Crypto is unregulated in Saudi Arabia, which means two things at once: nobody is licensed to sell it to you, and nobody is licensed to protect you when it goes wrong. Scammers know both. They borrow the names of SAMA, the CMA, NEOM and Vision 2030 because those names carry trust, and they use the same payment rails you use for groceries, STC Pay and instant bank transfers, because riyals sent that way do not come back. This guide catalogues the patterns that actually reach Saudi residents, from the 2019 "CryptoRiyal" tokens to today's Telegram "recommendation" groups, and ends with a verification routine and a reporting path.
One framing before we start. A scam is not the same as a bad investment. Bitcoin falling 30% after you bought it is market risk, and it is yours to carry. A scam is when the counterparty never intended to deliver, and the test for it is always the same: does the person asking for your money, your coins or your passphrase have any reason to need them that you can verify independently? If not, the answer is no, however polite the message.
What the regulators have actually warned
The baseline document is the 12 August 2018 statement of the Standing Committee for awareness on dealing in unauthorised securities activities, a body chaired by the Capital Market AuthorityCMAThe Capital Market Authority, Saudi Arabia's securities regulator and chair of the Standing Committee that issued the 2018 and 2019 virtual-currency warnings. with SAMASAMAThe Saudi Central Bank, which supervises banks and payment companies. It has licensed no crypto exchange., the Ministry of Interior, the Ministry of Media and the Ministry of Commerce as members. It said virtual currencies are not approved as official currencies in the Kingdom, that no parties or individuals are licensed to deal in them, and it specifically cited "fictitious contracts and the transfer of funds to unknown" parties among the risks. That last phrase is the regulators describing, in 2018, the exact mechanism of most of what follows.
A year later, in August 2019, the Ministry of Finance added a warning aimed at a specific fraud: tokens called "CryptoRiyal" and "SmartRiyal", marketed by a Singapore-based company using the riyal's name and the national emblem and claiming to be funding NEOM. The ministry stated that virtual currencies are not recognised by legal entities in the Kingdom and that any use of the Kingdom's name, currency or emblem to market them would face legal action. The same 2019 statement, reported through the Standing Committee, asked the public to report such offers through the SAMA and CMA websites. Our legal page covers what these statements do and do not mean for ordinary buyers; for this page the point is simpler: the regulators have been describing crypto fraud for seven years, and the pitch has not changed.
Cases on the public record
Three cases show the scale. On 17 October 2023 the Public Prosecution announced charges against fourteen citizens and residents for promoting unlicensed digital currencies and routing victims' transfers to fictitious foreign companies; no city was named. In a separate case reported by Gulf News, Riyadh police arrested five citizens over 120 frauds worth SR 11.8 million, with the proceeds sent abroad in Bitcoin, which is a reminder that crypto is often the exit route for a fraud that began with an ordinary bank transfer. And in February 2025 a token called "Official Saudi Arabia Memecoin (KSA)" was created on the Solana launchpad Pump.fun on 10 February and promoted on 17 February from the hijacked X account of the Saudi Law Conference, with posts impersonating the Crown Prince; the conference disavowed it and the token's market value collapsed to a few thousand dollars within days.
The pattern across all three is impersonation of authority: a fictitious foreign firm, a government project, a prince. Real Saudi institutions do not announce coins on X, do not take payment in USDT and do not need your riyals by tonight.
The P2P fraud catalogue
P2PP2PPeer-to-peer trading: you buy from or sell to another user on an exchange, which holds the crypto in escrow until the riyal payment is confirmed. markets on Binance, Bybit and OKX are where most riyals meet crypto in Saudi Arabia, so they are where most everyday fraud happens. The platform's escrowEscrowCrypto locked by the exchange during a P2P trade and released to the buyer only when the seller confirms payment. It protects both sides only if the seller waits for real funds. is strong protection, but every trick below is a way of talking you out of using it.
