PAYMENT SECURITY IN E-COMMERCE: A Legal Perspective

As an e-commerce startup or consumer, you need to understanding the legal responsibilities and protections that secure online payments in Nigeria’s digital economy, and your rights therein.

As online shopping continues to dominate the global retail space, guaranteeing payment security is no longer just a technical requirement; it's a legal imperative. Consumers entrust their personal and financial information to online merchants with the expectation that their data will be protected. For e-commerce businesses, failing to secure payment processes not only damages reputation but also invites legal penalties and consumer lawsuits. This article explores how businesses can ensure legal compliance in payment security, the rights of consumers, common legal issues, and key strategies for staying protected.

Background to the Rise of E-Commerce in Nigeria

E-commerce, the buying and selling of goods and services online, has emerged as a transformative force for businesses in response to the significant shift in consumer behaviour, driven by increasing internet penetration, mobile technology, and youthful demographics. Nigeria, being the most populous country in Africa, is at the centre of this digital revolution.

Platforms such as Jumia, Konga, Flutterwave Store, Selar, and informal Instagram shops, WhatsApp Lists, and Facebook Groups have made it easier than ever for Nigerians to access products, bypass physical retail limitations, and reach wider audiences. COVID-19 further accelerated the adoption of online commerce, forcing traditional retailers to digitize their operations. The Nigerian Communications Commission (NCC) reported over 150 million internet users as of 2023, making the digital marketplace not only viable but essential.

While this growth is commendable, it has also exposed systemic weaknesses in consumer protection, digital infrastructure, legal regulation, and digital payments. The evolution of Nigeria’s e-commerce ecosystem is inseparable from the rise of digital payment systems. Payment security has become a central concern, as more consumers transact online using debit cards, mobile money, and digital wallets, often without full awareness of their rights or the legal remedies available to them in the event of fraud.

The Central Bank of Nigeria (CBN) has played an instrumental role in promoting cashless policies and enabling financial innovation through regulatory frameworks like the CBN Guidelines on Mobile Money Services, the Regulatory Framework for Open Banking in Nigeria (2021), and the Licensing Framework for Payment Service Providers, among others.

Fintech companies such as Flutterwave, Paystack, Interswitch, Opay, and Moniepoint have revolutionized how payments are processed, offering seamless checkout experiences, instant settlements, and integrations that allow micro and small businesses to operate online.

However, with this rapid growth comes a heightened risk of cybercrime, identity theft, data breaches, and unauthorized transactions. Many businesses, particularly SMEs, often lack the legal and regulatory understanding needed to implement secure and compliant payment practices. As a result, the legal implications of payment processing are becoming increasingly complex, especially in the absence of a unified and enforceable framework for digital commerce.

Importance of Legal Compliance in Payment Processing

Payment security is often viewed as a technical or IT issue, but its legal implications are just as critical. Businesses that collect, process, or store consumers' payment data have legal obligations under various national and international laws. In Nigeria, these include:

• The Nigeria Data Protection Act (NDPA) 2023, which mandates data minimisation, lawful processing, and adequate security measures for sensitive data, including payment information.

• The Cybercrimes (Prohibition, Prevention, etc.) Act 2015, as amended in 2024, which criminalises electronic fraud, identity theft, and financial system breaches.

• The Federal Competition and Consumer Protection Act (FCCPA) 2018, which guarantees consumer rights such as transparency, refund options, and protection from unfair practices.

• CBN Guidelines, which mandate compliance with Know Your Customer (KYC), anti-money laundering (AML), and secure payment processing protocols.

Legal compliance in payment systems is not optional; it is a prerequisite for trust, business sustainability, and access to broader financial infrastructure. Non-compliance can lead to hefty penalties, reputational damage, regulatory sanctions, loss of payment processor partnerships, or even litigation.

How to Protect Your Business from Legal Disputes Arising from Payment Security Issues

To legally protect your e-commerce business from disputes tied to payment breaches or fraud, it’s important to implement a comprehensive legal and compliance strategy. Here are essential actions to take:

1. Compliance with Payment Data Protection Laws

Ensure compliance with local and international laws such as:

• Nigeria Data Protection Act 2023 (for Nigerian businesses): Requires a lawful basis for processing payment data, implementation of technical and organizational measures to protect personal data.

