Identity Theft and Financial Fraud Under Saudi Law

The short answer

Article 4 of the Anti-Cyber Crime Law punishes taking money or a deed by fraud, a false name or a false identity, and unlawful access to banking or credit data, with up to three years' imprisonment and a fine of up to SAR 2 million, or either. Article 1 of the Anti-Financial Fraud and Breach of Trust Law punishes taking another's money by fraudulent means with up to seven years and SAR 5 million. These are not absolute ceilings: Article 5 sets the penalty at no less than half the maximum and no more than double it where an organised gang or recidivism is involved.[1][2]

4 min read

Identity theft and financial fraud are addressed by more than one Saudi law at once: the Anti-Cyber Crime Law, issued by Royal Decree No. M/17 of 8/3/1428H, where the act is committed by technical means, and the Anti-Financial Fraud and Breach of Trust Law, issued by Royal Decree No. M/79 of 10/9/1442H, for taking money by fraudulent means generally. This page sets out the texts with their articles and the penalty range, while classifying any particular incident remains the competent authority's own function. Source 1

What Article 4 of the Anti-Cyber Crime Law criminalizes

Article 4 imposes imprisonment of up to three years and a fine of up to SAR 2 million, or either penalty, for the following acts: Source 2

Taking money or a deed by fraud: taking, for oneself or another, movable property or a deed, or signing such a deed, by fraud. Source 3
Assuming a false name or impersonating a false identity in order to achieve the above. Source 4
Unlawful access — without a valid legal basis — to banking or credit data, or data relating to ownership of securities, in order to obtain data, information, money, or the services they give access to. Source 5

What the Anti-Financial Fraud and Breach of Trust Law criminalizes: Articles 1 and 2

Article 1 imposes imprisonment of up to seven years and a fine of up to SAR 5 million, or either, on anyone who takes another person's money without right by committing one or more acts involving any means of fraud, including lying, deception or delusion. Source 6

Article 2 imposes imprisonment of up to five years and a fine of up to SAR 3 million, or either, for breach of trust: taking without right money delivered to a person by virtue of their work, or as a trust, partnership, deposit, loan, lease, pledge or agency, or disposing of it in bad faith, or deliberately damaging it — outside public funds. The essential difference is that the money here was handed over lawfully and then misused, rather than extracted by a trick from the outset. Source 7

The penalty range

Law and article	Acts covered	Penalty
Anti-Cyber Crime, Article 4	False identity or false name to take money or a deed, and unlawful access to banking or credit data	Up to 3 years and SAR 2,000,000, or either Source 8
Anti-Financial Fraud, Article 1	Taking another's money without right by fraudulent means, including lying, deception and delusion	Up to 7 years and SAR 5,000,000, or either Source 9
Anti-Financial Fraud, Article 2	Breach of trust in money delivered by virtue of work, or as a trust, partnership, deposit, agency and the like	Up to 5 years and SAR 3,000,000, or either Source 10

These figures are not an absolute ceiling. Article 5 of the Anti-Financial Fraud Law provides that the penalties imposed are no less than half their maximum and no more than double it in two situations: where the offence is committed through an organised gang, or in a case of recidivism. The Article 1 ceiling can therefore reach double in those cases. The Anti-Cyber Crime Law sets a comparable aggravation in its Article 8: the penalty is no less than half its maximum where the offence involves an organised gang, the abuse of a public office, the exploitation of minors, or prior convictions for similar offences. Source 11

Where more than one law applies: Article 9

A single incident may fall under both laws, and the law does not leave that unresolved: Article 9 of the Anti-Financial Fraud Law provides that where any of the acts in Articles 1 and 2 also constitutes an offence under other laws, the harsher penalty applies. The enacting decree also carves out the fraud acts set out in the Capital Market Law, which remain governed by that law. The Public Prosecution conducts the investigation and prosecution before the competent court under Article 10. Source 12

Reporting first: Article 8

The competent court may exempt from the penalties any offender who takes the initiative of reporting the offence to the competent authority before it becomes known and before harm occurs. Where the report comes after the offence is known, exemption requires that the report lead to apprehending the remaining offenders where there are several. The Anti-Cyber Crime Law sets a comparable rule in its Article 11. Source 13

How to report financial fraud via Absher

Absher provides a dedicated service for financial fraud reports within its Public Security services. The published steps for filing a report: Source 14

#	Step
1	Log in to your Absher account. Source 15
2	Select "My Services". Source 16
3	Select "Public Security". Source 17
4	Select "financial fraud reports". Source 18
5	Complete the required fields and attach any available documents or relevant screenshots. Source 19
6	Submit the report. Source 20

Safe practice on suspicion

Where identity theft or financial fraud is suspected, the safe practice is to use the official reporting channels — such as the Absher financial fraud reporting service — and not to rely on messages, links or numbers of unknown origin to verify identity, transfer money, or supply banking data. Those are the very data Article 4 criminalizes unlawful access to. Source 21

When do you need a licensed lawyer?

