Victims of Digital Transformation: How Do Financial System Loopholes Threaten Egyptians’ Money?

Soad Ibrahim (65) spent more than three hours in front of an ATM, in shock after her pension money was withdrawn because of a sudden technical fault in the machine, which deducted EGP 3,000, all that Soad and her family had to support them for a whole month of living expenses.

According to Soad, the machine suddenly stopped working, and on the advice of someone present, the elderly woman went to her bank to understand the reasons and try to obtain her pension manually. One of the employees told her that the fault had caused a glitch in the electronic system, and that it would take from three to 15 working days to verify her complaint and try to pay her the pension.

A few metres from this incident, Safaa, a university student who relies on e-wallets as the only means of receiving money from her family in Upper Egypt to cover her education expenses in Cairo, was making intensive efforts with a well-known telecommunications company (Vodafone) to try to recover EGP 2,000 her father had sent her days earlier, but to no avail. While she was in a state of collapse, overwhelming shock and confusion at being unable to recover her money, the calm employee on the other end of the phone was trying to convince her that the matter was not related to company policy, because it was a technical fault beyond the management’s control, and that “the matter will be looked into, and a reply will come, or perhaps it will not”.

The shock of Soad and Safaa is lived by thousands of people dealing with the digital financial system, whether through banks, e-payment wallets such as (Vodafone Cash, Etisalat Cash, Orange, WE and others) or direct payment apps (the most famous being the InstaPay app, which broke down yesterday, Wednesday, and Fawry), as a result of repeated breakdowns or the inability of protection systems to repel cyberattacks to protect customers’ money, or other reasons mainly related to the weakness of the digital environment and its excessive misuse, owing to the absence of government guidance and education of citizens in this field, which makes them easy prey for theft, fraud and extortion.

The figures and data collected for this investigation point to a doubling of theft and fraud operations through the hacking of the electronic systems of financial wallets and apps, whether those of companies or banks. They also show the weakness of the digitisation system adopted by the Egyptian government with the aim of strengthening protection, countering theft and fraud and protecting citizens from danger; instead of achieving its goals, it has, on the contrary, provided easy loopholes for carrying out cybercrimes on a wide scale, causing citizens to lose their money increasingly in recent years.

A survey we conducted of 100 respondents of different age groups distributed across different geographical areas in Egypt shows that 70% of them had previously been subjected to fraud and theft of money through financial apps, led by telecom companies’ apps at 60%, followed by direct payment apps at 40%, then bank apps and ATM faults at 30%. Most survey participants showed a lack of trust in most of these apps after repeated incidents of theft and faults that cause money to be lost, while they showed higher trust in banks, even in light of their exposure to incidents of fraud or theft.

E-Wallets

The number of e-wallet users saw a notable rise during this year, 2024: by the end of March 2024, the number of e-wallet accounts had reached about 42.14 million, compared with 39.4 million at the end of 2023. This increase came as a logical result of the government and the Central Bank announcing the financial inclusion strategy and support for digital transformation, with the aim of making more easy and secure electronic financial services available to citizens. These wallets allow users to carry out many operations such as transferring money, paying bills and topping up credit, and the number of transactions has risen significantly in recent years.

The most prominent app dominating the market is “Vodafone Cash”, which holds an 80% share of all e-wallet services, with more than 8.2 million active users as of 2024, followed by other apps such as “valU”, which has begun to grow rapidly as part of strengthening financial inclusion, while other apps such as “InstaPay” are gradually gaining popularity, as it is linked to the national instant payments network and offers innovative services for paying bills and daily purchases. The reliance on e-wallets is expected to keep expanding, supported by the growing number of smartphone users and the Egyptian government’s desire to strengthen the digital economy.

Despite its large dominance of the market, it has suffered numerous incidents and successive faults that caused customers to lose money. For example, in July 2024, “Vodafone Cash” suffered a major fault that led some users to report money being withdrawn from their wallets without prior permission; customers complained of shortfalls in their balances, while some recorded unjustified increases in their accounts.

This glitch resulted in money being withdrawn or added by mistake, sparking a wave of anger and anxiety among users. Although the company announced that it had taken swift measures to fix the fault a few hours later, the incident caused temporary losses for many users. This is not the first time “Vodafone Cash” has experienced these problems: in 2023, users faced similar problems because of technical faults, which pushed the company to compensate customers, and in September 2024 “Vodafone Egypt” announced that the “Vodafone Cash” service had returned to normal after a stoppage of about 60 minutes due to technical updates that began at 4 am. During this period, some customers faced a problem with their balances not appearing correctly. The company explained that these updates were part of efforts to improve service quality on some customers’ lines, stressing that balances returned to normal after the updates were completed within one hour.

