Online Fraud in Saudi Arabia: What to Do and Get Your Money Back

You saw an Instagram ad for a phone SAR 1,000 below market price, transferred SAR 3,200 to the IBAN the account sent you, and an hour later it disappeared. Or someone called claiming to be from your bank, asked for “the verification code to update your details”, and then you saw transactions you did not make. The next day a “money recovery office” messages you, promising to get the money back for a SAR 500 file-opening fee. That is the second loss many people suffer, so do not transfer anything to anyone from now on.

What to do now, in order: call your bank on its official number and ask it to freeze the account or card and dispute the transactions, then save every trace of the transaction, then file a report the same day. Under Saudi law a fraudster faces up to seven years in prison and a fine of up to SAR 5 million, and you have the right to claim your money back within the same criminal case.

What should you do in the first hour after discovering the fraud?

1. Contact your bank or payment app on the number printed on your card or from inside its app. Explain that it is fraud, ask it to block the cards and electronic channels and dispute the transactions, and keep the request number.
2. Change the passwords for your banking app, email and every account linked to your phone number, turn on two-factor verification, and disconnect any device you do not recognise from the account settings.
3. Save the transfer receipt: amount, date, transaction number, IBAN and the beneficiary name as it appeared to you. Ask the bank for a statement of the suspicious transactions and the accounts the money went to.
4. Do not delete the message, link or call log. Screenshot the ad, the account and the full chat, and copy the links, username and phone number before they are deleted, plus a screenshot of the page where you entered your details.
5. File a report with the criminal investigation authorities, which must accept, examine and collect information on reports and complaints for all crimes (Article 27 of the Law of Criminal Procedure).

Do not expect the bank to reverse every completed transfer. A quick dispute increases the chance of tracing the money, but it does not mean the money will come back. Banks' dispute procedures and deadlines are not set by the crime laws discussed here, so ask your bank directly and ask for its reply in writing. Anyone who calls you afterwards offering to help with recovery and asking for details or fees is, in many cases, a second round of the same fraud.

Is it fraud, or just a dispute with a store?

A real store that delivered late or sent a defective product has breached the sale contract, and your path with it is a civil claim or a complaint. Fraud starts with a lie from the beginning: goods that do not exist, a fake store, someone pretending to be a bank employee or a known supplier, or a link that looks like a message from a bank or delivery company, designed to take your details.

Questions that show the difference: does the store have a registration or real presence? Did it reply after payment and then disappear? Does the receiving account belong to the seller himself, or to someone else? Losing on a deal alone does not make the other party a fraudster.

Many victims feel embarrassed because they clicked the link or read the code to the caller. This does not change the description of the act: both laws punish obtaining money through lies, deception, false belief and pretending to be someone else, which is exactly what happens when someone convinces you he is a bank employee. Delaying out of embarrassment wastes valuable hours in tracing the money.

What is the penalty for online fraud in Saudi Arabia?

Article 1 of the Anti-Fraud and Breach of Trust Law punishes anyone who takes another person's money without right by any fraudulent method, “including lying, deception or creating a false belief”, with up to seven years in prison and a fine of up to SAR 5 million, or one of them. If committed by an organised gang or as a repeat offence, the penalty is no less than half of its maximum and no more than double it (Article 5).

Article 4 of the Anti-Cyber Crime Law punishes two acts common in these cases: obtaining movable property or a document through fraud, using a false name or claiming a false capacity; and accessing bank or credit data without a valid legal reason to obtain data, money or services. The penalty is up to three years in prison and a fine of up to SAR 2 million, or one of them. The law defines the information network broadly to include the internet (Article 1), so messages, links, apps and websites are covered.

The penalties are not added together automatically; Article 9 of the Anti-Fraud Law applies the harsher penalty if the act is also a crime under another law. Fraud covered by the Capital Market Law is excluded and has its own rules (Item 2 of Royal Decree M/79).

Under the Anti-Cyber Crime Law, the penalty is no less than half of the maximum if the crime was committed by an organised gang, the offender abused a public office, minors or similar persons were misled, or the offender had previous convictions for similar crimes (Article 8). The court may confiscate the devices and tools used and the money obtained from the crime, without prejudice to the rights of people acting in good faith, and may close the website permanently or temporarily if it was the source of the crime and it was committed with its owner's knowledge (Article 13).

The account holder who received the money is not always the fraudster

Often the IBAN is in someone else's name: a worker who sold his account, or a person lured by a promise of a job or commission. State the name in your report as it appeared to you, and do not accuse a specific person based on suspicion. Investigation and prosecution belong to the Public Prosecution, which links the accounts and transfers, and the telecommunications regulator provides technical support to the security authorities during evidence-gathering, investigation and trial (Articles 14 and 15 of the Anti-Cyber Crime Law).

A person who knowingly lets someone else use his account to receive victims' money is liable as an accomplice and punished up to the maximum for the crime (Article 3 of the Anti-Fraud Law). The court may exempt from punishment any offender who reports to the authorities before the crime is discovered and before harm occurs, or after it is discovered if his report leads to the arrest of the other offenders (Article 8). This exemption is decided by the court; it is not automatic.

A small company received an email from its “supplier” asking for the SAR 48,000 payment for goods to be sent to a new account. It paid, and then found that the email was fake.

The company keeps the email with its full address and the transfer details, checks with the real supplier by phone, and does not claim the amount from the supplier before it is clear whether the supplier's email or its own was hacked.

Can I get my money back, and how do I claim it?

A criminal penalty does not automatically mean your money is returned. Article 119 of the Civil Transactions Law separates civil liability from criminal liability, and Article 120 requires anyone who causes harm by his fault to compensate. You may claim your private right before the court hearing the criminal case at any stage, even if your request was not accepted during the investigation (Article 147 of the Law of Criminal Procedure).

If it turns out that the account holder was not part of the deception but benefited from the money, Article 144 of the Civil Transactions Law requires anyone who is enriched without a lawful reason at another's expense to compensate him up to the amount of the enrichment. In your claim, state the original amount, what you have recovered, and any additional harm you can prove, and do not add estimated amounts without evidence.

If the other party offers to return the money, make sure it actually arrives in your account; do not rely on a receipt image he sends you. A private settlement does not guarantee the public right case will be closed.

This is general information based on the official Arabic texts of Saudi laws, which prevail over any translation. It is not legal advice for your specific case.

Practical solutions for both sides

If you are the victim of fraud:

• Start with the bank, then the report on the same day, because transferred money moves between accounts quickly.
• Shut the door on the fraudster: new passwords, two-factor verification, and disconnecting unknown devices.
• Do not pay any “recovery office” that contacts you from a social media account.
• Claim your private right expressly in the report, ask the bank for the result of your dispute in writing, and keep a copy of everything you submitted.
• If there are several victims, each should keep his own receipt and chat; a shared story does not replace proof of each person's right.

If you are the holder of the account that received the money, or the accused store:

• If money from an unknown source reached you, do not transfer or withdraw it. Inform your bank immediately and keep proof that you did.
• Do not agree to “return” it to someone who contacts you and asks you to transfer it to another account; you may become part of the path of the stolen money.
• Collect proof of why the money reached you: a contract, an invoice, a delivered shipment, or a chat showing that you were deceived too.
• If you are a real store that delivered late, document shipping and communication, and complete the order or refund by a transfer you can prove.
• Do not give your bank account to anyone to receive money for a commission; you may be held liable as an accomplice.

If you fell victim to online fraud, or were summoned because a transfer entered your account, send us the receipts and chats on WhatsApp, and we will help you arrange the claim or the right response.