Financial InstitutionAPI
Customer KYC / BVN harvest (BOLA)
Increment an id and read any customer's full KYC, including BVN, address and balance.
- Attack
- Read profile id=3 (the MD).
- Nemesis defense
- Cross-tenant object reads are off-baseline and blocked.
- Modelled on
- Zenith Bank (2026): customer PII breach, phishing wave followed.
Request — review or edit the fields, then run it
Request that will be sent
GET /api/profile?id=3