The Central Bank of Egypt launched the “InstaPay” app in 2022 as part of the instant payments network within plans to automate the financial sector. The app saw wide uptake thanks to its ease of use and speed in completing financial transactions instantly between bank accounts and e-wallets, and it also made it easier to pay bills and make daily purchases. Although “InstaPay” has gained wide fame in Egypt as part of the instant payments network, it has faced some incidents related to the loss or theft of money because of technical faults or unsafe use by some users.

At times, “InstaPay” users have experienced technical problems that led to financial operations being frozen, affecting their ability to transfer or withdraw money on time. Some users reported delays in receiving money or failure to complete transfers because of technical problems in the system, usually due to heavy pressure on the network or software updates.

The Central Bank of Egypt revealed a large increase in the number of transactions through the instant payments app “InstaPay”, with the number of transactions exceeding 93 million in the first quarter of 2024, with total values exceeding EGP 565 billion. The bank indicated that the number of banks connected to the “InstaPay” network had reached 34 out of 35 banks in the system as of March 2024.

The chart shows the nature of “InstaPay” transactions during the first quarter of 2024. Source: Central Bank.

Because of the nature of “InstaPay” as a tool for transferring money instantly, some users have faced problems related to sending money to the wrong accounts by mistake. Although the system itself is secure, human errors such as entering a wrong account number or pressing the send button too quickly have caused some users to lose money, and some incidents involved attempts to hack or exploit users’ data through phishing attacks to obtain their account information in the app.

Unsafe Banks

The banking sector has also seen many incidents related to the theft or loss of money as a result of online fraud or some faults. In 2022, some Banque Misr customers reported being subjected to fraudulent attempts via text messages and phone calls, as fraudsters claimed to be bank representatives and asked customers to share their personal banking information, such as card numbers or passwords.

After obtaining this information, the fraudsters were able to withdraw money from customers’ accounts. As a result, Banque Misr issued an official warning to customers not to share any personal or financial information by phone or message.

From 2022 to 2024, a number of bank customers were subjected to phishing attacks through fake emails claiming to be from the bank. The messages included links to fraudulent websites similar to the bank’s website, asking customers to enter the login details of their accounts; as a result, some customers lost money from their bank accounts before the bank was able to close these websites and take the necessary measures to compensate affected customers, which forced banks to send periodic warning messages to citizens not to share any information about their balances with anyone other than bank employees and through an official mechanism.

According to many Egyptian bank customers whose opinions Zawia3 surveyed, many bank customers face recurring problems when using ATMs, especially at peak times such as after iftar during Ramadan, or during holidays, occasions and official vacations, when pressure on the machines increases. Among the most prominent of these problems is “cash retention”: the machine may deduct the amount from the customer’s account without actually dispensing the cash because of a technical fault.

Another problem is the machine refusing to make a withdrawal despite sufficient balance, usually due to certain cash denominations running out or the customer trying to withdraw an amount exceeding the maximum daily limit. In deposit operations, the machine may refuse to accept cash if it exceeds the permitted number of banknotes, or if it is of unaccepted denominations such as small denominations; the customer must make sure the cash complies with the bank’s deposit policy. In addition, some machines may retain the card when the PIN is entered incorrectly more than three times, as a security measure to verify card ownership. Customers also face a very widespread problem related to the machines constantly lacking sufficient cash, especially at the start of the month, when salaries and pensions are paid, or during holidays, vacations and feasts.

According to citizens’ testimonies, some bank officials may disclaim responsibility for the matter, considering that cash-in-transit companies are the main reason some machines in malls, streets and clubs go out of service, because of their delay in replenishing them at the speed agreed with the bank, compared with the quality of operation of the machines around bank branches.

Banking sources explain in press statements that “each branch manager moves to replenish the machine as soon as he receives a call from the ATM monitoring department that it is out of service or out of cash”, noting that “ATMs are equipped with alarm devices connected wirelessly to all the ATM departments in each bank to receive signals that cash has run out or is about to run out, so that they are replenished quickly before going out of service, according to bank officials”.

Bank officials say that regular rounds by staff are organised to maintain the machines and make sure there are no faults causing them to go out of service, whether because of banknotes being jammed through misuse by some customers or a technical fault in the machine.

