{"id":438767,"date":"2026-11-01T18:38:46","date_gmt":"2026-11-01T18:38:46","guid":{"rendered":"https:\/\/malwaretips.com\/blogs\/?p=438767"},"modified":"2026-11-01T18:38:46","modified_gmt":"2026-11-01T18:38:46","slug":"ncc-device-verification-scam-fake-portals-otps","status":"publish","type":"post","link":"https:\/\/malwaretips.com\/blogs\/ncc-device-verification-scam-fake-portals-otps\/","title":{"rendered":"NCC Device Verification Scam: Fake Portals Ask for Bank Details and OTPs"},"content":{"rendered":"<p>A website says you need to verify your phone with Nigeria\u2019s communications regulator. The logo looks familiar, and the page seems built for a routine check.<\/p>\n<p>Then the form starts asking questions that have little to do with your device. Before completing it, take a closer look at who is collecting the answers.<\/p>\n<figure><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2026\/11\/ncc-device-verification-scam-fake-portals-otps-illustration.png\" class=\"wp-image-438768\" alt=\"Illustrative fake device verification portal requesting a bank account and one-time password\" width=\"1536\" height=\"1024\" title=\"\" srcset=\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2026\/11\/ncc-device-verification-scam-fake-portals-otps-illustration.png 1536w, https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2026\/11\/ncc-device-verification-scam-fake-portals-otps-illustration-300x200.png 300w, https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2026\/11\/ncc-device-verification-scam-fake-portals-otps-illustration-1024x683.png 1024w\" sizes=\"auto, (max-width: 1536px) 100vw, 1536px\" \/><\/figure>\n<h2>Overview<\/h2>\n<h3>A real device check becomes the cover story<\/h3>\n<p>The NCC device verification scam impersonates the Nigerian Communications Commission and its legitimate device checking service. Fraudulent websites borrow that service\u2019s purpose to make intrusive requests seem necessary.<\/p>\n<p>Someone expecting to check a handset may therefore arrive prepared to cooperate. The deception begins when that expectation is redirected toward an imitation portal.<\/p>\n<h3>The regulator identified an active phishing campaign<\/h3>\n<p>The <a href=\"https:\/\/csirt.ncc.gov.ng\/index.php\/resources\/security-advisories\/452-phishing-campaign-impersonating-official-verifymydevice-gov-ng-device-verification-portal\" target=\"_blank\" rel=\"noopener\">NCC-CSIRT advisory<\/a> identifies lookalike domains, copied branding, requests for banking information and one-time passwords, and payments for nonexistent services.<\/p>\n<p>These are fraudulent sites impersonating the regulator. This warning concerns those portals and their requests, rather than a complaint about Nigeria\u2019s genuine device verification program.<\/p>\n<h3>The requests that should stop the process<\/h3>\n<ul>\n<li>A verification page asks for an OTP from your bank or another account.<\/li>\n<li>The form demands banking details unrelated to identifying a handset.<\/li>\n<li>A payment is presented as necessary for the supposed verification service.<\/li>\n<li>A familiar logo appears on an address different from the regulator\u2019s published route.<\/li>\n<li>A deadline pressures you to finish before checking the instructions independently.<\/li>\n<\/ul>\n<h2>Why This Fake Verification Page Can Look Convincing<\/h2>\n<p>Device verification sounds like a task people might reasonably need to complete. It gives the page a specific purpose, rather than an obviously unrelated prize or offer.<\/p>\n<p>The site can then introduce additional fields one at a time. Each request feels easier to accept once the visitor has decided the service is official.<\/p>\n<p>The NCC describes copied logos and page designs. A visitor who recognizes the appearance may overlook the address and judge the form by its presentation.<\/p>\n<p>HTTPS adds another misleading reassurance. The connection can be encrypted while the person receiving your information is an attacker.<\/p>\n<p>Before paying, compare the request with the NCC\u2019s own instructions. A browser\u2019s connection indicator cannot establish that the regulator authorized the charge.<\/p>\n<p>The illustration above shows a fictional verification form with banking and OTP fields. It explains the dangerous combination, rather than reproducing a captured NCC phishing page.<\/p>\n<p>Real versions can change their layout or wording. Recognizing the demand for sensitive information matters more than memorizing one screen\u2019s colors or button labels.<\/p>\n<h2>How the NCC Device Verification Scam Works<\/h2>\n<h3>Step 1: A lookalike address introduces the supposed service<\/h3>\n<p>The campaign directs people toward domains that resemble a device verification service. Some include words such as secure, verify, device, or NCC.