DESIGN AND IMPLEMENTATION OF A MACHINE LEARNING-BASED SYSTEM FOR SMS PHISHING (SMISHING) DETECTION IN NIGERIA
CHAPTER ONE
INTRODUCTION
1.1 Background of the Study
Phishing attacks represent one of the most pervasive and damaging forms of cyber threats in the digital age, where malicious actors impersonate trustworthy entities to deceive individuals into revealing sensitive information such as passwords, financial details, or personal data. Globally, phishing has evolved from simple email scams to sophisticated multi-channel assaults involving SMS, social media, and even voice calls, leveraging psychological manipulation and technological advancements to exploit human vulnerabilities (Ojewumi et al., 2022).In recent years, the proliferation of mobile devices and internet connectivity has exacerbated this issue, particularly in developing economies like Nigeria, where digital adoption outpaces cybersecurity awareness and infrastructure.
In Nigeria, the rapid growth of the telecommunications and financial sectors has made the country a prime target for phishing attacks. With over 200 million mobile subscribers as of 2025, and a burgeoning fintech ecosystem including platforms like OPay, Kuda, and PalmPay, cybercriminals have increasingly shifted focus to SMS-based phishing, commonly known as “smishing,” to exploit users’ trust in mobile communications (Njoku et al., 2023). According to recent statistics, Nigeria experienced an average of 4,622 cyber-attacks per week in December 2025, with phishing constituting a significant portion of these incidents (Nigeria Communications Week, 2026). Deloitte’s 2026 report highlights that Nigeria ranked third in Africa for phishing cases in 2024, recording approximately 3,500 incidents, contributing to cumulative economic losses exceeding $3 billion from cybercrimes between 2019 and 2025 (Deloitte, 2026). These figures underscore the escalating threat, as annual losses hover around $500 million, driven by the migration of essential services like banking, e-governance, and commerce to digital platforms (Ecofin Agency, 2026).
The impact of phishing in Nigeria extends beyond financial losses, affecting sectors such as banking, telecommunications, and healthcare. For instance, the Nigeria Inter-Bank Settlement System (NIBSS) reported over 740,000 attempted digital fraud incidents in 2023, with a 26% increase in financial fraud cases in 2024, largely attributed to phishing (Planet Web, 2025). High-profile cases include the 2024 compromise of over 5,000 OPay accounts through phishing and SIM-swap fraud, resulting in losses between ₦11 billion and ₦20 billion, and broader fraud exceeding ₦82.4 billion between 2023 and 2024 (Planet Web, 2025). In the telecommunications industry, companies like MTN and Glo face constant threats, where phishing SMS mimicking official notifications lure users into clicking malicious links or divulging one-time passwords (OTPs). This is particularly acute in regions like Port Harcourt, Rivers State, where oil and gas professionals are targeted with tailored scams exploiting industry-specific lingo (Ojeniyi et al., 2019; updated contexts from Musa et al., 2024).
Traditional detection methods, such as blacklisting URLs or rule-based filters, have proven inadequate against evolving phishing tactics, including polymorphic URLs, zero-day exploits, and AI-generated content (Subairu et al., 2020). These static approaches fail to adapt to the dynamic nature of attacks, where cybercriminals use obfuscation techniques like homograph domains or shortened links to bypass filters. In Nigeria, where low digital literacy rates ,estimated at 40% among adults in 2025, compound the problem, users often fall victim to scams promising quick financial gains amid economic challenges (Kaspersky Labs, 2025).26c1fe Moreover, the regulatory framework, including the Nigeria Data Protection Regulation (NDPR) and NITDA guidelines, emphasizes prevention but lacks robust enforcement, leading to underreporting and persistent vulnerabilities (Deloitte, 2025).
The advent of machine learning (ML) has revolutionized phishing detection by enabling predictive models that analyze patterns in text, URLs, and user behavior. Research shows that ML algorithms, such as Random Forest, Support Vector Machines (SVM), and Neural Networks, achieve detection accuracies exceeding 95% when trained on diverse datasets (Ojewumi et al., 2022). In the Nigerian context, studies have explored ensemble methods to enhance detection. For example, heterogeneous ensemble feature selection combines multiple classifiers to reduce false positives, proving effective against webpage phishing with accuracies up to 98% (Ogunleye et al., 2023). Similarly, feature-driven approaches using natural language processing (NLP) for URL analysis have demonstrated superior performance in identifying smishing attempts, incorporating lexical, syntactic, and semantic features (Muhammad et al., 2025).
Recent advancements incorporate deep learning techniques, such as Convolutional Neural Networks (CNNs) and Long Short-Term Memory (LSTM) models, for real-time SMS analysis. A comprehensive review indicates that hybrid ML-DL models outperform traditional methods in detecting multilingual phishing, relevant to Nigeria’s diverse linguistic landscape (Musa et al., 2024). Distributed ensemble methods further improve scalability for mobile environments, addressing resource constraints in low-end devices common in Nigeria (Olukoya et al., 2024). However, gaps persist: most models are trained on global datasets lacking Nigerian-specific phishing patterns, such as scams involving local banks or government schemes like NIN verification. Additionally, SMS phishing detection lags behind email-focused research, with limited integration of local dialects like Pidgin English (Njoku et al., 2023).
In Port Harcourt, the economic hub of Nigeria’s oil sector, phishing attacks often target energy professionals with tailored messages about job opportunities or contract bids, amplifying risks to critical infrastructure (Ibor et al., 2023). With cyber-attacks rising to 4,388 per week in 2025 (OmoolaEx IT Consultancy, 2025), there is an urgent need for localized ML systems. This study aims to bridge these gaps by developing a ML-based system for SMS phishing detection, leveraging NLP and ensemble learning tailored to Nigerian contexts.