Loopholes in the Digitisation of the Financial Sector

The digitisation of the financial sector in Egypt refers to the shift from traditional financial dealings to digital transactions, which strengthens the use of technology in providing financial services such as electronic payments, online banking services and mobile apps. This process comes within the context of the financial inclusion strategy, which aims to integrate more individuals and companies into the formal financial system, and is supposed to target increasing the proportion of individuals who have bank accounts or can access financial services, which strengthens the economy and reduces poverty. Egypt’s financial inclusion strategy was announced in 2019, as part of Egypt Vision 2030, which aims to develop the economy and achieve sustainable development. The government has focused on using financial technology to improve access to financial services.

The proportion of financially included people, according to the indicators of the Central Bank of Egypt’s financial inclusion database for natural persons, reached 71.5% in June 2024, and the period from 2016 to June 2024 saw an increase in the proportion of financially included citizens at a growth rate of 181%.

According to professor of political economy Karim El-Omda, financial inclusion is one of the basic pillars that all countries must focus on, because the higher the rate of financial inclusion, the easier it becomes for citizens, individuals, companies and even governments to handle financial transactions smoothly and effectively. He points out that although Egypt’s financial inclusion indicators were weak at first, the Central Bank’s latest data point to notable progress, with the financial inclusion rate reaching 71% by the end of 2023, compared with 65% in 2022; however, this figure is still far from developed countries, where the financial inclusion rate reaches 97%.

El-Omda explains, speaking to us, that the financial inclusion indicator is measured by the proportion of citizens over 16 who have bank accounts, and that the government has achieved notable successes in this area, while this proportion remains small so far. He explains that there are major challenges hindering further progress, including weak financial awareness among some and a deep-rooted fear of opening bank accounts because of the belief that their financial information will be exposed or that they will be under tax surveillance, especially given an informal economy that makes many individuals avoid electronic financial transactions, in addition to the weakness of the financial technology infrastructure, noting that incidents of lost balances are mostly linked to citizens’ weak culture and occur on a narrow scale.

But in contrast to the official data, data point to a notable increase in online fraud and theft in tandem with the digitisation of the financial sector. For example, statistics showed that cybercrimes have risen significantly, with the internet increasingly used in fraud and theft. Between 2019 and 2023, complaints about online theft crimes increased markedly: in 2019 there were hundreds of complaints, but by 2023 the number had multiplied significantly, and complaints are estimated to have exceeded 1,500, owing to increased reliance on the internet in various daily activities and increased awareness of the importance of reporting these crimes.

For his part, Gamal Mokhtar, a technology and information security expert, believes that cybersecurity, including attacks targeting the theft of citizens’ money through loopholes in apps and e-wallets, is an issue inseparable from Egypt’s national security, as it happens daily and targets individuals, companies and institutions, and requires a swift, continuous response and concerted efforts to confront it, in light of the great technological development the world is experiencing, from which many benefit in carrying out online theft and fraud.

Speaking to Zawia3, Mokhtar diagnoses three main ailments related to the response mechanisms. The first relates to reliance on cheap technology to secure the financial sector in general, whether bank apps and official apps or e-wallets and other online payment apps, as the responsible bodies do not spend in a balanced way on buying protection systems and rely on cheap ones; these cheap systems are not highly efficient and can be easily hacked, so the government and the private sector must allocate much higher budgets to provide the best tools for protecting the digital financial system.

The technology and information security expert notes the importance of relying on highly efficient companies for securing or implementing technological systems within the financial sector, noting that the second ailment linked to the inefficiency of the digital system is reliance on some companies that lack efficiency but are trusted or related, and the absence of competencies is the most prominent challenge in this regard.

Third, Mokhtar points to the absence of assessments related to avoiding the risks of electronic hacking, meaning not anticipating problems or following the traditional approach of denying the possibility of any problem occurring, which makes the possibility of a hack something unexpected and difficult to deal with.

He stresses, speaking to us, that the absence of technological education or culture, what is called “technological illiteracy”, from which most Egyptians suffer, in addition to the absence of guidance from the competent authorities, leaves people unable to protect themselves and makes them easy prey for theft or fraud, stressing the importance of providing an effective, constantly renewed protection system that keeps pace with the technological developments taking place in the world every day.

In this context, he proposes establishing an operations room serving all Egyptian banks to identify and counter new fraud methods, as well as organising campaigns to guide and educate citizens, not settling for temporary solutions, and working to address the problem at its roots and treat it as an ongoing problem, noting that banks, for example, cannot deal with the crisis of theft of customers’ money merely by issuing a warning message, but must play a bigger role in protecting them and countering any hacking operation.

