Saudi National Day has become a prime target for cybercriminals exploiting the SADAD payment system with sophisticated invoice scams. Resecurity’s advanced fraud prevention and threat intelligence solutions are playing a pivotal role in protecting both banks and consumers across the Kingdom.
Introduction: A New Wave of Fraud Targets Saudi National Day
Saudi National Day, celebrated each September 23rd, is a time of national pride and increased digital activity. Unfortunately, it has also become a magnet for cybercriminals who exploit the festive surge in online transactions. In recent years, the Kingdom has witnessed a dramatic rise in fraudulent activity—particularly involving fake SADAD invoices—posing significant risks to both financial institutions and everyday consumers.
The Fraud Landscape: SADAD Invoice Scams Surge During National Day
Official Warnings and Threat Trends
Saudi authorities, including the Saudi Central Bank (SAMA) and the National Cybersecurity Authority (NCA), have repeatedly warned of a sharp increase in cyber fraud around National Day. In 2025, AI-powered scams surged by 300%, with SADAD invoice fraud emerging as a primary threat vector. These scams typically spike during public holidays, leveraging the high volume of digital payments and the festive atmosphere to catch victims off guard.
How SADAD Invoice Scams Work
SADAD, the Kingdom’s national electronic bill payment system, is widely used for settling government and commercial bills. Fraudsters exploit this trusted platform by:
- Sending fake SADAD invoices via SMS, email, or messaging apps, often impersonating government agencies or major service providers.
- Phishing links that direct users to counterfeit payment portals mimicking the real SADAD interface, harvesting credentials and payment data.
- Social engineering tactics such as threats of service suspension or legal action to pressure immediate payment.
- Spoofed communications that appear to come from banks or official entities, increasing the likelihood of victim compliance.
Saudi media have reported a marked increase in unauthorized withdrawals and account compromises linked to these scams, with the financial impact described as “deep and comprehensive”.
Key Statistics (2024–2026)
| Indicator | Value/Trend |
| AI-powered scam increase | 300% surge in 2025 |
| Primary scam vector | SADAD invoice phishing/social engineering |
| Common scam period | National Day and public holidays |
| Official warnings issued by | SAMA, NCA, Ministry of Interior |
| Sectoral impact | Financial services, government, consumers |
Regulatory Framework: SAMA’s Robust Response to Fraud
Saudi Arabia’s regulatory environment is anchored by SAMA’s Cyber Security Framework (CSF), Counter-Fraud Framework, and strict consumer protection rules. Key requirements include:
- Real-time fraud detection and monitoring for all banks and payment service providers.
- Mandatory reporting of new fraud typologies and significant incidents to SAMA.
- Comprehensive consumer protection, including immediate notification of suspicious transactions and accessible complaint channels.
- Severe penalties for non-compliance, including fines up to SAR 5 million per breach, operational restrictions, and potential license revocation.
Third-party cybersecurity vendors like Resecurity are essential partners, providing the technical capabilities and intelligence needed for regulatory compliance and effective fraud prevention.
Resecurity in Saudi Arabia: Advanced Protection for Banks and Consumers
Local Presence and Strategic Partnerships
Resecurity, a US-based cybersecurity leader, has established a strong footprint in the Kingdom:
- AI-driven R&D center in Riyadh to accelerate local innovation and support Saudi organizations leveraging cutting-edge data science
- Proud Chairman’s Circle Member of the U.S.-Saudi Business Council – Resecurity is committed to fostering positive cooperation between the United States and the Kingdom of Saudi Arabia.
- Collaboration with the Union of Arab Banks, extending protection to member banks throughout the region.
- Partnership with University of Jeddah – Resecurity is supporting academia to help local talent with further career navigation in cybersecurity, fraud prevention and risk management
Core Capabilities and How They Counter SADAD Invoice Scams
| Scam Typology | Resecurity Capability | Example of Protection |
| Fake SADAD Invoices | Real-time fraud detection, brand protection, takedown of fake SADAD sites | Identifies and blocks fraudulent SADAD payment forms and fake invoice notifications |
| Phishing (Credential Theft) | Credential leak monitoring, phishing kit analysis, threat intelligence | Detects phishing campaigns targeting SADAD and Saudi banks, alerts on credential leaks |
| Impersonation | Brand protection, takedown of counterfeit domains, threat intelligence | Removes fake websites mimicking banks and SADAD, reducing consumer exposure to scams |
| Money Mule Recruitment | Threat intelligence, monitoring of job scam campaigns, takedown of recruitment sites | Identifies and disrupts fake job offers used to recruit money mules for laundering stolen funds |
Key Resecurity Solutions:
- Fraud Prevention Platform:
Deployed in major Saudi banks, this platform provides real-time monitoring and detection of fraudulent transactions, leveraging behavioral analytics and anomaly detection to flag suspicious SADAD invoice activity. - Credential Leak Monitoring:
Continuous surveillance of the dark web and illicit forums for leaked credentials linked to Saudi consumers and banking customers, enabling rapid response to account takeover attempts. - Brand Protection and Takedown:
Automated detection and dismantling of phishing sites and counterfeit domains impersonating SADAD and Saudi banks, drastically reducing the window of opportunity for scammers. - Threat Intelligence and Phishing Kit Analysis:
Delivery of actionable intelligence on emerging phishing kits and scam infrastructure, empowering banks to proactively defend against evolving threats. - Regulatory Alignment:
All solutions are designed to support SAMA’s Counter-Fraud Framework, ensuring banks meet the Kingdom’s stringent compliance requirements.