1.2 Statement of the Problem
Despite advancements in cybersecurity, phishing attacks in Nigeria continue to cause significant financial and data losses due to inadequate detection mechanisms for SMS-based threats. Traditional filters fail against sophisticated scams, and existing ML models lack localization, leading to high false negatives in diverse linguistic and cultural settings.
1.3 Objectives of the Study
The main objective is to design and implement a machine learning-based system for detecting phishing in SMS messages in Nigeria. Specific objectives include:
To analyze phishing patterns in Nigerian SMS using NLP.
To develop an ensemble ML model for accurate detection.
To evaluate the system’s performance using real-world datasets.
To propose recommendations for integration into mobile networks.
1.4 Research Questions
What are the prevalent patterns in phishing SMS in Nigeria?
How effective are ensemble ML algorithms in detecting these attacks?
What challenges arise in implementing such a system in resource-limited environments?
How can the system be optimized for real-time mobile use?
1.5 Significance of the Study
This study will contribute to cybersecurity in Nigeria by providing a localized tool to reduce phishing incidents, benefiting users, telecom operators, and regulators. It will also advance academic research on ML applications in African contexts.
1.6 Scope and Limitations
The study focuses on SMS phishing detection using ML, limited to English and Pidgin texts in Nigeria. Limitations include dataset availability and computational resources for training.
1.7 Definition of Terms
Phishing: Deceptive attempts to obtain sensitive information.
Smishing: Phishing via SMS.
Machine Learning: Algorithms that learn from data to make predictions.
NLP: Natural Language Processing for text analysis.
References
Deloitte. (2025). Nigeria’s cybersecurity outlook 2025. https://www.deloitte.com/ng/en/services/consulting-risk/perspectives/Nigerias-cybersecurity-landscape-in-2025.html
Deloitte. (2026). In Nigeria, rising ransomware, phishing pose serious risks for digital economy. https://thehighstreetjournal.com/ransomware-in-nigerias-digital-economy
Ecofin Agency. (2026). Deloitte warns of rising ransomware and phishing attacks in Nigeria in 2026. https://www.ecofinagency.com/news-digital/2301-52222-deloitte-warns-of-rising-ransomware-and-phishing-attacks-in-nigeria-in-2026
Ibor, A. E., Aghware, F. O., Akazue, M. I., & Ojugo, A. A. (2023). Evidence of personality traits on phishing attack menace among selected university undergraduates in Nigeria. Journal of Cybersecurity, 5(1), 45-56.
Kaspersky Labs. (2025). Africa cyberthreat landscape report 2025. https://content.kaspersky-labs.com/se/media/en/africa-cyberthreat-landscape-report-2025.pdf
Muhammad, T. M., Emmanuel, A. I., Adamu-Fika, F., Bature, K. S., & Maiauduga, A. D. (2025). A feature-driven approach to phishing URL detection using machine learning. Journal of Digital Innovations & Contemporary Research in Science, Engineering & Technology, 13(1), 123-135.
Musa, H., Gital, A. Y., & Ali, U. A. (2024). Comprehensive review on phishing website detection using machine learning and deep learning techniques. International Journal of Advanced Computer Science and Applications, 15(2), 45-56.
Nigeria Communications Week. (2026). Nigeria targeted with 4622 cyber-attacks per week in December 2025. https://www.nigeriacommunicationsweek.com.ng/nigeria-targeted-with-4622-cyber-attacks-per-week-in-december-2025
Njoku, D. O., Ikwuazom, C. T., Okolie, S. A., & Jibiri, J. E. (2023). URL based phishing website detection using machine learning. Imo Technology Summit and Expo Journal, 1(1), 1-15.
Ogunleye, G., Olukoya, B. M., Olusesi, A. T., Olabisi, P., Sodipo, Q. B., & Adekunle, O. (2023). Heterogeneous ensemble feature selection and multilevel ensemble approach to machine learning phishing attack detection. FUOYE Journal of Engineering and Technology, 8(4), 438-447.
Ojewumi, T. O., Ogunleye, G. O., Oguntunde, B. O., Folorunsho, O., & Fashoto, S. G. (2022). Performance evaluation of machine learning tools for detection of phishing attacks on web pages. Scientific African, 16, e01165.
Ojeniyi, J. A., Alhassan, J. K., Adebayo, O. S., & Olalere, M. (2019). Phishing attack detection based on random forest with wrapper feature selection method. International Journal of Information Processing and Communication, 7(2), 12-25.
Olukoya, B. M., Ogunleye, G. O., Olabisi, P. O., Olusesi, A. T., & Osobukola, A. A. (2024). Heterogeneous distributed ensemble feature selection: An enhancement approach to machine learning for phishing detection. Nigerian Journal of Basic and Applied Sciences, 32(1), 19-26.
OmoolaEx IT Consultancy. (2025). AI-driven cyber threats in Nigeria 2025. https://omoolaex.com.ng/blog/rise-of-ai-driven-cyber-threats-nigeria
Planet Web. (2025). Phishing attacks in Nigeria: Real cases, common scams, and how to stay safe. https://planetweb.ng/phishing-attacks-in-nigeria
Subairu, S., Alhassan, J., Abdulhamid, S., & Ojeniyi, J. (2020). A review of detection methodologies for quick response code phishing attacks. In 2020 2nd International Conference on Computer and Information Sciences (ICCIS) (pp. 1-5). IEEE.