This page explains the published statutory texts and the penalty range only. It does not assess any incident, and contains no defence strategy or prediction of a case's outcome. A licensed lawyer becomes a practical necessity where there is an existing report, investigation or summons involving you as complainant or suspect, where a charge is brought under either law, or where the aggravation in Article 5, the exemption in Article 8, or the harsher-penalty rule in Article 9 is in play — each of which turns on the facts of the file. If you have a report, summons, arrest or charge outstanding, consult a licensed lawyer about your rights and the procedures that fit your situation. Source 22

Save or share this guide card:

The image includes its creation date and time in Riyadh.

Share this guide with someone who needs it:

The shared link contains no inputs, results, or private details

Frequently asked questions

What counts as identity theft or financial fraud under the law?

Article 4 of the Anti-Cyber Crime Law punishes taking, for oneself or another, movable property or a deed, or signing such a deed, by fraud, by assuming a false name, or by impersonating a false identity, as well as unlawful access to banking or credit data or securities-ownership data. Article 1 of the Anti-Financial Fraud Law punishes taking another's money without right by any means of fraud, including lying, deception or delusion.[1][2]

What is the penalty for identity theft or financial fraud?

Article 4 of the Anti-Cyber Crime Law: up to three years' imprisonment and a fine of up to SAR 2 million, or either. Article 1 of the Anti-Financial Fraud Law: up to seven years and a fine of up to SAR 5 million, or either. These are not absolute limits: Article 5 of the latter sets the penalty imposed at no less than half its maximum and no more than double it where the offence is committed through an organised gang or in a case of recidivism.[2][1]

What is breach of trust, and is it the same as fraud?

It is not. Article 2 of the Anti-Financial Fraud and Breach of Trust Law imposes up to five years' imprisonment and a fine of up to SAR 3 million, or either, for taking without right money delivered to a person by virtue of their work or as a trust, partnership, deposit, loan, lease, pledge or agency, or disposing of it in bad faith or deliberately damaging it — outside public funds. The difference is that the money here was handed over lawfully and then misused, rather than obtained by a trick from the start.[2]

What is the difference between the Anti-Cyber Crime Law and the Anti-Financial Fraud Law?

The Anti-Cyber Crime Law covers acts committed by technical means, while the Anti-Financial Fraud and Breach of Trust Law addresses taking money by fraudulent means regardless of the means used. Where an act constitutes an offence under more than one law, Article 9 of the Anti-Financial Fraud Law provides that the harsher penalty applies. That law also does not apply to the fraud acts set out in the Capital Market Law, which are governed by that law's provisions.[2]

How do I report financial fraud via Absher?

The published steps: log in to your Absher account, select My Services, then Public Security, then financial fraud reports, then complete the required fields and attach any available documents, then submit the report. The Public Prosecution handles investigation and prosecution of offences under the Anti-Financial Fraud Law by virtue of its Article 10.[3][2]

Does filing a report mean I am in a fraud case?

No. A report is a step that puts the facts before the competent authority to verify; it is not a finding that an offence occurred. The Public Prosecution conducts the investigation and prosecution before the competent court under Article 10, and this page is general information about the law, not an assessment of any situation.[2]

Official sources

Source	Article / reference	As of
Anti-Cyber Crime Law — Royal Decree No. M/17 of 8/3/1428H, Bureau of Experts at the Council of Ministers	Article 4 (taking money or a deed by fraud, a false name or a false identity, and unlawful access to banking and credit data), Article 8 (aggravating circumstances), and Article 11 (exemption where the offender reports first)	2026-07-25
Anti-Financial Fraud and Breach of Trust Law — Royal Decree No. M/79 of 10/9/1442H, Bureau of Experts at the Council of Ministers	Article 1 (taking money by fraudulent means), Article 2 (breach of trust), Article 5 (organised gang and recidivism: no less than half the maximum and no more than double it), Article 8 (exemption where the offender reports first), Article 9 (the harsher penalty applies), Article 10 (Public Prosecution's jurisdiction), and the Capital Market Law carve-out in the enacting decree	2026-07-25
Absher — financial fraud reports (My Government services portal)	Financial fraud reporting service	2026-07-25

Change log

2026-07-07Legally reviewed and published
2026-07-25Corrected against the primary texts: the penalties were described as "published upper ranges", but Article 5 of the Anti-Financial Fraud Law raises them to no more than double the maximum for an organised gang or recidivism; added breach of trust under Article 2, which appeared in the law's name but was never explained; added the harsher-penalty rule in Article 9 and the Capital Market Law carve-out instead of leaving the overlap unresolved; added the exemption for an offender who reports first under Article 8; and attributed both sources to their decrees (M/17 and M/79)

Content on this site is general legal information, not legal advice, and is no substitute for consulting a licensed lawyer. We link you to official sources and do not represent any government body.