• General Data Protection Regulation (GDPR): If you process EU residents’ data, you must secure payment data and disclose how it's handled.

• PCI DSS (Payment Card Industry Data Security Standard): While not a law, non-compliance can lead to severe consequences if a breach occurs.

2. Transparent Terms and Conditions

Your website's Terms of Use and Privacy Policy must:

• Clearly outline the payment process

• Identify third-party processors (e.g., Paystack, Flutterwave, Stripe)

• Disclose security measures

• Explain users’ rights and dispute resolution procedures

3. Risk Allocation in Contracts

When using third-party payment gateways, you must:

• Execute legally binding contracts outlining liability in case of a breach

• Include indemnity clauses to protect your business

• Conduct due diligence to ensure the processor is compliant with laws

4. Consumer Protection Law Compliance

Many countries, including Nigeria, have consumer protection laws requiring:

• Honest descriptions of products/services

• Secure checkout procedures

• Mechanisms for refund, chargeback, and dispute resolution

Failure to adhere can result in lawsuits, regulatory fines, or blacklisting by payment processors.

Rights of the Consumer in Digital Transactions

The evolution of Nigeria’s e-commerce ecosystem has expanded the role of digital transactions in everyday life, from online shopping to bill payments, subscriptions, and service fees. As consumers increasingly rely on electronic platforms, the protection of their rights becomes a critical legal consideration.

The Federal Competition and Consumer Protection Act (FCCPA) 2018 lays the foundation for consumer rights in Nigeria, including in the digital space. In addition, the Nigeria Data Protection Act (NDPA) 2023, the Cybercrimes Act 2015 (as amended), and Central Bank of Nigeria (CBN) guidelines provide specific protections for digital payment interactions.

Therefore, consumers have legal rights when making online payments, many of which include:

1. The Right to Transparency: Clear disclosure of product prices, terms and conditions, and payment charges, including taxes, delivery, and other additional fees. Hidden charges are illegal in many jurisdictions. More so, platforms must not hide material terms or auto-enroll users into recurring payments without consent.

2. Right to Data Privacy and Security: Payment data must be collected and processed lawfully, with adequate protection against breaches. Consumers must be informed of how their card or personal data will be used to prevent misuse, sharing without consent, or unnecessary storage.

3. Right to Informed Consent: No transaction or data collection should occur without the consumer’s voluntary, informed consent.

4. Right to Refund and Return: If a product is not delivered or the transaction was fraudulent, consumers have the right to initiate a chargeback through their bank or card provider. Platforms must offer fair and timely refund processes as part of their commercial obligations.

5. Right to Safe and Secure Transactions: E-commerce platforms and payment processors are obligated to maintain reasonable security measures to prevent fraud or identity theft.

6. Right to Redress: Consumers have a right to seek redress for unauthorized debits, fraud, failure to deliver goods/services, or non-refunded returns, by filing complaints with regulatory bodies, suing in civil court, or petitioning for enforcement through consumer protection councils or agencies like Nigeria’s FCCPC or the NDPC.

Redress Mechanisms for Failed, Fraudulent, or Unauthorized Transactions

When a consumer faces a failed or unauthorized transaction, the ability to seek and obtain redress is essential to maintaining trust in digital commerce. In Nigeria, the following redress channels are available:

1. Internal Complaint Resolution (Merchant or Fintech App): Most platforms provide in-app or email-based complaint resolution tools. They are required to respond within 7–14 days under best practices.

2. Bank Dispute Resolution (Chargeback Mechanism): Consumers can file chargeback requests with their banks for unauthorized or undelivered transactions. CBN regulations mandate timelines for financial institutions to address such complaints.

3. FCCPC Complaint Portal: The FCCPC accepts complaints through its online portal and has the authority to investigate and penalize e-commerce businesses that violate consumer rights.

4. Data Protection Commission (NDPC): Where the dispute involves unauthorized use or breach of personal/payment data, complaints can be lodged with the Nigeria Data Protection Commission (NDPC) under the NDPA 2023.

5. Court Action (Civil Litigation): Affected consumers may sue in court for damages, injunctions, or specific performance where losses are significant or unaddressed by regulators.

