Iraq

The pitches reach people who need cash quickly, and pensioners. The Ministry of Planning and the International Labour Organization put unemployment at 16.5% in 2024, and above 36% among people aged 15 to 24, higher still in Nineveh, Diyala and Kirkuk. On WhatsApp and Telegram, anonymous accounts offer a job or a guaranteed profit. A common opening is a small return, under 30,000 dinars, then a guarantee fee and a larger sum, sometimes over 100 US dollars. One man who used a platform called al-Tadawul told Shafaq News that deposits into it had passed one billion dinars before the operators disappeared.

A second script uses a trusted name. On 18 October 2025 the central bank warned that people were pretending to be its staff, especially to pensioners, and asking for a pension card and financial details, or offering a loan. In January 2024 the bank said salary cards of public employees, pension cards and social-care cards were being used outside Iraq in short bursts. On 18 September 2026 Colonel Mohammed Ali Al-Hassoun, the interior ministry's spokesman, described fake links, someone posing as a bank or an official body, a prize or an investment, and then a request for the card number or the secret code.

On 11 December 2025 the National Intelligence Service said it had broken up a network in several governorates. The group posed as payment companies in calls, texts and links, took card details, withdrew the money, sent it abroad and brought it back into Iraq.

The payment that moves is usually one the customer appears to approve. Qi Card, a large electronic payments firm, said in December 2025 that most of the fraud it sees starts when someone shares a verification code. The code carries the full details of the transaction, and sharing it hands the money to the other person. Only the firm's own system is meant to send login codes and transfer messages. The same month the National Intelligence Service described calls, texts and links that pretend to be a payment company and then take the card data.

Banks must make a new wallet harder to open in someone else's name. Rules issued in January 2024, to be applied by 1 June 2024, require a one-time code sent once, and only to one handset, a live photograph kept with the file, a fingerprint, and a check that the face matches the photograph on the identity card. Before a prepaid card or wallet is topped up, the firm must match the face of the person standing there with the holder, and ask where the money came from.

Since June 2024 the cyber-resilience rules tell every bank and payment firm to teach customers how social engineering works. The central bank watches transactions through the national switch, the network that links the banks and the payment companies, and it makes surprise visits. Rasheed Bank, a state bank, said in December 2025 that it does not ask for personal or secret information by phone or by text, and that it had put controls on accounts to block unauthorised access.

A complaint about a payment goes to the central bank, which sends it on. Haider Ghazi, the bank's media director, said on 14 December 2025 that complaints arrive on the bank's own platform and are passed to the bank, the electronic payment company or the exchange office concerned, which then acts and reports back. The bank also watches the national switch and audits files. The cyber-resilience rules of June 2024 add a duty after a serious incident: the institution must tell customers what happened, how large the loss was, how many customers were hit.

Where the card itself was misused, the central bank has sent cases to the courts. In January 2024 it said security reports and its own checks, with the anti-money-laundering office, had found salary cards, pension cards and social-care cards used outside Iraq over short periods. A number of those cards were referred to the Supreme Judicial Council under Law No. 39 of 2015, the anti-money-laundering law. Public employees on the same files went to the Commission of Integrity.

When the money has already left the country, the intelligence service follows it under a judge. On 11 December 2025 the National Intelligence Service said a network had withdrawn funds, transferred them abroad and laundered them back into Iraq. The raids were under warrants from the Supreme Judicial Council, and several members were detained. The interior ministry's information-crimes directorate takes the fraud complaint and makes the arrest.

US$20.8m (IQD 27.02b) of it was returned to victims, 6.2% of the money lost.

In 2024 cybersecurity units in the Ministry of the Interior took more than 4,000 online fraud complaints, nearly twice the number the year before. The ministry registered at least 93 cyber fraud cases in 2023, up from 46 in 2021. Those complaints are followed by the Directorate for Combating Information Crimes. From 1 January 2026 to 18 September the directorate arrested 249 suspects and closed more than 4,890 fake pages and accounts. Colonel Mohammed Ali Al-Hassoun, the ministry spokesman, described the reports as fake links, impersonation of official bodies, banks and companies, prizes and investment offers, and requests for card numbers and secret codes.

