AI agents for business finance: what they can and can't do
What AI agents can do in bookkeeping, close, collections and compliance today, where a person must stay in charge, and how to judge a product.
The short answer
Change your email password first, then the breached service’s password and any account where you reused it, then PINs and cards if those were named. Under the Nigeria Data Protection Act 2023, a company must notify the NDPC within 72 hours of a risky breach and tell you immediately where the risk to you is high.
First, work out what actually leaked
Breach headlines rarely say exactly what was taken, and the right response depends on it. Before changing everything in a panic, read the company’s own notice (email, in-app message or website statement) and look for which of these categories it names. Each one enables a different kind of fraud.
| What leaked | What a criminal can do with it | What you change or watch |
|---|---|---|
| Name, phone number, email | Send convincing texts, calls and emails that quote your real details and pretend to be the bank | Nothing to "change", but treat every contact claiming to be the bank as suspect for months |
| Account number and balance or transaction history | Make a fake "fraud department" call sound real by quoting a recent payment | Same as above; never act on an inbound call, always call back on the number printed on your card or in the app |
| Date of birth, address, BVN or NIN | Answer security questions, attempt a SIM swap by posing as you, open accounts elsewhere | Put a SIM PIN on your line, ask your telco about extra checks, watch for accounts you did not open |
| Password (even if "encrypted") | Try the same email and password on other sites (credential stuffing) | Change that password everywhere you reused it |
| Card number, expiry, CVV | Online card fraud | Block and replace the card; set online and foreign usage off in card controls |
| Security answers or PIN | Pass phone verification, approve transactions | Change PIN and every security answer at once |
If the notice is vague, assume the worst category that the company could plausibly have held about you, and act on that.
What to change now, in order
Do these in this order, because the earlier items protect the later ones.
- Your email password and two-step verification. Password resets for almost everything go to your email. If the breached service sent you there, secure it first. See securing Gmail for banking.
- The breached service’s password, to something long and unique, created in a password manager.
- Every other account where you used the same password. This is the step most people skip, and it is how one breach turns into five.
- Your transaction PIN and app passcode on the affected bank or app, if PINs or security details were mentioned. Do not reuse one PIN across banks (more on that in using the same PIN for all banking apps).
- Card replacement, if card data was named. Block the card in the app first, then request a new one.
- Move off SMS codes where you can. If your phone number and personal details leaked, a SIM swap becomes easier. An authenticator app or in-app token is not tied to the SIM.
Your rights under the Nigeria Data Protection Act
The Nigeria Data Protection Act 2023 (NDPA) sets out what a company holding your data must do after a breach. According to a summary of section 40 by the law firm Udo Udoma & Belo-Osagie (September 2023):
- The company (the "data controller") must notify the Nigeria Data Protection Commission (NDPC) within 72 hours of becoming aware of a breach that is likely to put people’s rights and freedoms at risk. Information may be given in phases if it is not all available at once.
- Where the breach is likely to result in a high risk to you, the company must tell you directly and immediately, and explain the measures you can take to reduce the harm.
- If contacting everyone directly would be disproportionate, it may use widely used media instead; the NDPC can also make its own public statement if it thinks the company’s communication is inadequate.
- Companies must keep records of every breach, its effects and the remedial action taken.
Separately, the NDPC lists the rights you hold as a data subject, including access to your data, correction, erasure, restriction, objection and the right to complain to the Commission. This is information, not legal advice; read the Act or speak to a lawyer if you are considering a claim.
How to complain
- Write first to the company, ideally to its data protection officer if one is named in its privacy policy. Ask what data of yours was affected and what it is doing about it. Keep a copy.
- If the answer is unsatisfactory, complain to the NDPC. Its contact page lists info@ndpc.gov.ng and +234 (0) 916 061 5551, with offices in Life Camp, Abuja.
- Under the NDPC’s 2025 General Application and Implementation Directive, the Commission aims to acknowledge a complaint within 7 days and the company has 21 days to respond.
If money has already left your account, a data-protection complaint is not the fast route. Report to your bank immediately and follow what to do in the first hour after fraud.
The next three months: what to watch
- Every debit alert. Turn on both email and SMS alerts so one channel failing does not hide a transaction.
- Calls and texts that use your real details. A caller who knows your name and last transaction is not proof they are your bank.
- Your phone signal. A sudden "no service" or "SIM not registered" message, while others around you have signal, can mean a SIM swap in progress. Call your network from another phone.
- Emails saying your password was changed, or a "new device" signed in, that you did not trigger.
- Unknown loan or account messages, which can mean someone used your identity elsewhere.
You can also check whether your email address appears in other known breaches using the method in how to check if your email or password was leaked.
Where Pryme fits
If you hold money with Pryme, the same order applies: secure your email first, then your Pryme passcode and transaction PIN. Pryme sign-in uses an authenticator app rather than SMS codes, which limits what a leaked phone number can do; see the security page.
Questions people ask
My bank had a data breach, should I close my account?
Not necessarily. Closing the account does not recall leaked data. Changing passwords and PINs, replacing a card if card data leaked, and watching alerts usually matter more.
Does a bank have to tell me if my data was leaked in Nigeria?
Under section 40 of the NDPA 2023, as summarised by Udo Udoma & Belo-Osagie, a company must tell you immediately where a breach is likely to pose a high risk to you, and must notify the NDPC within 72 hours of a risky breach.
Can someone empty my account with my BVN and phone number?
Not with those alone, but they make phishing calls and SIM swap attempts more convincing. Never share an OTP or PIN, and put a SIM PIN on your line.
Where do I report a data breach in Nigeria?
Complain to the company first, then to the Nigeria Data Protection Commission at info@ndpc.gov.ng or +234 (0) 916 061 5551. Report any money lost to your bank straight away.
Sources
- Afriwise (Udo Udoma & Belo-Osagie): Data breaches, compliance obligations under the Nigerian Data Protection Act 2023, 28 Sep 2023 · accessed Oct 2026
- Nigeria Data Protection Commission: home page (data subject rights) · accessed Oct 2026
- Nigeria Data Protection Commission: Contact · accessed Oct 2026
- NDPC: Nigeria Data Protection Act General Application and Implementation Directive (GAID) 2025 · accessed Oct 2026
This article is general information, not financial, legal or tax advice. Products described are provided under the terms on this site and are subject to regulation and eligibility.