As Nigerians prepare to usher in the New Year 2026, cybersecurity experts and law enforcement agencies are raising the alarm over a fast-spreading online scam disguised as festive greetings on WhatsApp, Telegram, and SMS.
The scam, which has already triggered multiple complaints across social media and digital safety forums, involves fraudsters sending malicious New Year messages designed to look like personalised greetings from trusted contacts. Once opened, the messages can expose victims to financial theft, data breaches, and complete takeover of their mobile devices.
Although similar scams have been detected in other countries, cybersecurity analysts say Nigerian users are particularly vulnerable due to the widespread use of mobile banking, USSD transactions, and peer-to-peer transfers during the festive season.
How the New Year greeting scam targets Nigerians
Investigations by cybersecurity professionals show that the scam relies heavily on trust and familiarity. Victims receive messages that appear to come from friends, family members, church groups, or work colleagues, often because the sender’s WhatsApp account has already been compromised.
The messages usually carry festive captions such as “Happy New Year 2026 – open your card,” “You have received a special New Year gift,” or “Click to see your personalised New Year message.” Some versions promise cash rewards, airtime bonuses, or shopping vouchers, all designed to encourage quick clicks.
Once the link is opened, users are prompted to download an Android application file (APK). Security experts warn that this file is not a greeting card but a spyware-laden app that installs itself silently on the phone.
What happens after the malicious app is installed
After installation, the malware gains extensive access to the victim’s device, allowing cybercriminals to:
- Read incoming SMS messages, including bank alerts and one-time passwords (OTPs)
- Monitor notifications from Nigerian banking apps and fintech platforms
- Access contact lists, photos, media files, and stored documents
- Take remote control of the phone, including microphone access in some cases
- Hijack the victim’s WhatsApp account and automatically forward the scam to all saved contacts
With this access, fraudsters can initiate unauthorised transfers through mobile banking apps, USSD codes, and digital wallets. Some victims report repeated small withdrawals, a tactic used to avoid triggering bank fraud alerts immediately.
Cybersecurity experts say this method is especially effective in Nigeria, where many users rely on instant mobile transfers for daily transactions.
Why the scam spreads faster during festive periods
Digital safety analysts note that scams like this thrive during holidays because people are less cautious online. During festive periods, Nigerians exchange a high volume of greetings, videos, and forwarded messages, making it easier for malicious links to blend in.
Android users face a higher risk due to the ability to install applications from outside official app stores. Combined with the popularity of WhatsApp as Nigeria’s primary messaging platform, the scam can spread rapidly once a single account is compromised.
How Nigerians can protect themselves this New Year
Security agencies and cybersecurity professionals are urging Nigerians to take extra precautions as the year draws to a close:
- Avoid clicking links in unsolicited New Year messages, even if they appear to come from someone you know. Always confirm through a call or separate message.
- Do not download apps or updates sent via WhatsApp, Telegram, or SMS. Legitimate greetings do not require app installations.
- Share New Year wishes using plain text, images, videos, or stickers from trusted platforms.
- Enable two-step verification on WhatsApp and other messaging apps.
- Install apps only from official sources such as the Google Play Store.
- Be cautious of messages that create urgency, promise gifts or cash rewards, or request unusual permissions such as access to SMS or storage.
What to do if you have been affected
If you suspect your phone has been compromised, experts advise immediate action. Disconnect the device from the internet, uninstall any unfamiliar applications, and change passwords for your banking, email, and messaging apps.
Victims should also contact their banks immediately to block transactions and report suspicious activity. Complaints can be lodged with the Nigeria Police Force Cybercrime Unit or through the Economic and Financial Crimes Commission (EFCC) channels. Prompt reporting increases the chances of stopping further losses and tracing fraudulent activity.
As Nigerians prepare to welcome 2026, cybersecurity professionals are reminding the public that staying alert online is just as important as celebrating offline.
