Developing an Original Methodology for Cyber Attribution in Nigerian Financial Cybercrime Cases

Cyber attribution, the identification of threat actors responsible for cyberattacks, is critical for prosecution and deterrence, yet existing attribution methodologies are developed for nation-state contexts and require significant adaptation for the financial cybercrime environment dominant in Nigeria. This study developed an original cyber attribution methodology for Nigerian financial cybercrime cases, drawing on technical analysis, legal requirements, and operational constraints of Nigerian cybercrime investigation. A methodology development approach was employed: systematic review of attribution methodologies from 2018 to 2024 (52 publications), structured consultation with 20 EFCC investigators and 8 prosecutors, and iterative methodology design and expert validation. The review confirmed that existing technical attribution methods (malware analysis, network forensics) were inadequately adapted for the social engineering-heavy, mobile-first Nigerian cybercrime ecosystem. Original empirical work analysed 30 anonymised EFCC case files to identify attribution evidence patterns, success factors, and failure modes. The original Nigerian Financial Cybercrime Attribution Methodology proposes a three-layer evidence framework: technical indicators (device fingerprints, transaction trails, network artefacts), behavioural indicators (modus operandi signatures, linguistic patterns, victim targeting logic), and social network indicators (co-offender relationships, money mule network mapping). Legal admissibility criteria aligned with the Cybercrime Act 2015 and Evidence Act 2011 are specified for each evidence layer. Expert review by 12 forensics and legal specialists confirmed the methodology's original contribution. The study recommends adoption by EFCC as the standard cybercrime case attribution procedure.

Keywords: cyber attribution, financial cybercrime, EFCC, Nigeria, forensic methodology