The Nigeria Financial Intelligence Unit has uncovered an emerging crowdfunding network being exploited to raise and channel funds for terrorist operations.
This is as the agency said terrorist financiers were opening bank accounts in women’s names as well as using phone numbers for mobile banking or account alerts that are not registered to the account holder or the true beneficiary.
The disclosures are contained in the NFIU’s 2025 Annual Report, obtained by The Newsmen from a top official.
According to the report, the crowdfunding scheme involves foreign-based facilitators using social media platforms to solicit donations under the guise of humanitarian relief or educational support, before moving the funds through multiple layers to terrorist operatives in Nigeria.
The NFIU said hundreds of sympathisers were typically encouraged to make relatively small donations, ranging from $50 to $500, through PayPal pages or conventional bank accounts, with the amounts deliberately kept low enough to evade automated anti-money laundering alerts.
“The following is a case study on Crowdfunding Network identified during the year: A foreign-based facilitator runs social-media campaigns claiming humanitarian relief or educational support and uses encrypted apps (Telegram, Signal) to share links to convincing PayPal pages or standard bank accounts.
“Hundreds of sympathiser donors contribute $50–$500 each, amounts small enough to avoid most automated AML alerts,” the report read.
The funds are subsequently pooled into a “master account” controlled by a senior member of the group living legally abroad.
“When the pool reaches a threshold, that account becomes the hub for onward movement,” the report stated.
The NFIU said the funds were then fragmented into dozens of smaller payments and transferred through International Money Transfer Operators and remittance applications to a network of money mules in Nigeria.
It identified students, small-business owners and relatives among those used as mules, noting that the strategy was designed to avoid reporting thresholds and obscure the origin and destination of the funds.
“Rather than sending one large transfer, the senior member fractures the funds and sends dozens of sub-threshold payments through IMTOs and remittance apps to a network of money mules in Nigeria; students, small-business owners, or relatives, avoiding reporting triggers.
“Upon receipt, the money was either converted to cash, used to purchase dual-use items such as motorcycles, fertilisers and satellite internet equipment, or transferred through mobile banking channels to logistics managers and field operatives,” it added.
The report described the final stage as the “integration” of the funds into terrorist operational financing.
The Unit also identified the use of gender-based proxy accounts as another emerging terrorist financing technique, with terrorists opening bank accounts in women’s names while male commanders or logistics managers secretly control them.
“Terrorist financiers are opening bank accounts in women’s names while male commanders and logistics managers secretly control them.
“They exploit cultural norms that make women less likely to be suspected by authorities, using wives, sisters, or female associates as fronts to distance illicit funds from the true operatives.
“This tactic functions as identity laundering: women’s accounts are managed by men who hold ATM cards, mobile-banking credentials, and PINs, while the women often remain unaware of the transactions and volumes,” the report stated.
The report further revealed that terrorist facilitators were using telephone numbers that were not registered to the account holders or actual beneficiaries for mobile banking and transaction alerts.
It said pre-registered SIM cards, numbers registered to deceased persons and SIMs linked to gender-based proxies were being used to break the connection between bank accounts, SIM cards and Bank Verification Numbers.
“Terrorist facilitators use phone numbers for mobile banking or account alerts that are not registered to the account holder or the true beneficiary.
“They bypass the security link between SIM cards and BVNs by using pre-registered SIMs, SIMs registered to deceased people, or SIMs tied to gender-based proxies. This severs the audit trail: when a transaction is flagged, investigators trace the phone to an unrelated person, letting the real facilitator stay anonymous and continue operations,” it stated.
The NFIU also uncovered sophisticated methods of disguising terrorist transactions through detailed or coded narrations.
It said cells, particularly those linked to the Islamic State West Africa Province, used precise transaction descriptions to maintain what analysts described as an internal accounting system.
According to the report, frequent logistics-related payments with detailed narrations were often sent from a single source to multiple recipients, reflecting a structured financial system within the terrorist network.
“Terrorist cells, particularly those linked to ISWAP, routinely use precise, professional-sounding transaction narrations to maintain internal accounting. Operating like “shadow states” with strict bureaucratic controls, they require detailed descriptions so field commanders can justify expenses to central financial controllers. Although truthful narrations appear counterintuitive, they create an internal audit trail; analysts repeatedly observe high-frequency, logistics-related payments with accurate narrations sent from a single source to multiple recipients,” the report said.
However, the NFIU said some facilitators used innocuous words, secret codes and alphanumeric strings in transaction descriptions, sometimes switching between languages, to conceal the purpose of payments and evade automated bank filters.
“Transaction descriptions employ innocuous words, secret codes, or alphanumeric strings to conceal intent. Facilitators use this coded language, often switching languages to evade banks’ automated keyword filters that flag terms like ‘Jihad,’ ‘Arms,’ or ‘Boko.’