer who cannot find their phone or whose code expires leaves the payment incomplete. Treat a payment as received only once your provider confirms it succeeded.
- Tell customers what to expect. A line on the invoice e-mail saying their bank may ask them to confirm the payment saves a phone call.
- Do not take card details yourself to "help". Reading a card number over the phone and typing it somewhere else defeats the very step the CBN requires.
PIN monitoring and the three-attempt block
At a physical terminal, the CBN expects banks to have real-time online monitoring tools for PIN entry attempts, and a card is blocked automatically after three unsuccessful PIN attempts. That block is the bank's decision, not your terminal's, and your cashier cannot lift it.
The practical lesson is for the counter. When a customer's first or second PIN attempt fails, the kind response is to offer another way to pay, such as a transfer to your account, rather than to encourage one more guess. A customer who leaves with a blocked card blames the shop, fairly or not.
Before the terminal arrives: due diligence and GPS
The CBN says proper due diligence should be done on all merchants before a POS terminal is allocated to them. It also lists Standards and Guidelines on ATM and POS Operations in Nigeria among its payments system measures. Expect your acquiring bank to ask who owns the business, where it trades and what it sells, and keep your registration documents and proof of address ready so the request does not stall.
The Nigeria Inter-Bank Settlement System (NIBSS) states that POS devices in Nigeria now require GPS tracking for recertification. For a merchant that means the terminal's location is part of the picture. A terminal that wanders far from the address you gave, or that is lent to another trader, invites questions when it is recertified.
The CBN's Payments System Supervision page sets out its mandate over the payment system and lists these card and POS measures among its initiatives. Check it, and your bank's merchant agreement, rather than relying on a summary.
Which cards a Paystack pay page takes
If you collect card payments online through Paystack, its documentation says it supports Visa and Mastercard cards in all its markets, Verve cards in Nigeria, and Amex in Nigeria, South Africa and Kenya. A Nigerian customer holding a Verve card can therefore pay a naira invoice through a Paystack page, and the second-level authentication step described above still applies to that payment.
How card money reaches your books in Achekam
Achekam treats the two kinds of card payment differently, because they arrive differently.
Online, on an invoice. A business can take Paystack payments on its invoices in NGN, KES, GHS, ZAR or USD. Each payment is confirmed with Paystack before it is recorded: notifications are checked by signature and re-verified with Paystack's verify API, after the business pastes the webhook address Achekam gives it into its Paystack dashboard. A verified payment is then recorded as a receipt against the invoice, debiting the gateway's clearing account and crediting trade receivables, and the invoice shows as paid or part-paid. The customer's payment goes straight to the ledger, with no one retyping it.
At the till, on a terminal. Achekam's till is not connected to any card machine. A card payment at the till is recorded by the cashier from the bank terminal's slip. The till also does not drive card terminals, receipt printers, cash drawers, scales or a customer display; that needs a device bridge Achekam does not have today. What the till does do is post: every till sale that reaches the server posts a balanced journal in the same step, with each payment method to its own account, so card takings sit apart from cash and can be matched to the bank's settlement.
Because the cashier copies the slip, the slip matters. A sale recorded as card when the terminal actually declined it is a cash shortfall waiting to be discovered. The section below is written with that in mind. For the wider choice of ways to take money at the counter, see payment methods at a Nigerian till, and for connecting a provider to your invoices, setting up your payment gateway.
Card-handling rules for your staff
A short set of house rules covers most of the risk on your side:
- Never record a card sale without an approved slip. "Pending" or "declined" on the slip means no sale.
- The customer enters the PIN, alone. Staff do not ask for it, look at it or type it.
- After a failed PIN, offer another method instead of another attempt.
- Keep the terminal at the trading address given to the bank, and never lend it to another business.
- Match the terminal's end-of-day total to the card total in the till before the cashier leaves.
- Online, wait for confirmation. An invoice is paid when the provider has confirmed it, not when the customer says they clicked.
- Report a lost or stolen terminal to the bank the same day.
Pin these rules beside the till and go through them with every new cashier. Then read your acquiring bank's merchant terms once a year: when the CBN changes a card rule, that is where it reaches you.
General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.
