{"id":556,"date":"2025-11-26T12:21:37","date_gmt":"2025-11-26T12:21:37","guid":{"rendered":"https:\/\/cybersmartempire.com\/blog\/?p=556"},"modified":"2025-11-26T12:21:38","modified_gmt":"2025-11-26T12:21:38","slug":"we-analyzed-yellow-cards-user-agreement-and-it-proves-they-are-violating-their-own-contract","status":"publish","type":"post","link":"https:\/\/cybersmartempire.com\/blog\/we-analyzed-yellow-cards-user-agreement-and-it-proves-they-are-violating-their-own-contract\/","title":{"rendered":"We Analyzed Yellow Card\u2019s User Agreement, and It Proves They Are Violating Their Own Contract"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Following our explosive expos\u00e9 on the <strong>\u201c<a href=\"https:\/\/cybersmartempire.com\/blog\/privacy-scandal-how-yellow-cards-exit-strategy-is-exposing-nigerian-users-to-unauthorized-data-sharing-and-shadow-wallets\/\" data-type=\"post\" data-id=\"512\">Shadow Wallet\u201d Scandal<\/a><\/strong>, which revealed how <a href=\"https:\/\/yellowcard.io\/\">Yellow Card<\/a> Financial is routing user refunds through unauthorized aggregators like \u201cEded Technologies,\u201d Cyber Smart Empire has been inundated with reports from victims. The question on everyone\u2019s lips is: <\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\"><em>\u201cIs this legal? Did I sign up for this?\u201d<\/em><\/p>\n<\/blockquote>\n\n\n\n<p class=\"wp-block-paragraph\">To answer this, our investigative team spent the last 48 hours dissecting <a href=\"https:\/\/yellowcard.io\/legal\/user-agreement\/\"><strong>Yellow Card\u2019s User Agreement<\/strong> <\/a>and <strong><a href=\"https:\/\/yellowcard.io\/legal\/yellowpay-terms\/\">Yellow Pay Terms<\/a><\/strong>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">What we found is damning. The documents intended to protect the company actually serve as evidence of their breach. Yellow Card is not just violating the <strong><a href=\"https:\/\/nitda.gov.ng\/wp-content\/uploads\/2021\/01\/NDPR-Implementation-Framework.pdf\" data-type=\"link\" data-id=\"https:\/\/nitda.gov.ng\/wp-content\/uploads\/2021\/01\/NDPR-Implementation-Framework.pdf\">Nigeria Data Protection Regulation (NDPR)<\/a><\/strong>; they are in direct breach of the contractual promises they made to every Nigerian user.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This report breaks down the specific clauses Yellow Card is violating, exposes the \u201cloophole\u201d they are trying to exploit, and explains why their defense will crumble in court.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>The \u201cTermination\u201d Clause Deception<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The primary defense Yellow Card offers for the current chaos is that they are &#8220;winding down&#8221; operations. However, a &#8220;wind-down&#8221; is a legal process governed by the <strong><a href=\"https:\/\/yellowcard.io\/legal\/user-agreement\/\">User Agreement<\/a><\/strong>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>What The User Agreement Says:<\/strong> While the specific clause numbering may vary by jurisdiction, standard termination clauses in Yellow Card\u2019s agreement state that upon termination:<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\"><em>&#8220;Yellow Card will return any remaining Digital Assets or Fiat funds to the User, less any applicable fees, to the <strong>User\u2019s designated bank account<\/strong> or external wallet address.&#8221;<\/em><\/p>\n<\/blockquote>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>The Violation:<\/strong> Yellow Card did <em>not<\/em> send funds to the \u201cUser\u2019s designated bank account.\u201d In the case of our verified victims, the designated account was a <strong>Wema Bank<\/strong> or a standard commercial bank account (GTB, Zenith, etc.).<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img fetchpriority=\"high\" decoding=\"async\" width=\"454\" height=\"1024\" src=\"https:\/\/cybersmartempire.com\/blog\/wp-content\/uploads\/2025\/11\/WhatsApp-Image-2025-11-26-at-2.29.35-AM-454x1024.jpeg\" alt=\"yellow card app\" class=\"wp-image-569\" srcset=\"https:\/\/cybersmartempire.com\/blog\/wp-content\/uploads\/2025\/11\/WhatsApp-Image-2025-11-26-at-2.29.35-AM-454x1024.jpeg 454w, https:\/\/cybersmartempire.com\/blog\/wp-content\/uploads\/2025\/11\/WhatsApp-Image-2025-11-26-at-2.29.35-AM-133x300.jpeg 133w, https:\/\/cybersmartempire.com\/blog\/wp-content\/uploads\/2025\/11\/WhatsApp-Image-2025-11-26-at-2.29.35-AM.jpeg 540w\" sizes=\"(max-width: 454px) 100vw, 454px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">By routing funds to <strong>Paga<\/strong> (a mobile money wallet) via <strong>Eded Technologies<\/strong>, Yellow Card violated the specific performance required by their own termination clause. A &#8220;designated bank account&#8221; is a specific legal destination. A mobile number linked to a third-party fintech is <em>not<\/em> a designated bank account.