There is no provision in Nigerian law that specifically defines deepfakes, prohibits their creation for fraudulent purposes, or creates a standalone offence for using AI-generated synthetic media to deceive. There is no mandatory labelling requirement obliging platforms or creators to identify AI-generated content as such. There is no specific civil cause of action that a victim of deepfake fraud can bring on the basis of the synthetic media itself, separate from the underlying fraud it was used to commit.
In February this year, Ngozi Okonjo-Iweala, director-general of the World Trade Organisation and one of the most recognisable Nigerian women alive, had to log onto X to tell her countrymen that she had not, in fact, invited them to invest a minimum of ₦380,000 in exchange for returns of ₦2.6 million in one week. A video had been circulating across WhatsApp, Instagram, and Facebook using a synthetic version of her face and voice to promote exactly that scheme. The video was slick, the voice was convincing, and for those who did not know that she does not maintain accounts on those platforms, there was nothing obvious to signal that what they were watching was a fabrication.
|
|
She was not the first. Ibukun Awosika, former chairman of First Bank of Nigeria, spent January doing the same thing, debunking AI-generated videos that placed her endorsement behind investment platforms she had never heard of. Nigerian social media, on any given week, carries deepfake content of celebrities and public figures promoting one scheme or another, and the volume of it is accelerating, rather than slowing down.
Within just a week of formulating the idea for this piece, I stumbled across five separate deepfake scams on TikTok. The roster of AI-generated targets was staggering: Wizkid, Rema, Ngozi Okonjo-Iweala, former President Olusegun Obasanjo, and even President Tinubu, all weaponised by fraudsters to pitch sketchy investment schemes.
|
|
|
|---|
The people whose faces are being stolen are famous enough to have platforms from which to respond. Most Nigerians who lose money to these schemes are not.
What Is Actually Happening
A deepfake is synthetic media generated through artificial intelligence, specifically through a category of machine learning that can replicate a person’s face, voice, and mannerisms with sufficient accuracy to deceive an untrained eye. The technology is not new, but its accessibility has changed dramatically. Tools that once required specialist knowledge and expensive hardware are now available cheaply, some freely, to anyone with a smartphone and a motivation to use them. According to Surfshark, deepfake incidents globally surged by 257 per cent in 2024, and the first quarter of 2025 alone recorded more incidents than the entire preceding year.
In Nigeria, the specific use case driving the most immediate harm is financial fraud. The formula is consistent: A trusted face, a credible-sounding voice, an investment opportunity with implausible returns, and a short window before “slots run out.” The Okonjo-Iweala video promised ₦2.6 million in the first week from a ₦380,000 investment, and added that only 4,000 slots were available, with more than 80 per cent already reserved. These pressure mechanics are designed to bypass scepticism, and they work because the face delivering them carries decades of earned credibility.
The targets of these schemes are not naive people who should have known better. They are ordinary Nigerians navigating a brutal cost-of-living environment, reached on platforms they use daily, presented with content that looks and sounds like a person they have reason to trust. The Minister of Information acknowledged as much in May 2025 when he described deepfake videos as having “damaged countless reputations and traumatised families.” What he did not add, though it is equally true, is that the families most traumatised by deepfake fraud are not the celebrities whose faces were used, but the people who believed them.
The common thread across these frameworks is that they treat deepfakes as a distinct category of harm requiring specific legal treatment, rather than hoping that general fraud or impersonation laws will stretch to cover them. Nigeria has not yet made that move.
What the Law Currently Says
Nigeria has three frameworks that are theoretically applicable to deepfake fraud, none of which was designed with it in mind.
The Cybercrimes (Prohibition, Prevention, etc.) Act 2015, as amended in 2024, penalises fraud, identity theft, phishing, and the dissemination of false information through computer systems. Section 32 of the Act criminalises impersonation in electronic communications, with the intent to commit fraud. On a generous reading, a deepfake video used to promote a Ponzi scheme could be prosecuted under these provisions, and the 2024 amendments broadened the Act’s scope beyond financial institutions to cover any person or entity. But the Act does not mentions artificial intelligence, deepfakes, or synthetic media. It does not contemplate a scenario where the impersonation is not a human pretending to be someone else, but a machine generating a convincing simulacrum of them. That gap is not a technicality; it is a substantive enforcement problem, because proving that a specific deepfake video constitutes “impersonation” under a law that did not anticipate the technology requires courts to stretch language beyond what it was written to carry.
The Nigeria Data Protection Act 2023 protects personal data, including biometric data and by implication a person’s likeness. The unauthorised use of someone’s face to generate synthetic content is a form of biometric data processing without consent, and a credible argument exists that it falls within the NDPA’s prohibitions. But the NDPA is a data protection statute, calibrated around the rights of data subjects in processing relationships with controllers. Its enforcement architecture, centred on the NDPC, was not built to handle real-time takedowns of viral fraud content, and no enforcement action has yet been taken by the Commission specifically targeting deepfake misuse.
