On this page
Short answer. A BVN or NIN lookup confirms that a number exists and that its attributes match what the user typed. It does not prove the person typing owns that number. Pair the lookup with a liveness check and face match.
What the numbers are
The Bank Verification Number (BVN) is an 11-digit identifier issued through the banking system and linked to a person's biometrics. The National Identification Number (NIN) is an 11-digit identifier issued by the National Identity Management Commission (NIMC). Phone numbers are tied to identity through SIM registration. Fintechs use all three to confirm that a customer is a real, registered person.
What a lookup proves, and what it does not
A lookup returns attributes held against the number: typically name, date of birth and phone, and in some products a photo. From that you can confirm that the number is valid and that the details your user typed agree with the record.
The gap: knowing someone's BVN or NIN is not the same as being that person. Numbers leak, get shared and appear on documents. A lookup alone cannot tell you whether the person on your screen is the owner.
To close that gap you need a possession or biometric link: a live selfie matched to the photo on a government ID, or to the photo returned by the lookup, plus a phone check where the number is also tied to the person.
A sound flow
- Collect the number and consent. State the purpose and record when the user agreed.
- Look it up through a licensed data partner.
- Compare names with tolerance. Order, initials and spelling vary; use fuzzy matching with a sensible threshold.
- Run liveness and a face match against the ID portrait.
- Decide and record. Keep the result, the scores and a hash of the number.
Name matching is where most false rejections hide
- "Adebayo Chukwuemeka Okafor" versus "Okafor Adebayo": same person, different order.
- Initials, hyphens and diacritics differ between records.
- Maiden and married names appear on different documents.
Normalise case, strip punctuation, compare tokens regardless of order, and send near-matches to review rather than rejecting them.
Staying inside the law
- Lawful basis and consent. Verify only people you have a legitimate reason and permission to check.
- Purpose limitation. Use the data for the verification you described, nothing else.
- No enumeration. Never iterate through number ranges or scrape identity data.
- Do not store raw numbers. Keep a keyed hash; see our guide to hashing identity numbers.
Cost and reliability
Lookups depend on upstream providers, so they can be slower or temporarily unavailable. Treat a failed lookup as "unknown", offer a retry, and avoid billing logic that punishes the user for a provider outage.
How IDNexus supports it
IDNexus offers BVN, NIN and phone lookups alongside biometric verification, so one account and one audit trail cover both halves. Lookup rates are published on the identity pricing endpoint, and NIN supports a strict non-refundable v2 mode. Endpoints and examples are in the documentation.
BVN, NIN and phone lookups in the same API
Run identity lookups and biometric checks from one account, with consent captured and only hashes stored.
Create account