<\/p>\n<p>Those terms help the address fit the task. They do not give the site authority to represent the regulator or collect financial information.<\/p>\n<p>The advisory names the following addresses. They are written here in a disabled format so they cannot be opened accidentally.<\/p>\n<ul>\n<li>secure-verifymydevice[.]ng<\/li>\n<li>verifymydevice[.]com[.]ng<\/li>\n<li>embed-ncc[.]registrmydevice[.]ng<\/li>\n<li>verifymydevice[.]ng<\/li>\n<\/ul>\n<p>The presence of a Nigerian domain ending does not itself prove fraud. The specific addresses and their imitation of the official service are what the advisory identifies.<\/p>\n<p>Likewise, an unfamiliar domain should not be investigated by submitting a test OTP or making a small payment. Neither experiment safely establishes who operates it.<\/p>\n<h3>Step 2: Familiar branding encourages the visitor to continue<\/h3>\n<p>The fake portal copies the regulator\u2019s appearance and presents verification as its reason for collecting information. This makes the first interaction feel administrative.<\/p>\n<p>A phone identifier can seem relevant to that task. The risk grows when the page uses that reasonable starting point to normalize unrelated questions.<\/p>\n<p>Urgent language can shorten the decision. Instead of asking why a device check needs banking information, the visitor concentrates on getting the process finished.<\/p>\n<p>There is no need to argue with the page or prove its claims false while it is open. Leave it and check the official instructions separately.<\/p>\n<h3>Step 3: The form asks for information that can affect other accounts<\/h3>\n<p>The NCC warns about requests for OTPs, bank details, and other sensitive information. These requests change the situation from a device inquiry into an account security risk.<\/p>\n<p>An OTP may authorize a login, a transaction, or an account change. Its purpose depends on the service that issued it and the accompanying message.<\/p>\n<p>Typing a code into a fake verification page can therefore assist an action elsewhere. The device checking story does not make that code safe to share.<\/p>\n<p>Read any genuine notification carefully. If it describes an action you did not start, stop rather than treating the code as another required field.<\/p>\n<p>The advisory does not establish that every visitor suffered the same compromise. The information entered and the actions approved determine which accounts need attention.<\/p>\n<h3>Step 4: A supposed verification requirement becomes a payment demand<\/h3>\n<p>Some portals demand money for services that do not exist. The authority claim supplies the reason to pay, even though the payment is part of the fraud.<\/p>\n<p>Do not infer that a charge becomes legitimate because the page has already accepted your device details. Completing earlier fields does not validate later requests.<\/p>\n<p>A payment receipt from the recipient would not establish regulatory approval either. It would only record that money moved through the chosen payment route.<\/p>\n<p>The warning does not publish a universal fee, a confirmed loss total, or one payment method used in every version. Avoid relying on an amount alone.<\/p>\n<h3>Step 5: The visitor leaves with uncertainty about what was completed<\/h3>\n<p>A submitted form may leave someone believing their handset is now verified. That belief can delay checking bank activity or reporting an unauthorized account action.<\/p>\n<p>Return to the genuine service to establish your device\u2019s actual status. Treat any exposed financial or account information as a separate problem requiring its own response.<\/p>\n<p>The NCC also lists possible harmful redirects among the risks. That does not establish that every visit installs malware or that a particular payload reached your phone.<\/p>\n<h2>How to Reach the Genuine Device Checking Service<\/h2>\n<p>The NCC advisory directs users to verifymydevice.gov.ng and the device checker reached through the NCC\u2019s own website, www.ncc.gov.ng\/devicechecker.<\/p>\n<p>Open the regulator\u2019s site independently, rather than using the questionable message as your starting point. Compare the instructions before providing any information.<\/p>\n<p>The advisory also lists the USSD code *315# and the NCC consumer contact number 622. Confirm these through the official site when you need assistance.<\/p>\n<p>You can read the official instructions before starting a check. Do not submit a handset identifier to an unfamiliar page simply to see what happens next.<\/p>\n<p>According to the NCC, legitimate verification does not require an OTP, banking details, or other sensitive information. A page demanding them deserves an immediate stop.