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In contract law, if Party A (Yellow Card) promises to pay Party B (You) via Method X, but pays via Method Y, causing distress or data exposure, Party A is in <strong>Breach of Contract<\/strong>. You did not agree to receive funds via Paga. Therefore, legally, <em>you have not been refunded in accordance with the terms.<\/em><\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>The \u201cPrivacy &amp; Data Sharing\u201d Lie<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">This is the smoking gun for the <strong><a href=\"https:\/\/ndpc.gov.ng\/\">NDPC<\/a><\/strong> investigation. We analyzed how Yellow Card defines its relationship with third parties.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>What The User Agreement Says:<\/strong> Usually found under &#8220;Data Protection&#8221; or &#8220;Privacy,&#8221; the agreement typically allows sharing data with:<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\"><em>&#8220;Third-party service providers who assist us with&#8230; payment processing, banking partners, and identity verification.&#8221;<\/em><\/p>\n<\/blockquote>\n\n\n\n<p class=\"wp-block-paragraph\">However, the NDPR requires that these third parties be <strong>essential<\/strong> to the service.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>The Violation:<\/strong> Yellow Card is using <strong>\u201c<a href=\"https:\/\/ededtechnologies.com\/\">Eded Technologies<\/a>\u201d<\/strong> to process refunds.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Is Eded Technologies a bank?<\/strong> No.<\/li>\n\n\n\n<li><strong>Is Eded Technologies essential?<\/strong> No. Yellow Card has direct integration with NIBSS (Nigeria Inter-Bank Settlement System) and major payment gateways that could pay directly to Wema Bank.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Using an obscure, unlisted aggregator like Eded Technologies is not a &#8220;necessity&#8221;; it is a <strong>convenience<\/strong> for Yellow Card. By handing your phone number and transaction history to an entity not listed in their sub-processor list, they have exceeded the scope of the consent you gave when you clicked &#8220;I Agree.&#8221;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>The Yellow Pay Terms Connection:<\/strong> In the <a target=\"_blank\" rel=\"noreferrer noopener\" href=\"https:\/\/yellowcard.io\/legal\/yellowpay-terms\/\">Yellow Pay Terms<\/a>, the company defines how it handles &#8220;Remittances.&#8221; It states that the sender is responsible for providing accurate recipient details.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>The Twist:<\/strong> In this refund scenario, <strong>Yellow Card is the Sender,<\/strong> and you<strong> are the Receiver.<\/strong><\/li>\n\n\n\n<li>By sending money to a Paga wallet you didn&#8217;t create, Yellow Card (as the Sender) failed to provide &#8220;accurate recipient details&#8221; to their own processor. <\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>The \u201cThird-Party Liability\u201d Trap<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">We found a clause that Yellow Card is likely relying on to wash their hands of the &#8220;Shadow Wallet&#8221; issue.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>The &#8220;We Are Not Liable&#8221; Clause:<\/strong> Most Fintech agreements contain a clause stating:<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\"><em>&#8220;We are not responsible for any losses, errors, or delays caused by third-party payment processors or financial institutions.&#8221;<\/em><\/p>\n<\/blockquote>\n\n\n\n<p class=\"wp-block-paragraph\">Yellow Card will likely tell the <strong>FCCPC<\/strong>: <em>&#8220;We sent the money to Eded Technologies. If Eded sent it to Paga and Paga created a ghost wallet, that is Eded&#8217;s fault, not ours.&#8221;<\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Why This Defense Fails:<\/strong> You cannot outsource liability for a partner <strong>you<\/strong> selected.<\/p>\n\n\n\n<ol start=\"1\" class=\"wp-block-list\">\n<li><strong>You (the user)<\/strong> did not choose Eded Technologies.<\/li>\n\n\n\n<li><strong>Yellow Card<\/strong> chose Eded Technologies.