A second desk is the central bank. On 14 December 2025 Haider Ghazi said the bank takes complaints on its official platform and sends each one to the bank, the payment company or the exchange office that handled the payment. The national switch links those firms so the transaction can be watched.

The desks meet when the money moves. The interior ministry keeps the criminal complaint and the takedown of the page. The central bank keeps the payment file and can send a misused card to the Supreme Judicial Council under the 2015 anti-money-laundering law. On 11 December 2025 the National Intelligence Service, working under that council's warrants, detained members of a network that had posed as payment companies and sent the money abroad.

The figure shown here is an estimate of 75,056 scam cases for 2025, with 347.58 billion Iraqi dinars lost. The cases are the average recorded per adult in Indonesia, India, Japan, South Korea, Malaysia, the Philippines, Singapore, Thailand and Vietnam, applied to Iraq's adults. The money is those countries' recorded losses as a share of their economies, applied to Iraq's. It stands for the scale a national register of that kind would hold.

The count the interior ministry has stated sits beside that estimate. Cybersecurity units took more than 4,000 online fraud complaints in 2024, nearly twice the year before, and the ministry registered at least 93 cyber fraud cases in 2023, up from 46 in 2021. From the start of 2026 to 18 September the Directorate for Combating Information Crimes arrested 249 suspects and closed more than 4,890 fake pages and accounts. The arrests and closed pages are what the spokesman told the Iraqi News Agency. The complaints figure was reported from the ministry's cybersecurity units.

What that directorate does with a report is trace the page and the person, and arrest. Where a payment card was misused, the central bank has referred cards to the Supreme Judicial Council under the Anti-Money Laundering and Counter-Terrorism Financing Law, Law No. 39 of 2015, and public employees on the same files to the Commission of Integrity. A network that sent stolen card money abroad was raided on 11 December 2025 under warrants from the Supreme Judicial Council.

The scripts the interior ministry described in September 2026 are a short list. Colonel Mohammed Ali Al-Hassoun said the approaches were a fake link, someone posing as an official body, a bank or a company, a prize, or an investment chance, followed by a request for the card number or the one-time code. On 18 October 2025 the central bank told pensioners that callers and social media accounts were pretending to be its staff, asking for a pension card or offering a loan. A licensed firm, the bank said, does not ask for card or account details that way.

Investment pitches run on WhatsApp and Telegram. Shafaq News reported anonymous accounts promising a job or a guaranteed profit. The opening stake is small, sometimes under 30,000 dinars. Once that return appears, the victim is asked for a guarantee fee and then for a larger sum, sometimes above 100 US dollars, and is pushed to recruit other people. A platform called al-Tadawul took deposits that one participant put at more than one billion dinars, then stopped paying and disappeared.

A third group is the card that already exists. In January 2024 the central bank said salary cards, pension cards and social-care cards were used outside Iraq in short bursts, and that fake pages were offering services in exchange for the card details. Qi Card said in December 2025 that the usual last step is the verification code: the message shows the payment, and passing the code on sends the money.

Banks and payment companies now sit under one rulebook, and mobile lines are being put in the holder's name. From June 2024 every bank and payment firm must train staff, teach customers about social engineering, and say how large a serious loss was. From 1 June 2024 a new wallet or a prepaid top-up needs a live photograph, a fingerprint and a face match. In December 2024 the governor, Ali al-Alaq, said a cybersecurity centre for the banking sector was being built. The national switch already links the banks and the payment companies.

The telecoms regulator moved in autumn 2026. Decision Q/116 of 29 September requires a scan of the national identity card or passport and a live photograph, matched to the official record. An Iraqi citizen may hold seven ordinary lines and seven data lines. The records stay in Baghdad, and the company answers for a breach under its control. Companies have 720 days to re-register existing lines. The rules bind 90 days after they are adopted and published, and the fine is up to 3 million dinars for each line that breaks them.

Online fraud complaints in 2024 were more than 4,000, nearly twice the year before, and cyber fraud cases went from 46 in 2021 to at least 93 in 2023. By 18 September 2026 the interior ministry's information-crimes directorate had arrested 249 suspects and closed more than 4,890 fake pages. On 11 December 2025 the intelligence service, under the Supreme Judicial Council, detained a network that had moved card money abroad.