SIM registration chaos fuels fears of criminal liability

Thousands of phone lines registered under Egyptians’ National ID numbers without their knowledge have sparked widespread alarm after users discovered them through the restored “My Numbers” feature on the My NTRA app. The findings have raised concerns about potential legal consequences, particularly when Egypt’s new Criminal Procedure Law takes effect and judicial notifications begin relying on National ID numbers and registered phone numbers.

The National Telecommunications Regulatory Authority (NTRA) announced last Thursday that it had restored the service using a “temporary technical fix” that masks the middle digits of phone numbers while system updates are completed. But the measure instead exposed the scale of manipulation of users’ data and triggered a wave of complaints over the possible legal consequences of unknown SIMs.

What began as individual social media posts quickly spread across Facebook groups where Egyptians exchange advice and consumer complaints. Users reported a recurring pattern: multiple active lines registered using their personal data across different mobile operators, even though they said they had never obtained the SIMs and did not know who was actually using them.

Panic

The alarm has been fueled by a recent case in which a university student was sentenced to life in prison after a SIM registered in his name without his knowledge was used in a drug-smuggling operation. Investigators linked him to the crime through the SIM, which smugglers used to coordinate a shipment that was later seized.

According to his family, a sales employee at a mobile operator’s branch in Sharqia governorate used the student’s personal data to meet a monthly sales target.

Although the student provided his ID to activate a single line, the employee exploited his signature to activate 10 unauthorized lines. One was later used in the crime, leaving the young man facing a life sentence and exposing a broader pattern of falsified SIM registration data in the area.

Spurred by fear and curiosity after the case, other users rushed to check the “My Numbers” feature on the My NTRA app.

For many, the shock was not that they found a single forgotten line, but that they discovered large numbers of active SIMs registered under their personal data that they knew nothing about. What had seemed like a technical inconvenience suddenly appeared to pose a direct threat to their personal liberty.

Complaints

Posts circulating in major consumer advice and complaint groups, including Ask in Egypt and Power of Social Media, revealed widespread confusion and procedural obstacles after users checked their records. The problem went beyond unknown numbers, exposing complications inside mobile operators’ retail branches themselves.

Testimonies described large numbers of SIMs registered to single individuals. One content creator and group administrator said he had discovered 16 unauthorized lines registered in his name. Another user recounted what happened to his elderly mother, who cannot read or write, when she discovered six numbers registered in her name. When he visited the operator’s branch, an employee told him the numbers were “linked to a corporate account” and refused to cancel or disconnect them.

The user said fear of a repeat of the Sharqia student’s case was what drove him to seek an immediate solution.

Attempts to resolve such cases exposed a procedural gap between the My NTRA app and mobile operators’ branches. One post noted that, to protect privacy, the app masks the middle digits of registered numbers, displaying only the first three and last three. Branch employees, however, required customers to provide the complete 11-digit number before accepting non-possession forms or processing cancellations, leaving users unable to comply when the disputed lines were ones they had never bought or owned.

Other accounts described concerns over how branches handled denials of possession. One woman said that after insisting she did not possess a Vodafone line registered in her name, an employee refused to give her an official copy of the “non-possession form,” handing her instead a handwritten slip bearing a request number. She said the exchange left her questioning the document’s legal standing if she were to face a criminal investigation later.

Official response

Facing mounting public anxiety and the widespread circulation of such accounts, the NTRA issued an official statement on Saturday intended to provide legal reassurance and clarify the remedies available to citizens.

The regulator stressed that “the mere registration of a phone line in a person’s name does not, in itself, establish their responsibility for actions carried out using that line,” provided it can be shown that they did not possess or exercise actual control over it. Criminal liability, it said, is personal and remains subject to the assessment of investigative authorities and the judiciary.

The NTRA urged citizens who discover unknown numbers registered in their names to file formal complaints with the regulator so it can verify whether registration procedures were properly followed, while affirming their right to report the matter directly to investigative authorities, including the Public Prosecution. It said it imposes sanctions on telecom operators whenever violations are proven.

The authority also announced steps to overhaul its activation system, including tighter inspections of retail outlets and operators and an expansion of biometric verification to improve data accuracy and prevent manipulation.

In a follow-up post explaining the complaint process, the NTRA said users should visit an operator’s sales point, report that they do not possess the disputed lines, present their original National ID, complete a non-possession form and keep a copy.

New vulnerabilities

Despite the regulator’s attempt to defuse fears over criminal liability, its response drew sharp criticism from rights advocates and lawyers, who said it shifted responsibility away from mobile operators and required citizens, already victims of negligence or forgery, to repeatedly prove their innocence at retail branches.

Hassan El-Azhary, a lawyer and legal researcher at Masaar, Community for Technology and Law, said the NTRA’s handling of the crisis contains a fundamental legal flaw: it shifts the burden of proof from the parties responsible for the problem, namely the mobile operators, onto the victims.

El-Azhary told Al Manassa that NTRA regulations and official documents require mobile operators to retain verified color copies of purchase contracts for every activated SIM. But sales practices in the field routinely violate those rules. “Sales reps sell SIMs in batches of 50 or 100 using copies of ID cards,” he said, leaving companies unable to prove that the signatures or contracts in their possession are genuine.

Directing citizens to visit branches and submit “denial of ownership” forms, he argued, is “completely upside down.” The regulator should instead compel operators to carry out comprehensive audits of their data and update their records at their own expense and under their own responsibility.

“The authority and the companies are trying to shift the burden of proving line ownership onto the public rather than the operators,” El-Azhary said. “The NTRA should follow the example of the banking sector and issue an order requiring all these companies, within a strict deadline, to review and update every registered line. Whether they succeed or fail is their problem, not the public’s.”

He said the risk goes beyond simply having an extra number registered to someone’s name because mobile lines have taken on a new function as a person’s digital and legal identity. “A phone line is no longer just an ordinary thing,” he said. “A phone number has become a person’s address.”

That “digital address,” he noted, is now tied to substantial financial transactions through mobile wallets. It will also carry new legal weight when Egypt’s Criminal Procedure Law takes effect on October 1, as the law will rely on judicial notifications delivered through National ID numbers and registered phone numbers.

Fraudulent lines registered to someone’s identity, he warned, could expose that person to criminal liability or implicate them in cybercrimes or public funds cases without their knowledge. “Enormous legal and criminal liabilities are now tied to a single line,” he said. “It makes no sense to keep passing the buck.”

At its root, El-Azhary said, the problem is “a data leak crisis, not merely a dispute over SIM ownership,” fueled by an open black market where citizens’ full names and National ID numbers are traded.

“Personal data has become available everywhere for reasons no one understands, making it easy for someone to create and sign a forged contract, and then leave you to deal with the fallout,” he said.

El-Azhary linked the disorder to the continued non-enforcement of the Personal Data Protection Law (Law No. 151 of 2020) and the failure to implement its executive regulations. Had the law been fully operational, he said, citizens who discover fraudulent lines registered under their names would not be limited to filing “denial of ownership” forms. They would have an explicit legal right to demand the permanent deletion of their personal data from the databases of companies with which they never had a contract in the first place.