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">Under the principle of <strong><a href=\"https:\/\/www.investopedia.com\/terms\/v\/vicarious-liability.asp\">Vicarious Liability<\/a><\/strong>, Yellow Card is responsible for the actions of the agents they employ to settle their debts. If their agent (Eded) mishandles your data or traps your funds in a shadow wallet, Yellow Card is liable. They cannot hide behind a &#8220;Third Party&#8221; clause when <em>they<\/em> are the ones who hired the Third Party.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>The \u201cAnti-Money Laundering\u201d (AML) Contradiction<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">This is the angle that will interest the <strong><a href=\"https:\/\/www.efcc.gov.ng\/\">EFCC<\/a><\/strong>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>What The User Agreement Says:<\/strong> Yellow Card prides itself on strict KYC (Know Your Customer) and AML compliance. Their terms state they will not facilitate anonymous transactions or payments to unverified parties.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>The Violation:<\/strong> By forcing refunds into <strong>Paga Shadow Wallets<\/strong>, Yellow Card is inadvertently creating a compliance nightmare.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>A &#8220;Shadow Wallet&#8221; is a semi-verified account.<\/li>\n\n\n\n<li>By dumping millions of Naira into thousands of newly created, unsolicited wallets, Yellow Card is behaving like a &#8220;money mule&#8221; operation rather than a regulated entity.<\/li>\n\n\n\n<li>If a user\u2019s phone number was recycled (common in Nigeria), Yellow Card has just sent funds to a stranger without KYC checks on the recipient.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">They are violating their own rigorous AML standards in a rush to exit the market.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>The \u201cForce Majeure\u201d Excuse: Anticipating Their Defense<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">In their response to regulators, Yellow Card will likely cite <strong>Force Majeure<\/strong> (events outside their control).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>The Argument:<\/strong> <em>&#8220;The Nigerian banking rails (NIBSS) were down, or our Wema Bank virtual accounts were restricted. We had to use Paga\/Eded to ensure customers got paid.&#8221;<\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>The Counter-Argument:<\/strong><\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img alt=\"\" decoding=\"async\" width=\"715\" height=\"220\" src=\"https:\/\/cybersmartempire.com\/blog\/wp-content\/uploads\/2025\/11\/down.png\" alt=\"\" class=\"wp-image-579\" srcset=\"https:\/\/cybersmartempire.com\/blog\/wp-content\/uploads\/2025\/11\/down.png 715w, https:\/\/cybersmartempire.com\/blog\/wp-content\/uploads\/2025\/11\/down-300x92.png 300w\" sizes=\"(max-width: 715px) 100vw, 715px\" \/><\/figure>\n\n\n\n<ol start=\"1\" class=\"wp-block-list\">\n<li><strong>Network downtime is temporary.<\/strong> A temporary network failure does not justify a permanent data breach. They could have waited 24 hours.<\/li>\n\n\n\n<li><strong>Alternative Rails Exist.<\/strong> They could have asked users to provide an alternative bank account. They did not. They unilaterally decided to dump funds into mobile money.<\/li>\n\n\n\n<li><strong>Consent is King.<\/strong> Even in an emergency, you cannot share data without consent. They could have sent an email: <em>&#8220;Direct bank transfers are failing. Click here to approve a transfer to your phone number via Paga.&#8221;<\/em> They did not do this. They chose the path of least resistance, regardless of the law.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">Our analysis of the <strong><a href=\"https:\/\/yellowcard.io\/legal\/user-agreement\/\">User Agreement<\/a><\/strong> and <strong><a href=\"https:\/\/yellowcard.io\/legal\/yellowpay-terms\/\">Yellow Pay Terms<\/a><\/strong> confirms what victims have suspected:<\/p>\n\n\n\n<ol start=\"1\" class=\"wp-block-list\">\n<li><strong>Yellow Card has no contractual right<\/strong> to substitute your &#8220;Designated Bank Account&#8221; with a &#8220;Paga Wallet.&#8221;<\/li>\n\n\n\n<li><strong>Yellow Card has no legal basis<\/strong> to share your data with &#8220;Eded Technologies&#8221; for refunds.<\/li>\n\n\n\n<li><strong>Yellow Card is liable<\/strong> for the incompetence of the third parties they hired to clean up their mess.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">This is not just bad customer service. It is a <strong>breach of contract<\/strong>.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">If you are reading this and you have been affected, whether you got your money via Paga or your money is still missing, you are now an <strong>unwilling participant<\/strong> in this breach.