Fake Absher & Nafath Verification Call Scams: How Social Engineering Traps Work

In the Kingdom of Saudi Arabia, government digital identity portals like Absher (أبشر) and the National Single Sign-On (Nafath / نفاذ) have unified civic life. From authenticating vehicle registrations and residential leases to opening bank accounts and issuing mobile SIM cards, Nafath is the central digital gateway for over 35 million citizens and residents.

Because Nafath grants universal access to official transactions, cyber syndicates have developed sophisticated social engineering scams targeting users' authentication prompts. In this guide, we expose how fake Absher and Nafath verification calls work, dissect the two-digit authentication number exploit, and provide steps to safeguard your national identity.

1. The Two-Digit Nafath Verification Exploit

To understand the danger, one must understand how Nafath works. When you initiate a legitimate government or banking action, Nafath generates a two-digit number (e.g., 47). You must open your Nafath mobile app, tap "Accept", and select that identical two-digit number to finalize authorization.

The Fraud Scenario:

1. The Pretext Call: The scammer contacts the victim claiming to represent the Ministry of Interior, Jawazat (Passports), Muroor (Traffic Police), or a telecom provider (STC, Mobily, Zain). The caller claims there is an urgent security violation, an unpaid fine, or that a new SIM card must be registered to your national ID.
2. The Background Request: While keeping you engaged on the phone, the scammer opens an online banking portal, mobile provider portal, or credit bureau platform using your National ID or Iqama number. The platform triggers an official Nafath authentication request.
3. The Deceptive Prompt: Your Nafath app buzzes with an incoming notification. The scammer says over the phone: "We have sent an official verification to your Nafath app. Please open the app immediately, press Accept, and select the number 72 to verify your innocence."
4. The Catastrophic Authorization: The victim assumes they are verifying their identity to a government official. Once they tap the matching number, the scammer gains full legal authorization to issue SIM cards in the victim's name, take out digital personal loans, or transfer funds.

2. Common Pretexts Used by Absher & Nafath Fraudsters

Scammers exploit urgency, fear, and authority:

• "Your Iqama/National ID is Expired": Claiming residency suspension unless updated via phone.
• "Suspicious SIM Cards Registered in Your Name": Claiming multiple unauthorized phone numbers were opened under your ID, threatening legal action unless verified.
• "Court Order or Ministry of Justice Subpoena": Threatening immediate travel bans or bank freezes unless you authenticate an urgent Nafath notice.
• "Medical Insurance or Tawakkalna Update": Phishing for personal details under the guise of health compliance.

3. Five Golden Rules to Protect Your Digital Identity

1. Never accept Nafath requests during phone calls: If anyone calls you and tells you to open Nafath, hang up instantly.
2. Read the service description in Nafath: The Nafath app clearly displays the requesting entity (e.g., "Al Rajhi Bank" or "STC"). If you are speaking with someone claiming to be "Muroor" but the Nafath app displays a banking login request, it is an outright fraud attempt.
3. Activate Biometric Protection: Ensure face-recognition or fingerprint security is enabled inside your Nafath and Absher applications.
4. Verify the Incoming Number on Number LookUp: Check the caller's phone number on Number LookUp: select the Saudi flag (+966) to review community spam reports.
5. Report Scam Attempts: Forward scam SMS messages to 330330 and file a report on the "Kollona Amn" (كلنا أمن) application.

4. What to Do If You Accidentally Approved a Nafath Request

If you suspect you fell victim to a fraudulent Nafath approval:

• Open your Nafath app immediately and check active digital sessions.
• Log in to Absher and check the "My SIMs" (أرقامي) service on the CST portal to see if unauthorized mobile numbers were issued in your name.
• Contact your commercial banks immediately to freeze online banking and debit cards.
• File an official report with the police or Public Prosecution detailing unauthorized identity impersonation.

For additional guides on telecommunications safety, explore our articles on common Gulf phone scams and how to block spam calls on iPhone and Android, or remove your contact details via Remove My Number.