<\/p>\n<p>Check the complete address, including its ending, rather than searching for a familiar word inside it. Attackers can place convincing words in addresses they control.<\/p>\n<p>For someone helping a relative, send the official regulator\u2019s starting page and explain the suspicious request. Avoid forwarding the fraudulent link as though it were usable guidance.<\/p>\n<h2>What to Do if You Have Fallen Victim to This Scam<\/h2>\n<ol>\n<li><strong>Stop using the imitation portal.<\/strong> Close the page and refuse further requests for codes, payments, documents, or remote help.<\/li>\n<li><strong>Record what you supplied.<\/strong> Note the address, time, fields completed, codes entered, and any payments. Preserve messages and receipts without returning to the form.<\/li>\n<li><strong>Contact your financial provider quickly.<\/strong> Use its official app, your card, or a trusted statement. Explain precisely which bank or card details were exposed.<\/li>\n<li><strong>Identify the purpose of any OTP.<\/strong> Tell the issuing provider that you entered its code on a fraudulent site. Ask it to check the associated action.<\/li>\n<li><strong>Secure an affected account.<\/strong> Change an exposed password through the genuine service. Review access, recovery methods, and recent changes, with help from the provider where needed.<\/li>\n<li><strong>Report the fake portal.<\/strong> Use the NCC\u2019s official contact or CSIRT reporting route. Include the address and supporting evidence, with sensitive personal information protected.<\/li>\n<li><strong>Check your device through the real service.<\/strong> A fake confirmation does not establish official verification. Ask the NCC for help if the genuine result is unclear.<\/li>\n<li><strong>Watch for follow-up approaches.<\/strong> Refuse anyone asking for another payment or code to reverse the first problem. Verify every recovery contact independently.<\/li>\n<\/ol>\n<h3>If you paid the supposed verification fee<\/h3>\n<p>Ask the payment provider whether it can stop, recall, or dispute the transaction. Available options depend on how you paid and whether the money has moved.<\/p>\n<p>Describe it as a payment induced by an impersonation website. Keep the recipient details and transaction reference, rather than relying only on a screenshot of the logo.<\/p>\n<p>A report does not guarantee a refund. Prompt, accurate information still gives the provider a better chance to identify the transaction and explain the available route.<\/p>\n<h3>If you only entered device information<\/h3>\n<p>Tell the NCC what type of identifier you provided and ask whether further precautions are appropriate. Do not assume that a handset identifier alone permits a bank withdrawal.<\/p>\n<p>Be alert to messages that repeat your device details to appear credible. Information copied from one form can make a later impersonation attempt feel more personal.<\/p>\n<p>You do not need to replace every password simply because you saw the page. Focus on any credentials, codes, permissions, or financial details actually exposed.<\/p>\n<h3>If you installed something or granted access<\/h3>\n<p>Stop using that session for banking and seek trusted technical assistance. Explain exactly what you installed, approved, or allowed someone else to control.<\/p>\n<p>The response should follow that additional exposure. Visiting a page, downloading a file, installing an application, and granting remote control are different events.<\/p>\n<p>Do not pay an unsolicited helper who appears after the incident. A second person using the NCC name still needs independent verification.<\/p>\n<h2>A Practical Check Before You Submit Another Form<\/h2>\n<p>Ask what the service is supposed to establish. A device check has a clear subject: the handset and its status.<\/p>\n<p>Then compare each request with that purpose. A bank login code authorizing a financial action does not become relevant because it appears beneath a device verification heading.<\/p>\n<p>When a request seems out of place, stop at that point. You can restart through the regulator after confirming the process.<\/p>\n<p>This is particularly useful on a small screen, where the address may be shortened. Scroll or inspect the full address before trusting a familiar page design.<\/p>\n<p>Keep legitimate notifications visible while checking an account. Their wording can help your provider identify what a stolen code was used to authorize.<\/p>\n<p>If you are unsure whether something completed, ask the genuine provider. Do not resolve that uncertainty by entering another code on the same suspicious page.