A Real Fraud Problem, Correctly Escalated
On August 10, 2026, Egypt's National Telecommunications Regulatory Authority (NTRA) referred all four of the country's mobile operators — Vodafone Egypt, Orange Egypt, Etisalat by e&, and Telecom Egypt's WE — to the Public Prosecution over SIM lines registered to citizens' national ID data without their knowledge or consent (NTRA press release; Egypt Independent). The trigger was concrete: a university student's national ID had been used, with the student's own consent, to obtain mobile lines for someone else — one of which surfaced in a drug-trafficking case, exposing him to legal jeopardy for a number he never used (Biometric Update). The case set off roughly 4,000 complaints from Egyptians who discovered lines registered in their names that they had never activated.
That is a legitimate regulatory failure. Identity-linked SIM registries exist precisely so that a mobile number can be tied to an accountable person — for law enforcement, for fraud prevention, for the basic proposition that a phone line isn't anonymous. When operator staff or resellers can register lines against a citizen's ID without that citizen's presence, the entire premise breaks down, and the citizen bears the downside risk. NTRA spokesperson Mohamed Ibrahim was careful to note that a line registered without a citizen's knowledge doesn't create automatic legal liability for its misuse, but the student's case shows how thin that reassurance is in practice once a prosecutor is involved.
The Response: Re-Verify Everyone, Fast
NTRA's emergency package, announced the same day, is broad. It suspends bulk and corporate SIM sales pending re-verification; it requires operators to text every existing line holder instructing them to visit a branch and re-sign contracts confirming their identity, on pain of permanent deactivation; and it accelerates a biometric — facial-scan — verification layer inside operator apps, tied to the national civil ID registry (Egyptian Streets; IDTech). Reported figures put the first re-verification phase at roughly 19 million lines, against a nationwide base of around 127 million registered mobile connections. Officials are targeting an early-September 2026 rollout of the app-based facial check, though NTRA has not published a binding technical implementation date.
The mechanics are straightforward: a customer opens the operator's app, takes a selfie, and an automated system matches it against the photo on file with the civil ID registry. A match authorizes the SIM; a mismatch blocks it. NTRA says the biometric comparison happens in a way that keeps the underlying facial data unavailable to mobile-company employees, addressing the specific failure mode — staff-enabled fraudulent registration — that caused this crisis.
Steelmanning the Regulator
The case for moving fast is genuinely strong. Unauthorized SIM registration isn't a paperwork problem; it's an identity-theft vector with criminal-liability consequences, as the student's case demonstrated. A biometric check at the point of registration is a targeted fix: it closes the exact gap that let an operator employee (or a compromised in-branch process) attach a citizen's ID to a line that citizen never held. Compared to Nigeria's and Pakistan's earlier biometric SIM drives — both prompted by similar fraud and security concerns — Egypt's version is narrower in scope, applies only at registration and re-registration, and NTRA has publicly committed to keeping the raw biometric match out of operator hands. A regulator that ignored 4,000 identity-fraud complaints would deserve far harsher criticism than one that over-corrects.
Where the Fix Outruns the Law
But the design has two problems the government has not answered. First, biometric matching at registration does not solve the actual failure mode in the case that triggered it: the student voluntarily let someone else use his ID to register a line. A facial scan authenticates the registrant, not the eventual holder — nothing in the new system stops a verified line from being handed to a third party the moment it's activated, which is exactly what happened here. NTRA is building a national facial-recognition layer to catch employee-side fraud while leaving the citizen-side loophole that produced the headline case untouched.
Second, and more serious: Egypt's Personal Data Protection Law (Law 151/2020) classifies biometric data as sensitive personal data requiring heightened consent and processing safeguards — but its executive regulations, needed to actually operationalize those protections, were only issued on November 1, 2025, via Ministerial Decree 816/2025. A biometric registry tied to the civil ID system for tens of millions of subscribers is now being built on a data-protection framework that has been operationally live for barely nine months, with no independent regulator track record to test it against. MP Amira al-Adly raised exactly this in a radio interview, pressing the government on the system's legal basis, oversight body, and access controls, and asking pointedly whether this is really scoped to SIM fraud or a quiet first step toward a broader digital-identity system (Egypt Independent). NTRA has not published the technical framework governing match failures, data retention, or which state bodies can query the system — the questions that determine whether "employees can't see the data" is a real safeguard or a talking point.
The Proportionate Path
Egypt doesn't need to choose between tolerating identity fraud and deploying an unaudited biometric layer across its telecom base. A proportionate response re-verifies the current registry (already underway and defensible), fixes operator-side registration controls, and — separately, on its own legislative timeline — subjects any facial-recognition SIM system to the PDPL's sensitive-data provisions with a named supervisory authority, a published retention limit, and an independent audit before the September rollout, not after. Fraud response and biometric infrastructure-building are different projects with different risk profiles; collapsing them into one emergency order, on a five-week clock, treats a scandal as a mandate for surveillance capacity the law hasn't caught up to regulating.