6. Arbitration and Alternative Dispute Resolution (ADR): Some platforms include ADR clauses in their user agreements, allowing parties to resolve disputes through private arbitration or mediation.

Legal Liabilities of Merchants, Banks, and Intermediaries

The digital transaction ecosystem includes multiple actors, each with distinct legal responsibilities. Nigerian law increasingly expects these players to anticipate risks and implement safeguards.

• Merchants (Online Sellers & Platforms): They owe a duty of care to their customers to provide accurate information, fair terms, and secure checkout systems. When they fail to do these, or for other incidents such as delivery failures, hidden charges, and fraudulent listings (especially in marketplace models), they are held liable for any damages caused therefrom. They are obligated to refund where goods are defective or not delivered.

• Payment Processors / Fintechs: These are regulated by the Central Bank of Nigeria, which mandates KYC processes, fraud monitoring, transaction reversals, and AML compliance. Where payment platforms negligently allow fraud or unauthorized access, they enjoy a shared liability.

• Banks (Issuing and Acquiring): Must investigate claims of fraudulent transactions to comply with their chargeback obligations under the CBN Consumer Protection Framework. Banks are also obliged to have and maintain a secure payment infrastructure and respond to unauthorized transactions promptly.

• Joint Liability in Complex Transactions: In many cases, consumers may not know who is at fault (e.g., merchant vs. payment processor). Nigerian courts and regulators may assign shared or joint liability, depending on where the breakdown occurred.

Key Takeaways and Recommendations for Legally Compliant Payment Practices

For e-commerce businesses, legal compliance in payment security is essential for business sustainability and consumer trust. Here are the major takeaways and action points:

Implement Strong Legal Contracts

• Ensure you have clear contracts with payment service providers.

• Define liabilities and ensure regulatory compliance clauses are present.

Stay Updated with Applicable Laws

• Monitor and adapt to new financial, consumer, and data protection laws.

• If you operate internationally, understand cross-border compliance requirements.

Have Clear Website Disclosures

• Publish and update Terms & Conditions, Privacy Policy, and Refund Policy.

• Use simple language and ensure they are accessible before checkout.

Honor Consumer Rights

• Always obtain clear consent before charging customers.

• Provide easy-to-use mechanisms for refunds, cancellations, and chargebacks.

Conduct Regular Legal Risk Audits

• Work with legal counsel to audit your e-commerce site and payment flow for potential legal risks.

• Ensure that you can demonstrate reasonable efforts to protect payment information.

Conclusion

As e-commerce continues to reshape Nigeria’s economy, the legal dimension of payment security has become more critical than ever. While technology powers convenience, it is the law that safeguards trust, ensuring that consumers are protected, merchants are accountable, and platforms operate fairly.

Businesses that take payment security seriously must combine robust technical infrastructure with legally sound practices. A legally secure e-commerce environment not only prevents disputes but also builds long-term trust and credibility with customers.

By understanding the legal landscape, implementing proper safeguards, and respecting consumer rights, you can significantly reduce your liability exposure and ensure your e-commerce platform remains both profitable and protected.

More so, Nigeria must strengthen regulatory compliance, mandate secure transaction protocols, and establish clear, accessible redress systems for digital consumers. Ultimately, legally sound payment systems are not just a compliance issue; they are the foundation to sustainable digital trade, national economic confidence, and global competitiveness.

---

About Legal Bytes

We are Adune Legal’s weekly Newsletter, which simplifies the Law for Busy Executives, Entrepreneurs, and Tech Enthusiasts interested in the legal aspects of Business, Technology, and Intellectual Property.

We love emails from our readers— reply to this email and let us know your thoughts and suggestions.

​WAIT!!!

Become a paid subscriber and access;

• Q&A sessions with Nneoma Grace via chats on Substack.

• Detailed Legal Templates and examples to save you time and legal fees

• Expert Interviews and Case Studies

Don't miss out on these perks - subscribe today and start enjoying it!

Thanks for reading Legal Bytes​

​Adune Legal’s Team

P.S. Like Legal Bytes? Please forward us to a friend.

P.P.S. Was this publication forwarded to you? Sign up here & see previous publications.