Adaeze runs a small fabric import business in Aba. One afternoon, she gets an SMS from what looks like her bank: "Your account has been flagged for unusual activity. Click here to verify your details immediately." The link looks almost right. She clicks it.
Thirty minutes later, ₦340,000 is gone.
This story is not unusual. Nigerian banking phishing attacks are among the most sophisticated in West Africa, and they target MSMEs disproportionately — because business accounts hold larger balances and owners are often too busy to scrutinise every message carefully.
Lucrive Shield exists because of an incident like this — one that hit close to home for the Lucrive team. We built it and made it free for every Nigerian, account or no account.
Lucrive Shield is a free phishing URL checker at lucrive.io/shield. You paste a link you have received — by WhatsApp, SMS, email, or social media — and it tells you within seconds whether the link is likely legitimate, suspicious, or dangerous.
No account needed. No sign-in. It works for anyone.
You paste a URL. Shield runs seven checks simultaneously and returns one of three verdicts:
GREEN — the domain matches a verified Nigerian bank or fintech on our whitelist. The link is most likely genuine.
AMBER — something looks off. The domain is new, hosted abroad, unusually long, or has other signals that warrant caution. Do not proceed without verifying through official channels.
RED — the link shows strong phishing signals: it impersonates a known Nigerian bank name, is on a known blocklist, or scores high across multiple risk factors.
The seven checks Shield runs:
① Nigerian bank domain whitelist — a curated list of verified domains for 35+ Nigerian banks and fintechs, including GTBank, Access Bank, First Bank, Zenith, UBA, Opay, Palmpay, Kuda, and others. An exact match is a clean GREEN immediately.
② Typosquat detection — looks for domains that are one or two characters away from a real bank's name. "gtbankk.com" or "accessbank-ng.com" trigger this immediately.
③ Brand impersonation in subdomain — some phishing links put the real bank name in a subdomain to fool you: "zenithbank.some-random-site.com". Shield catches this.
④ Known blocklist — cross-references against databases of confirmed phishing and malware URLs.
⑤ Domain age — newly registered domains (under 30 days) are a strong signal. No legitimate bank registers a domain two weeks before a campaign.
⑥ Hosting location — legitimate Nigerian bank websites are hosted in Nigeria or by major CDN providers. Offshore hosting is a flag.
⑦ URL structure anomalies — unusually long URLs, excessive hyphens, or suspicious formatting patterns raise the score.
Each check contributes a risk score. Anything above 60 is RED. Between 25 and 60 is AMBER. Below 25 is GREEN.
A RED verdict means the link has strong phishing characteristics. Here is what to do:
Step 1 — Do not proceed. Close the message. Do not click, do not enter any details.
Step 2 — Contact your bank directly. Every major Nigerian bank has a dedicated fraud line. Do not use contact details from the suspicious message — look them up independently.
Here are the fraud lines for the most common Nigerian banks:
Shield shows you the official fraud line for the bank being impersonated — so you can call the right number immediately.
Step 3 — Report to the EFCC. The Economic and Financial Crimes Commission tracks phishing campaigns. You can submit a report at efcc.gov.ng/petition or call +234 809 332 2644.
Step 4 — Report through Shield. There is an anonymous report form at the bottom of Shield's results page. Every report helps us improve the detection for the next person.
An AMBER verdict does not mean the link is definitely fake — but it means something is unusual enough to verify first.
Call your bank using the number on the back of your card. Ask them whether they sent you that specific message. If they did not, you have your answer.
These three names come up in phishing flows involving fund movement — legitimate payment platforms being used as intermediaries after a victim's account is compromised.
If you receive a message claiming to be from any of these platforms asking you to verify a link, call them directly:
Shield includes verified domains for all three.
If you receive any message claiming to be from Heritage Bank Nigeria — asking you to update your account, transfer funds, or verify details — it is a scam. The Central Bank of Nigeria revoked Heritage Bank's banking licence on 3 June 2024. The bank is under NDIC liquidation. There is no active Heritage Bank system to log into.
Shield shows a "Revoked Licence" notice for Heritage Bank links rather than a standard verdict.
Shield checks URLs. It does not:
It is a single, fast check you run yourself when something looks off. Think of it as a second pair of eyes before you take action.
One habit worth building: whenever a message arrives asking you to click a link related to your bank, your business account, or any financial platform — paste the URL into Shield before you do anything else. It takes ten seconds. The cost of not doing it can be far higher.
If you work in a business with staff who handle payments or banking, share the Shield link with them. The most common entry point for phishing is not the business owner — it is the person who handles supplier payments or petty cash and is less familiar with what a bank's official URL looks like.
① Go to lucrive.io/shield — no account, no sign-in
② Paste the suspicious URL into the input box
③ Press Check this link
④ Read the verdict. If RED or AMBER, use the fraud contact shown and do not proceed.
That is it. The whole process takes under ten seconds.
Lucrive is a financial management platform built for Nigerian MSMEs — invoicing, tax calculation, budgeting, and pricing analysis. We built Shield because the team experienced a phishing incident firsthand. We did not want to keep it internal.
Shield is free, permanently, for everyone. You do not need a Lucrive account to use it. If you do want to manage your invoices, tax estimates, and receipts in one place, Lucrive is free to start →
And if you receive a phishing link, paste it into Shield first. Ten seconds could save your business.
Sources & further reading
People and businesses in our examples are illustrative, not real Lucrive customers. Figures are worked examples: confirm your own position with a qualified tax adviser.