Sudan

The people in the opened cases are those the war has already pushed onto a phone payment. Scammers contact them as staff of a humanitarian organisation, or as a relative abroad, including in Saudi Arabia, and say that money is waiting. Aid workers are in the same net. A Darfur volunteer account that was receiving relief funds lost about 45 million Sudanese pounds in April 2026, sent on to accounts in El Geneina and Khartoum North. Najm al-Din Qamar lost more than 3.6 million pounds after a caller claiming a Qatari aid body sent a code to his phone.

The approach is a conversation, by direct contact or a text on social media. The caller asks for a reference number, an instant payment code, a password, or the answer to a security question. Al-Sanousi said that once the password is handed over, the account is under the scammer's control. A second script is a fake prize, by message or by voice. An engineer quoted by Ayin described the urgent-update pitch: an activation code, or a WhatsApp link the victim is told to open.

Where the money lands is inside Sudan. In Qamar's case the prosecution's letter to the bank traced three accounts, in Forbaranga in West Darfur, in Al Jazeera, and in Atbara on the River Nile. Al-Sanousi said the groups hide behind fake accounts and international numbers, which makes them very hard to reach. The authorities follow the phones, the transfers and the social media pages, with the banks and with Meta, the owner of Facebook.

The payment that moves is the one the customer appears to make. Al-Sanousi told Al Arabiya that the reference number or the instant payment code is itself the order that sends the balance. Passwords and security answers are taken in the same conversation. Ayin describes a further route: a message that the account needs an urgent update, an activation code, or a WhatsApp link that opens the account to the caller. Bankak, the Bank of Khartoum app, is the rail most widely used for transfers.

From 25 January 2026 the central bank's cybersecurity framework requires live fraud detection, checks against skimming at cash machines and shop terminals, and a review after every fraud. Banking apps must warn about phishing and catch fake links, come only from the bank's own store, end a silent session, and tie the login to the phone. A circular of 15 September 2025 gives banks one month to watch accounts continuously and flag unusual patterns.

Remote opening has its own gate. Circular 4/2024, of 2 December 2024, limits it to people the civil register can identify, requires a face check, and tells the bank to detect fraud as it happens, tell the customers who are hit, limit the damage, and report the incident at once. Eight mobile-payment firms hold a licence, among them MoMo, Cashi, SudanPay and Bede. The central bank has also warned against an unlicensed payments app in Rapid Support Forces areas of South Darfur: using it breaches the 2014 anti-money-laundering law.

When a victim reaches the prosecution, the next step on the opened cases is a letter to the bank. In Najm al-Din Qamar's case the tracing put more than 3.6 million Sudanese pounds in three accounts, in Forbaranga, Al Jazeera and Atbara. He said the transfers had been followed and the case was still before the court, with no verdict. A Darfur aid account of about 45 million pounds was traced to El Geneina and Khartoum North.

In October and November 2026 the sums were larger and still moving. Walid Ismail El Sadig told Radio Dabanga that 21 million pounds left his Bank of Khartoum account in two transfers, 15 million on 14 October and 6 million on 3 November. Another customer in Umbadir lost 12 million pounds on 14 October, sent to an account that had also been taken over. The Dar Hamar emergency rooms documented more than 50 such cases, losses of 18 million to 45 million pounds each, and wrote to the bank, the central bank, the public prosecution and the courts.

Once a court has the case, the Informatic Offences Act tells it to confiscate the equipment and the funds collected, sparing a person who acquired them in good faith, and it may close the shop if the owner knew. The bank's duty is separate. Central bank rules say the bank must tell the customers who are hit, limit the damage, and report the incident at once. A bank that misses the September 2025 deadline on monitoring systems faces the penalties in the 2021 sanctions regulation.

US$1m (SDG 2.29b) of it was returned to victims, 2.1% of the money lost.

In May 2026 the cybercrime prosecution's own figure was more than 15,000 electronic fraud reports in one year. Adam Al-Sanousi gave that number to Al Arabiya. He had told Ayin that the information technology prosecution alone had investigated more than 15,000 online fraud cases in the past year, leaving out the other states. He said the reports were rising sharply, and Ayin's investigators placed the jump in February 2026.

