Research report: Institutional typology of cybercrime enforcement in Nigeria using EFCC conviction records

When Nigeria’s Economic and Financial Crimes Commission publishes its conviction records, the numbers tell a story that looks little like the cybercrime of popular imagination. A new study in Discover Data has systematically analysed the agency’s complete conviction dataset for 2022 and found that of 3,785 convictions recorded that year, only 524 cases, or 13.8 percent, were classified as cybercrime-related. Within that cyber subset, the overwhelming majority, 83.4 percent, were impersonation and identity fraud cases, offences labelled in the records as cheating and personation, impersonation, or related variants involving online identity deception and social engineering. Technically sophisticated offences were almost entirely absent: computer-related offences made up just 2.3 percent of cyber convictions, and business email compromise, despite Nigeria’s global prominence in that crime type, appeared in only a single case across the entire dataset.

The study, conducted by Aminu Muhammad Auwal and published on 1 September 2026, is the first to apply systematic keyword-based content analysis to a complete annual EFCC conviction dataset in order to build an inductive, population-level institutional typology of prosecuted cybercrime. The author retrieved the publicly available conviction records from the EFCC’s online portal, screened all 3,785 entries using keywords such as cyber, internet, online, computer, email, BEC, impersonation and fraud, and retained only cases whose offence descriptions contained an explicit reference to digital, electronic or internet-mediated conduct. Cases involving exclusively offline financial crimes, such as money laundering without a digital element, advance fee fraud with no online component, or general document forgery, were excluded regardless of their proximity to cybercrime categories. After manual review, 524 cases met the inclusion criteria and 3,261 were excluded.

From those 524 cases, the study derived four analytic offence categories drawn directly from the offence labels recorded by the EFCC rather than imposed from external theoretical frameworks. Alongside impersonation and identity fraud and the general residual category of cybercrime and affiliated offences, which accounted for 14.1 percent of cyber convictions, the typology included computer-related offences and business email compromise. Notably, the terms romance and Yahoo, which dominate journalistic and academic accounts of Nigerian internet fraud, do not appear as explicit offence descriptor labels in the 2022 conviction dataset. The author treated romance fraud and Yahoo-style social engineering as interpretive frames during classification but based the final typology solely on the offence labels documented in the records.

The resulting picture is striking for what it does not contain. The EFCC’s 2022 conviction record shows near-total concentration in impersonation-based and social engineering fraud, offences that rely less on technical skill and more on psychological manipulation, identity deception and the exploitation of trust relationships. High-skill cyber offences such as system intrusion, large-scale identity exploitation or organised digital financial attacks are almost entirely absent from the record. The author characterises this as a limited institutional cybercrime depth, in which most convicted cases are functionally indistinguishable from offline fraud, differing only in the medium through which the deception is carried out rather than in its underlying structure.

Crucially, the study frames these figures not as a measure of how much cybercrime exists in Nigeria but as a map of what one agency detects, charges, prosecutes and successfully convicts. Conviction data, the author argues, does not merely describe the prevalence of cybercrime; it reveals the operational reality of cybercrime enforcement. What appears in prosecution records reflects institutional capacity and filtering as much as it reflects the actual landscape of criminal activity. The institutional filters of detection, charging and prosecution systematically favour offences with accessible evidentiary profiles, typically those supported by victim complaints, financial transaction records and confessions, while offences requiring complex forensic reconstruction are consistently passed over.

Several institutional realities help explain the concentration on impersonation and identity fraud. These cases align with traditional investigative competencies and require limited specialised digital forensic capacity. They generate more straightforward evidence chains. They map onto existing legal frameworks developed for offline fraud, reducing prosecutorial complexity. And perhaps most importantly, the EFCC’s statutory mandate explicitly focuses on economic and financial crimes, a mandate that structurally shapes which offences are investigated, charged and convicted. Other categories of cybercrime falling outside that mandate, such as cyberbullying, cyber harassment or cyber-espionage, are handled by other agencies, most notably the Nigeria Police Force under the Cybercrimes Act of 2015.

The near-absence of business email compromise convictions is particularly striking, and the study offers several non-exclusive explanations rather than a single conclusion. BEC offences may be prosecuted under broader fraud or impersonation categories rather than recorded as a distinct label. Some cases may involve ongoing investigations that had not concluded within the 2022 calendar year, while others may involve offenders operating beyond the EFCC’s jurisdictional reach. What the data show, the author emphasises, is that BEC is largely absent from the institutional record of EFCC convictions, which is itself a meaningful finding about prosecutorial classification, independent of whether BEC activity itself is widespread in Nigeria.

The enforcement profile also diverges sharply from typologies documented in other institutional settings. Comparative scholarship on Chinese cybercrime has identified substantial activity in intellectual property theft, state-sponsored espionage and technically sophisticated intrusions, while research on developed economies has found a more balanced representation across fraud, hacking and malware distribution. The EFCC pattern, by contrast, shows extreme skewness toward a single category. The author cautions that these contrasts must be interpreted carefully, because differences in the mandates, resources and enforcement strategies of the agencies being compared make direct comparisons analytically complex. Research on cybercrime enforcement in Ghana has similarly shown how prosecutorial capacity and legal category design shape which offences become visible in official records, suggesting the concentration observed here may reflect a broader regional pattern in West African cybercrime governance rather than a Nigerian peculiarity.

The study’s limitations are stated explicitly and are central to interpreting its findings. The analysis relies exclusively on publicly available EFCC conviction records, which capture only cases that resulted in conviction and therefore do not reflect the full spectrum of cybercrime activity investigated by Nigerian law enforcement. Conviction records are themselves socially and institutionally produced datasets, shaped by prosecutorial discretion, plea bargaining arrangements, evidentiary thresholds, selective enforcement priorities and administrative reporting practices. The dataset constitutes a census of EFCC convictions for 2022 rather than a sample, so descriptive statistics rather than inferential methods were used, and the analysis cannot establish causal relationships between institutional factors and enforcement patterns or predict future enforcement trends. The findings reflect the enforcement priorities of one specific agency and should not be generalised to Nigerian cybercrime enforcement as a whole without data from other bodies.

Within those bounds, the study makes a methodological argument as much as an empirical one: administrative data produced by law enforcement agencies offers a distinct analytical perspective that perception studies and offender interviews cannot provide. Future research directions suggested include comparing multi-year trends in EFCC data, examining patterns in Nigeria Police Force cybercrime prosecution data, and conducting cross-national comparisons of enforcement patterns, with integrated multi-agency data offering a more complete institutional picture. The dataset underlying the analysis is publicly available from the EFCC’s conviction records portal. For policymakers, the findings raise questions about whether an enforcement toolkit concentrated on internet-facilitated fraud, and on cases requiring minimal digital forensic capacity, is aligned with more sophisticated emerging threats, and about the consequences of a feedback loop in which only certain forms of cyber harm are recognised as legitimate targets of state intervention.

Subject of Research: An institutional typology of cybercrime offences in Nigeria's EFCC 2022 conviction records

Article Title: Institutional typology of cybercrime enforcement in Nigeria using EFCC conviction records

Article References: Auwal, A. M. (2026). Institutional typology of cybercrime enforcement in Nigeria using EFCC conviction records. Discover Data, 4(1), Article 19. https://doi.org/10.1007/s44248-026-00115-0

Image Credits: AI Generated

DOI: 10.1007/s44248-026-00115-0

Keywords: cybercrime, Nigeria, EFCC, conviction records, impersonation fraud, business email compromise, identity fraud, administrative data, enforcement, content analysis, West Africa, criminology