Experts’ statements and customers’ testimonies, as well as reports reviewed, show that the most important problems facing Egypt’s financial digitisation system include several aspects related to infrastructure, legislation and financial inclusion. For example, the complex regulatory environment is one of the biggest challenges, as companies must deal with several regulators, such as the Central Bank of Egypt and the Financial Regulatory Authority, which causes delays in operations and places burdens on start-ups working in financial technology.

Digital financial illiteracy: a large proportion of the population in Egypt is not financially literate, with 76% lacking digital skills, which poses a major challenge to adopting financial technology on a wide scale, especially among the most vulnerable groups, such as low-income people and women. Third, the challenges of cybersecurity and data privacy: protecting customers’ data and preserving their privacy are among the priorities of the digital financial system. Fourth, the limited adoption of digital payments: despite the increased use of digital payments, a large proportion of consumers in Egypt still prefer to pay in cash.

A chart showing the main problems.

What Does the Law Say?

Legal expert specialising in cybercrimes Islam El-Essawy confirms that the concept of “online fraud” is a recent development, not previously present in Egypt, of the traditional crime known as fraud as stipulated in the Egyptian Penal Code, with the “electronic pretext” added as a new element, as this crime is committed via the internet and social media.

He says, speaking to us: “The Egyptian Penal Code criminalises fraud as a general crime; on the other hand, the Cybercrime Law (Law No. 175 of 2018) does not set a direct penalty for online fraud, but it explains in Articles 27 and 28 the means used to commit this crime, which include social media platforms and internet networks.”

The law regulates the combating of crimes linked to the use of technology and the internet: it aims to protect personal information and data, to set appropriate penalties for cybercrimes such as fraud and data manipulation, in addition to defining the responsibilities of internet and app service providers, and it gives the security authorities the powers needed to investigate and seize crimes, which strengthens cybersecurity in Egypt and sets legal controls for dealing with data and information in cyberspace.

Article 27 of the law stipulates that “in cases other than those stipulated in this law, anyone who creates, manages or uses a website or private account on an information network aimed at committing or facilitating the commission of a crime punishable by law shall be punished by imprisonment for no less than two years and a fine of no less than EGP 100,000 and no more than EGP 300,000, or one of these two penalties”. Article 28 of the law also stipulates: “Anyone responsible for managing a website, private account, email or information system who conceals or tampers with the digital evidence of any of the crimes stipulated in this law that occurred on a website, account or email, with the intent of obstructing the work of the competent official bodies, shall be punished by imprisonment for no less than 6 months and a fine of no less than 20,000 and no more than 200,000, or one of these two penalties.”

El-Essawy explains that “any person, whether an individual, company or institution, who creates and manages a website with the aim of committing the crime of fraud is considered to be violating the law, under the articles that criminalise it”, noting that “in the event of loss of money because of faults in payment systems and the various apps of telecom companies or other apps, this is not considered online fraud, but is attributed to a technical glitch that requires filing a civil case to recover the money, and the citizen can demand the return of his money if the glitch resulted from a technical fault in the system”. He also stresses the need to turn to the competent legal bodies, such as the internet investigations unit or crisis management, as legal procedures in Egypt may take time, but they aim to achieve justice.

He adds: “In the event of any glitch in banking transactions, it is advisable to contact the bank directly as a first step. Banks must refund money in cases of technical faults, and there is usually a time frame for refunding the amount ranging from 3 to 15 days. As for digitisation in the financial sector, Law No. 175 of 2018 is considered the most comprehensive in addressing all issues related to digital transactions. In the absence of a direct legal text in the Cybercrime Law, general laws such as the Commercial Code or the Central Bank Law can be relied upon.”

Based on the data in the report on the Egyptian financial sector’s digitisation system and customer protection, it is clear that the challenges facing this system go beyond the technical aspect, as achieving real effectiveness in financial inclusion and customer protection requires integrated efforts at various levels. Despite the efforts made to digitise the financial sector, there is a notable increase in cases of online theft and fraud, which has led many individuals to lose their money, and the continued exposure of customers to fraud reflects clear loopholes in the security procedures in place, in addition to citizens’ insufficient financial awareness. Despite the digital transformation the government is pursuing, the current system suffers from weak protection of data and transactions, making it easier for criminals to exploit technical loopholes for fraud.

Moreover, technical faults in payment and transfer systems contribute to worsening the problem, as customers find themselves facing financial losses as a result of those faults. This situation requires the concerned bodies to take serious steps to improve the technological infrastructure and strengthen security standards.