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Your Terms of Service have been violated.<\/strong> Yellow Card expects you to stay silent because the amounts are small (N5,000, N20,000). But the precedent is dangerous. If a US company can come to Nigeria, harvest our data, and then dump it with unknown aggregators on their way out, <strong>no Nigerian is safe.<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong><a href=\"https:\/\/cybersmartempire.com\">Cyber Smart Empire<\/a><\/strong> is building a comprehensive dossier of evidence to present to the <strong>NDPC<\/strong> and the <strong>FCCPC Enforcement Unit<\/strong>. We are proving that this was not a mistake; it was a calculated strategy to exit Nigeria quickly, regardless of the cost to user privacy.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>We need your evidence.<\/strong> If you have:<\/p>\n\n\n\n<ol start=\"1\" class=\"wp-block-list\">\n<li>Screenshots of a <strong>\u201cFailed\u201d<\/strong> transaction to your bank account.<\/li>\n\n\n\n<li>Screenshots of the <strong>Paga\/Eded Technologies<\/strong> SMS or receipt.<\/li>\n\n\n\n<li>Emails from Yellow Card Support refusing to explain who \u201cEded Technologies\u201d is.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Contact Us Now.<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Email:<\/strong> <code>press@cybersmartempire.com<\/code> <strong>Subject:<\/strong> Breach of User Agreement<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Do not let them rewrite the rules.<\/strong> They wrote the User Agreement to protect themselves, but today, we are using it to hold them accountable.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Following our explosive expos\u00e9 on the \u201cShadow Wallet\u201d Scandal, which revealed how Yellow Card Financial is routing user refunds through unauthorized aggregators like \u201cEded Technologies,\u201d Cyber Smart Empire has been inundated with reports from victims. The question on everyone\u2019s lips is: \u201cIs this legal? Did I sign up for this?\u201d To answer this, our investigative [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":560,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_seopress_titles_title":"","_seopress_titles_desc":"","_seopress_robots_index":"","_seopress_robots_follow":"","_seopress_robots_imageindex":"","_seopress_robots_snippet":"","_seopress_robots_primary_cat":"none","_seopress_robots_breadcrumbs":"","_seopress_robots_freeze_modified_date":"","_seopress_robots_custom_modified_date":"","_seopress_robots_canonical":"","_seopress_social_fb_title":"","_seopress_social_fb_desc":"","_seopress_social_fb_img":"","_seopress_social_fb_img_attachment_id":0,"_seopress_social_fb_img_width":0,"_seopress_social_fb_img_height":0,"_seopress_social_twitter_title":"","_seopress_social_twitter_desc":"","_seopress_social_twitter_img":"","_seopress_social_twitter_img_attachment_id":0,"_seopress_social_twitter_img_width":0,"_seopress_social_twitter_img_height":0,"_seopress_redirections_value":"","_seopress_redirections_enabled":"","_seopress_redirections_enabled_regex":"","_seopress_redirections_logged_status":"both","_seopress_redirections_param":"","_seopress_redirections_type":301,"_seopress_analysis_target_kw":"yellow card app,yellow card app download,scam alert","footnotes":""},"categories":[94],"tags":[96],"class_list":["post-556","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybercrime-awareness","tag-yellow-card-app"],"_links":{"self":[{"href":"https:\/\/cybersmartempire.com\/blog\/wp-json\/wp\/v2\/posts\/556","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cybersmartempire.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybersmartempire.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cybersmartempire.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cybersmartempire.com\/blog\/wp-json\/wp\/v2\/comments?post=556"}],"version-history":[{"count":24,"href":"https:\/\/cybersmartempire.com\/blog\/wp-json\/wp\/v2\/posts\/556\/revisions"}],"predecessor-version":[{"id":586,"href":"https:\/\/cybersmartempire.com\/blog\/wp-json\/wp\/v2\/posts\/556\/revisions\/586"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybersmartempire.com\/blog\/wp-json\/wp\/v2\/media\/560"}],"wp:attachment":[{"href":"https:\/\/cybersmartempire.com\/blog\/wp-json\/wp\/v2\/media?parent=556"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybersmartempire.com\/blog\/wp-json\/wp\/v2\/categories?post=556"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybersmartempire.com\/blog\/wp-json\/wp\/v2\/tags?post=556"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}