In August 2026 Egypt's telecom regulator did something rare: it referred every mobile operator in the country to prosecutors at once. On 10 August the National Telecom Regulatory Authority (NTRA) sent Vodafone, Orange, e& and WE to the Public Prosecution over lines registered in citizens' names without their knowledge, following user complaints (Gulf News). On 25 August the Interior Ministry announced 18 arrests, including six customer-service employees of one operator, according to reports of the ministry's statement.
The response was fast and the underlying harm is real. But how Egypt fixes this will matter more than how it punished it.
The strongest case for the crackdown
The regulator's position deserves a fair statement. A mobile number in Egypt is no longer just a phone line. Gulf News notes that numbers link to mobile wallets, bank accounts, traffic-fine payments and other government services, and that many Egyptians discovered, often by chance, lines registered in their names. Some filed police reports to protect themselves from liability for misuse. If operators' own staff or retail intermediaries can register lines from copies of ID cards, the identity layer behind those services is broken, and a regulator with licensing power has every reason to act forcefully.
The NTRA's own guidelines on user rights say licensed companies must protect subscriber data and may disclose it only when the law requires, under a judicial warrant, or with the customer's separate written consent (NTRA user-rights guidelines). Registering a line with someone's data and no consent is the opposite of that rule. Referring the operators to prosecutors, rather than only fining them, signals that the failure is a legal one.
What the NTRA actually ordered
The NTRA's press release describes urgent measures the operators agreed to in meetings with the regulator (NTRA):
- Suspend the sale and activation of new lines through corporate systems, for private companies and government entities alike.
- Text holders of older registrations, telling them to visit a branch, sign a new contract and verify identity. Lines whose paperwork is not completed by the deadline are cancelled.
- Speed up biometric verification through the operators' apps.
Enterprise reports that the first phase of the re-verification campaign covers about 19 million SIM cards, out of roughly 127 million registered lines (Enterprise). Neither source I could fetch gave a hard deadline for holders.
The sequencing is sensible in one respect. The corporate channel is where bulk registration is easiest to abuse, and freezing it is a narrow, targeted intervention. It stops new harm without touching ordinary retail customers.
Where proportionality starts to strain
The re-verification order is a different kind of measure. It treats every holder of an older line as a suspect-in-waiting. A person who has done nothing wrong must now take time off to visit a branch, or lose their number. Their number may be attached to a bank account, a wallet, or a government login. The cost of a missed text message is borne entirely by the citizen, while the failure being corrected was the operators' own control environment.
The evidence also points to a narrower source. Police reportedly found 4,071 lines, most already activated and linked to e-wallets, and twelve of the 18 detained worked for intermediary companies and retail outlets. That is a pattern of insider and dealer-channel fraud. It argues for audit trails, dealer licensing, per-agent activation limits and liability for operators whose staff register lines. It does not obviously argue for forcing the whole base through a branch.
The biometric push raises a second problem. SMEX notes that biometric data, unlike a password or phone number, cannot be replaced if leaked, and raises open questions about its collection, storage, retention and protection (SMEX). Enterprise adds that verifying identity at registration does not show who uses the SIM afterwards, since a legitimate holder can hand it to someone else. A system that collects faces and fingerprints at scale to solve an insider-fraud problem could create a larger breach target than the one it closes, unless it comes with clear limits on what is stored, for how long, and who may query it.
Protecting the innocent holder
One element of the response is good policy. The NTRA has said that having a line registered in your name does not by itself make you legally responsible for its use, if you can show you did not possess it. Citizens can also visit a branch and sign a non-possession form, which suspends the line immediately, and can request a list of numbers registered under their ID, as Egypt Independent reported on 13 August. That matters because Enterprise describes a student sentenced in absentia to 25 years after a line registered with his ID was linked to a narcotics case. A liability rule that follows possession, not paperwork, is what a rights-respecting identity regime needs.
What a proportionate fix looks like
- Target the channel. Publish what the investigations find about where the 4,071 lines came from, and tie operator penalties to the control failures found.
- Make re-verification risk-based. Prioritise lines registered through corporate or dealer channels, and let ordinary retail lines verify through an app or at renewal, rather than cancelling them at a deadline.
- Set statutory limits on biometrics. Specify retention, purpose limitation, access logging and breach notification before collection at scale.
- Publish the numbers. SMEX notes the NTRA has not disclosed how many lines or users were affected. Without that, no one can judge whether the remedy fits the harm.
The arrests show the enforcement system can reach insiders. The test now is whether the repair stays aimed at them.