Victims in the opened cases went to more than one desk. Qamar went to the prosecution, which wrote to his bank and had the receiving accounts traced across three states. El Sadig was questioned by the public prosecution, then found the cybercrime prosecution full of Bank of Khartoum customers with the same problem. The Dar Hamar emergency rooms passed more than 50 Bankak cases to the bank, the central bank, the prosecution and the courts. Under a December 2024 circular, banks must tell the payment systems department when a fraud or a data breach occurs.

The police keep a separate wartime complaints platform under the Ministry of the Interior. It takes reports of missing people, sexual violence, theft and missing vehicles, and says those reports are investigated, and the complainant told the result, once security allows. The national mechanism formed on 19 October 2026 sits above this. Chaired by the assistant prosecutor general, it can open cases for the state on information crime and on harmful publication, and it watches what is posted on social media.

The figure shown here is an estimate of 23,995 scam cases for 2025, with 57.25 billion Sudanese pounds lost. The cases are the average recorded per adult in India, the Philippines and Vietnam, applied to Sudan's adults. The money is those countries' recorded losses as a share of their economies, applied to Sudan's. It stands for the scale a national register of that kind would hold.

The count the cybercrime prosecution has stated is narrower. In May 2026 Al-Sanousi said the office had recorded more than 15,000 electronic fraud reports in one year, and that the information technology prosecution had investigated more than 15,000 online fraud cases in the past year, leaving out the other states. The two are one floor from one official. The police spokesman's book for the war months is every citizen report: from June 2023 to 15 April 2024 Brigadier Fath al-Rahman Mohamed Tom counted more than 50,000, among them 37,000 car thefts, 13,062 offences against property, 163 missing people and 49 offences against the person.

What that prosecution does with a fraud report is trace and charge. Al-Sanousi said the office follows phones, bank transfers and social media pages, with the banks and with Meta, the owner of Facebook. The Informatic Offences Act punishes cheating or impersonation to obtain an instrument or a signature with up to seven years, and taking card numbers in order to take money with up to twelve years. The court confiscates the equipment and the funds collected.

The prosecutor's account of the reports is a small set of scripts. Al-Sanousi told Al Arabiya that gangs rely on social engineering: a confident caller pretends to work for an international organisation, says a transfer is waiting, and asks for the reference number or the instant payment code, which moves the balance. The same interview describes phishing that offers a fake prize, and the taking of passwords and security answers. He told Ayin that humanitarian-aid fraud was the pattern in front of him.

A second pattern, documented in late 2026, is the emptying of a Bank of Khartoum account the customer already holds. More than 50 customers in West Kordofan, many of them traders in Umbadir, told the Dar Hamar emergency rooms that between 18 million and 45 million pounds had left each account through the Bankak app. One man lost 21 million pounds across October and November. Another lost 12 million on 14 October, sent to an account that had also been taken over. At the cybercrime prosecution he met many others from the same bank.

The legal names sit in the Informatic Offences Act. Cheating, or using a false name or a false capacity to obtain an instrument or a signature, carries up to seven years. Reaching card numbers or data in order to take someone else's money carries up to twelve years. A lawyer told Ayin that the 1991 criminal law treats the same conduct as deliberate deception to take money, with prison, a fine, or both, and a term of up to three years.

Sudan has put the banks under one rulebook, and a prosecutor at the head of a new national mechanism. The cybersecurity framework, in force for every bank and financial institution from 25 January 2026, tells them to detect fraud as it happens and to exchange information across the sector. The September 2025 circular makes continuous account monitoring compulsory within a month. Accounts opened from a distance must be tied to the civil register. Eight mobile-payment firms hold central bank licences, from MoMo and Cashi to Bede and Nil Pay.

The mechanism of 19 October 2026, chaired by the assistant prosecutor general, can file cases for the state. Its stated work is information crime together with harmful publication. Ahmed Al-Dirdiri, the telecoms minister, told the International Telecommunication Union on 12 November 2026 that three authorities, for cybersecurity, artificial intelligence and digital transformation, had been set up in the past year, with a digital identity and a government platform called Baladna, while the phone networks were being restored.

The results are a heavy caseload and open files. More than 15,000 reports in one year came as the prosecutor said the numbers were rising, and that office's figure leaves out the other states. In November 2026 Bank of Khartoum customers were still at the cybercrime prosecution after losses in the tens of millions of pounds. Al-Sanousi said the groups hide behind fake accounts and international numbers.