The NDPC’s most recent relevant action was endorsing, in early 2026, a joint statement from 60 global data protection authorities on AI-generated imagery and privacy. The endorsement acknowledged “mounting concerns” about the misuse of AI tools to create non-consensual imagery, particularly affecting children and vulnerable groups. An endorsement of a global statement is useful as a signal of regulatory intent; but a signal is not a rule, and a rule is not enforcement.
The Regulatory Void
There is no provision in Nigerian law that specifically defines deepfakes, prohibits their creation for fraudulent purposes, or creates a standalone offence for using AI-generated synthetic media to deceive. There is no mandatory labelling requirement obliging platforms or creators to identify AI-generated content as such. There is no specific civil cause of action that a victim of deepfake fraud can bring on the basis of the synthetic media itself, separate from the underlying fraud it was used to commit. There is no platform liability framework that compels TikTok, Instagram, or Facebook to remove deepfake fraud content within a defined period, or that holds them accountable when they fail to do so.
This is not a Nigerian peculiarity; most jurisdictions are still working through these questions. But the gap between Nigeria’s exposure to deepfake fraud and the sophistication of its legal response is wider than it needs to be, and wider than the situation permits.
Global Precedents: What the Rest of the World Has Done
The EU AI Act, which entered into force in 2024, mandates transparency obligations for synthetic content, requiring that AI-generated media be labelled as such and that individuals be informed when they are interacting with AI systems. Platforms operating in the EU that fail to implement these requirements face significant penalties. The United Kingdom, through the Online Safety Act, created specific criminal offences for sharing non-consensual synthetic intimate imagery, with dedicated enforcement powers. In the United States, over 45 states have enacted some form of deepfake legislation, with Tennessee’s ELVIS Act explicitly granting every individual a property right in the use of their name, photograph, and voice, and California and Texas targeting deepfakes in election interference and non-consensual content specifically.
The common thread across these frameworks is that they treat deepfakes as a distinct category of harm requiring specific legal treatment, rather than hoping that general fraud or impersonation laws will stretch to cover them. Nigeria has not yet made that move.
The average Nigerian encountering these videos is not technologically unsophisticated, they are simply operating in an information environment where the tools for generating convincing synthetic media have outpaced the tools for detecting them, and where the law has not yet created consequences sufficient to deter the people who deploy those tools for fraud.
A Three-Pronged Roadmap for Nigeria
Three things are both necessary and achievable within Nigeria’s existing legislative and regulatory architecture.
The first is an amendment to the Cybercrimes Act to create a standalone offence of synthetic identity fraud, defined as the creation or distribution of AI-generated media that uses an identifiable person’s likeness or voice without their consent for the purpose of financial deception or reputational harm. The penalty structure should be calibrated to the scale of the harm, not borrowed from provisions written for a different kind of offence. This is not a complicated drafting exercise; it is a political decision about whether the National Assembly considers this harm serious enough to name directly.
The second is an NDPC guidance note on the use of personal biometric data in AI systems, specifically addressing the conditions under which a person’s face or voice can lawfully be used to generate synthetic content, what constitutes valid consent for such use, and the enforcement consequences for platforms that host non-consensual synthetic media. The NDPC’s endorsement of the global AI imagery statement is a starting point, but domestic guidance with specific obligations and enforcement triggers is what the law actually needs.
The third is a platform accountability framework, whether through the NDPC, the NCC, or a joint instrument between them, that imposes takedown obligations on social media platforms for deepfake fraud content, with defined response timelines and liability consequences for non-compliance. Okonjo-Iweala flagged her deepfake on X, and it continued to circulate on Instagram, WhatsApp, and Facebook for days after. The platforms are not passive conduits; they are the infrastructure through which the fraud operates, and the law should treat them accordingly.
The Bottom Line
There is a tendency, when discussing deepfake fraud in Nigeria, to frame it primarily as a problem for the public figures whose faces are being used. That framing is understandable, because they are the ones with the platforms to complain loudly, but it obscures where the harm actually concentrates. Okonjo-Iweala has a global communications infrastructure and an X account with millions of followers. She can issue a denial that travels as fast as the original fabrication. The person who wired ₦380,000 to a scheme because they watched a convincing video of her endorsing it does not have that option.
The average Nigerian encountering these videos is not technologically unsophisticated, they are simply operating in an information environment where the tools for generating convincing synthetic media have outpaced the tools for detecting them, and where the law has not yet created consequences sufficient to deter the people who deploy those tools for fraud.
AI could be coming for all our faces. The question is whether the laws we have will be ready when it does.
‘Mide Alabi is a lawyer. He writes from Lagos and can be reached at [email protected]