<\/p>\n<h3>When someone else completed the form for you<\/h3>\n<p>Ask them to describe each field and approval without submitting anything again. They may remember a code or payment screen that you did not see.<\/p>\n<p>Check whose bank account or phone received the notification. The person who owns that account should contact its provider, even if the handset being checked belongs to you.<\/p>\n<p>Save the messages that arrived during the interaction. Their timestamps can help the provider connect a code with a particular account action.<\/p>\n<p>If a shop or helper supplied the address, tell them about the NCC advisory. Do not assume they operated the fraudulent portal simply because they shared it.<\/p>\n<p>Ask them to stop directing others there while they verify the route. Sharing the official notice is more useful than circulating the imitation page\u2019s live link.<\/p>\n<p>Finally, check whether they retained a copy of your details. Agree on a safe way to preserve evidence without spreading sensitive information to additional people.<\/p>\n<p>This keeps the response focused on the actual exposure and gives each account holder a clear next step.<\/p>\n<h2>Frequently Asked Questions<\/h2>\n<h3>Is the NCC device verification program itself a scam?<\/h3>\n<p>No. The warning concerns fraudulent portals impersonating the NCC\u2019s genuine service. Use the regulator\u2019s published route and check its current instructions independently.<\/p>\n<h3>Does a padlock mean the verification website is official?<\/h3>\n<p>No. HTTPS protects the connection to a site. It does not establish that the operator represents the NCC or has a legitimate reason to collect your information.<\/p>\n<h3>Should device verification require my bank OTP?<\/h3>\n<p>The NCC says legitimate verification does not require OTPs or banking details. Stop if a supposed verification page asks for them, and check with the regulator directly.<\/p>\n<h3>Are all websites ending in .ng fraudulent?<\/h3>\n<p>No. The domain ending alone is not a verdict. The advisory identifies particular imitation sites; compare the complete address with the official service.<\/p>\n<h3>Does opening the fake portal mean my phone has malware?<\/h3>\n<p>That conclusion is not established by the warning. Your next steps depend on whether you submitted information, approved an action, installed software, or granted access.<\/p>\n<h3>Can I recover a verification payment?<\/h3>\n<p>Contact the payment provider immediately and ask about stopping, recalling, or disputing it. Recovery depends on the transaction and cannot be guaranteed.<\/p>\n<h2>The Bottom Line<\/h2>\n<p>These portals borrow a legitimate device check to collect information or payments the service does not require. The NCC has identified the impersonation campaign.<\/p>\n<p>Leave any form asking for banking details or an OTP. Start again through the genuine NCC route, and report any exposed account information to its actual provider.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>A website says you need to verify your phone with Nigeria\u2019s communications regulator. The logo looks familiar, and the page seems built for a routine check. Then the form starts asking questions that have little &#8230; <\/p>\n<p class=\"read-more-container\"><a title=\"NCC Device Verification Scam: Fake Portals Ask for Bank Details and OTPs\" class=\"read-more button\" href=\"https:\/\/malwaretips.com\/blogs\/ncc-device-verification-scam-fake-portals-otps\/#more-438767\" aria-label=\"Read more about NCC Device Verification Scam: Fake Portals Ask for Bank Details and OTPs\">Read more<\/a><\/p>\n","protected":false},"author":51,"featured_media":438768,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[49],"tags":[],"class_list":["post-438767","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-scam-reports","masonry-post","generate-columns","tablet-grid-50","mobile-grid-100","grid-parent","grid-50","resize-featured-image"],"_links":{"self":[{"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/posts\/438767","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/users\/51"}],"replies":[{"embeddable":true,"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/comments?post=438767"}],"version-history":[{"count":2,"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/posts\/438767\/revisions"}],"predecessor-version":[{"id":438844,"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/posts\/438767\/revisions\/438844"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/media\/438768"}],"wp:attachment":[{"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/media?parent=438767"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/categories?post=438767"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/tags?post=438767"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}