| Pattern | How it works | Your defence |
|---|---|---|
| Screenshot release | Buyer sends a fake transfer confirmation or SMS and asks you to release "because the bank is slow". | Release only when the riyals are visible in your own bank app or STC Pay balance. Never on an image. |
| Triangulation / third-party payment | Buyer pays you from a stolen or borrowed account; the real owner disputes it; your account is reviewed and the coins are gone. | Sender name must match the buyer's verified exchange name. Reject any third-party payment and open an appeal. |
| Off-platform "better rate" | Buyer or seller asks to continue on WhatsApp or Telegram to avoid fees, then disappears after one side pays. | Never leave the order screen. Outside the app there is no escrow and no appeal. |
| Crypto-first "cash deal" | A "USDT cash dealer" in Riyadh or Jeddah wants coins sent before meeting, or a deposit to "reserve the rate". | There are no licensed cash crypto desks in the Kingdom. Use the platform or an OTC desk with a legal entity. |
| Wrong network / flash USDT | You receive a "USDT" that is a fake token on another chain, or a sender claims to have sent TRC-20 when nothing arrived. | Check the transaction on the block explorer for the right network and the official contract; a balance is not proof until it is spendable. |
Two further habits close most gaps: trade only with merchants who have hundreds of completed orders and a high completion rate, and keep amounts within your normal account activity so an inbound transfer does not look unusual to your bank. Our P2P guide walks through a safe order step by step, and the selling guide covers the cash-out side.
Fake exchanges, apps and "investment companies"
The second family of scams is the fake platform. Some are websites copied from a real exchange with one letter changed in the domain. Some are Android APK files shared in groups under names like "Binance Saudi" or "Binance Pro Arabic", which no exchange has ever published; sideloaded apps can read your screen and your SMS codes. Some are polished "investment companies" with an office address in Dubai or Riyadh, a WhatsApp account manager and a dashboard that shows your "profits" growing until you try to withdraw, at which point a "tax" or "unlock fee" appears. That last variety is the classic structure of the October 2023 case: riyals transferred to a fictitious foreign firm.
The tell is always withdrawal. A real exchange lets you withdraw a small amount on day one. A scam platform has a reason why you cannot: minimum balance, pending verification, a fee to be paid first. If you cannot get 100 riyals' worth out, do not put 10,000 in. Note also that "Bitcoin ATM in Riyadh" listings fall in this family: there are no verified Bitcoin ATMs in the Kingdom, and a 2019 check found the two machines once listed for Jeddah and Jubail did not exist. Our ATM page explains the alternatives.
Telegram groups, romance and giveaways
Arabic Telegram and WhatsApp are full of "توصيات" (recommendation) channels promising fixed monthly returns, "halal investment" pools and VIP signal groups. A fixed return on a volatile asset is either a lie or a Ponzi scheme paying old members with new members' money; it is also, for what it is worth, exactly the ribaRibaInterest or a guaranteed return on money, prohibited in Islamic finance. A 'guaranteed 10% a month' crypto scheme is riba-shaped as well as fraudulent.-shaped structure that scholars warn against on our halal page. The paid tier of a signal group usually exists to sell you a coin the admins bought earlier.
"Pig-butchering" is slower and crueller. Someone contacts you on Instagram, Snapchat or a dating app, builds a relationship over weeks, then mentions a crypto platform where they "trade with their uncle's help". The platform is fake; the early withdrawals work to build trust; the big deposit disappears. Victims in the Gulf are often expats far from family, which is exactly who the scripts target. Celebrity giveaways are the fast version: a video of Elon Musk, a "send 1 DOGE, receive 2" address, and a countdown. Nobody doubles coins. Ever.
Pi Network deserves its own paragraph because the community here is large. Since the Open Network launch in February 2025 and the ongoing KYC migration, fake "KYC agents" offer to speed up verification in exchange for your 24-word passphrase, "sell your Pi for SAR" groups take either your coins or your riyals first, and apps impersonating the Pi Browser circulate outside the official stores. The Pi Core Team never asks for your passphrase. Bee Network tokens cannot be withdrawn at all, so any "BEE for sale" is fake. If you want price exposure to Pi, a listed exchange such as CEX.IO, which trades it as an IOUIOUAn exchange credit standing in for a coin that cannot yet be withdrawn to its own blockchain. You get the price, not the token., is the honest route; our Pi guide explains the trade-offs.
Seed phrases, phishing and "recovery"
Your seed phraseSeed phraseThe 12 or 24 words that recreate your wallet on any device. Anyone who has them owns your coins; no support team, exchange or regulator will ever need them. is the master key to a self-custody wallet, and every seed-phrase request is theft. The usual costumes: a "Trust Wallet support" account replying to your public complaint on X; a "MetaMask security update" page reached from a sponsored search result; a Google Form "airdrop registration"; a "wallet sync" step inside a fake Pi or Binance app. Legitimate wallets never ask for the phrase after setup, and no exchange, bank or regulator has any use for it.
