Anti-corruption officials said Hope Olusegun Aroke used a "network of accomplices" for the fraud.
He was arrested in 2012 and has been serving a 24-year sentence at the Kirikiri Maximum Security Prison.
But a preliminary investigation found he still had access to the internet.
In a statement on Tuesday, Nigeria's Economic and Financial Crimes Commission (EFCC) said it had received intelligence about Aroke's scam and was faced with the "riddle" of how he was able to "continue to ply his ignoble trade" from inside the Lagos prison.
Following his arrest in 2012, the EFCC said the then Malaysia-based student was the "arrow head of an intricate web of internet fraud schemes that traverse two continents".
The EFCC this week said its preliminary investigation had revealed that, "against standard practice", Aroke had been given access to the internet and his phone. He had also been admitted to the Nigeria Police Hospital in Lagos for an "undisclosed ailment" and had been able to leave the facility to stay in hotels, meet with his wife and children, and attend social functions.
He had used the fictitious name Akinwunmi Sorinmade to open two bank accounts and bought a luxury car and homes during his time in prison, the EFCC added. He had also been "in possession of his wife's bank account token in prison, which he used to freely transfer funds."