Visualizing the Threat: SADAD Scam Surge and Resecurity’s Response
Resecurity has successfully blocked over 320 fraudulent sites impersonating key financial and government platforms in Saudi Arabia, demonstrating the effectiveness of its brand protection and takedown capabilities.
Staying Ahead of Evolving Threats
The surge in SADAD invoice scams around Saudi National Day underscores the need for continuous vigilance and advanced cybersecurity measures. As fraudsters become more sophisticated, leveraging AI and social engineering, both banks and consumers must adopt a proactive stance.
With its deep local presence, advanced technology, and regulatory alignment, Resecurity is a critical ally in the Kingdom’s fight against digital payment fraud—protecting both banks and invoice scams.
Recommendations:
- For Banks:
Invest in real-time fraud detection, threat intelligence, and brand protection platforms. Partner with trusted cybersecurity vendors like Resecurity to ensure compliance and robust defense. - For Consumers:
Remain vigilant during high-risk periods, verify all payment requests, and report suspicious activity immediately. - For Regulators:
Continue to enforce strict compliance, promote public awareness, and foster collaboration between financial institutions and cybersecurity experts.
Real-World Examples & Typical Scam Scripts
Case Examples:
- Victims receive WhatsApp or SMS messages claiming they owe a SADAD invoice, have a pending utility bill, or must pay a traffic fine. Links direct them to fake SADAD portals mimicking major banks.
- Parcel delivery scams prompt users to confirm receipt and pay through fraudulent SADAD forms.
- Social media messages impersonate charities, requesting “processing fees” via SADAD.
Common Scam Messages:
- “You have an outstanding SADAD invoice. Please pay immediately to avoid service interruption. Click here to view and pay your bill.”
- “A new traffic violation has been registered. Settle your fine via SADAD to avoid penalties.”
- “Your electricity/water bill is overdue. Pay now through SADAD to prevent disconnection.”
- “You are eligible for a donation from [charity]. Pay a small fee via SADAD to complete the process.”
Official Warnings & Consumer Protection
SAMA (Saudi Central Bank)
- Urges consumers to avoid sharing personal or banking information and to only use official websites for payments.
- Identifies invoice scams and false invoicing as major risks.
- Provides an online fraud reporting form.
Ministry of Interior (Absher Platform)
- Warns against responding to unsolicited messages or sharing personal data.
- Advises using only the official Absher website for government services.
Saudi CERT
- Publishes alerts about fraudulent SMS and phishing attempts, especially those requesting banking updates.
Reporting Channels
| Authority | How to Report Fraud |
| SAMA | Online Fraud Reporting Form |
| Ministry of Interior | Email: 991@moi.gov.sa |
| Saudi CERT | Security Awareness Portal |
| Major Banks | Official customer service numbers or in-branch |
Legal Penalties for Fraud in Saudi Arabia
Financial fraud is a serious crime in Saudi Arabia, carrying penalties of up to seven years in prison and fines up to SAR 5 million. Repeat or organized offenders face even harsher consequences.
How to Protect Yourself: Actionable Consumer Guide
1. Verify All Invoices:
Always check biller codes and reference numbers through your official bank app or website. Never pay invoices received via unsolicited messages.
2. Avoid Clicking Suspicious Links:
Access SADAD and government services directly through official apps or URLs—never through links in emails, SMS, or social media.
3. Guard Your Information:
Never share banking credentials, passwords, or 2FA codes with anyone.
4. Report Suspicious Activity:
If you receive a suspicious invoice or payment request, report it immediately using the official channels listed above.
5. Stay Informed:
Follow SAMA, the Ministry of Interior, and Saudi CERT for the latest alerts and guidance.
Be the first to comment