Once coins are gone, the second wave arrives: "recovery experts" and "blockchain forensic firms" who found your post and promise to retrieve the funds for an upfront fee or a "gas deposit". On-chain transfers are irreversible, and a stranger who can "hack it back" cannot. The only realistic recovery is a police report that reaches an exchange before the thief cashes out, which is why speed and documentation matter more than any service. Keep SMS-based two-factor as a last resort and use an authenticator app; enable withdrawal whitelistingWhitelistA pre-approved list of wallet addresses an exchange may send to; new addresses are blocked for a cooling period. It limits the damage if your login is stolen. on your exchange; and move long-term holdings to a hardware wallet whose phrase lives on paper, not in a photo.
How to verify anything in sixty seconds
- Check the regulator yourself
Open sama.gov.sa or cma.gov.sa directly (type it, do not click a link you were sent). Neither lists any crypto platform as licensed. "SAMA-approved crypto" is false on sight.
- Match the app publisher
On the App Store or Google Play the developer name must be the real company (Binance is listed by Binance Switzerland AG, for example). An APK from a chat is never the real app.
- Read the legal entity
A real exchange names the company serving you and its terms. CEX.IO, for instance, serves Saudi users through CEX OVRS LLC and says so on its legal page; a scam has a logo and a WhatsApp number.
- Test a withdrawal
Deposit the minimum, withdraw a small amount to your own wallet or bank. If there is any reason you cannot, stop.
- Search the name with the word scam
In Arabic and English. Fake investment companies burn through names, but victims post quickly.
- Refuse urgency
A rate that expires in ten minutes, a prince who needs an answer today, a buyer who cannot wait for the bank. Urgency is the scam, not the opportunity.
Reporting in Saudi Arabia
If money has already moved, act in this order. First, call your bank's fraud line (the number on the back of your card or inside the app) so the outgoing transfer can be flagged while it is still inside the Saudi banking system; STC Pay and bank transfers are fast, but a report within minutes sometimes helps. Second, file a police report through 911 or the reporting services on the Absher platform; a report number is what an exchange needs to freeze coins that land in a custodial account. Third, if the fraud happened on an exchange, open an appeal or support case in the app and export your P2P order history and chat. Fourth, report the offer itself through the SAMA and CMA websites, as the 2019 Standing Committee asked the public to do. Save every wallet address: blockchain records are permanent, and they are the evidence investigators actually use.
Do not pay anyone who promises to make the report "faster" or to recover the funds "through contacts". There is no fee-based shortcut inside the Saudi system.
The checklist
- Licence
- No crypto platform is licensed in Saudi Arabia. Any claim otherwise is false.
- Official coin
- There is none. "Riyal coin", "NEOM coin", "KSA memecoin" = scam.
- P2P release
- Only after riyals show in your own bank or STC Pay app, from a sender whose name matches.
- Where to trade
- Inside the exchange's order screen. Never WhatsApp, Telegram or a car park.
- Apps
- Official stores, real publisher name. Never a shared APK.
- Seed phrase
- Never typed anywhere after setup. Nobody legitimate asks.
- Returns
- Fixed monthly profit on crypto does not exist. Signals groups sell exits, not entries.
- Recovery
- No upfront-fee service can reverse a transaction. Police report first.
- Report
- Bank fraud line, then 911 / Absher, then the exchange, then SAMA and CMA websites.
If you are new to all of this, read our beginners' guide before your first purchase, and buy through a platform you can verify rather than a person you cannot. CEX.IO has operated since 2013 and publishes its entities and fee ranges; Binance, Bybit and OKX publish theirs; none of them is licensed here, and that is precisely why the verification habits above are yours to keep. Crypto can lose value quickly even when nobody is cheating you, so start with money you can afford to see halve.
Frequently asked questions
How do I know if a crypto platform is licensed in Saudi Arabia?
None is. No exchange, broker or "investment company" holds a Saudi licence to trade crypto for the public, and SAMA and the CMA have licensed nobody. So any website or caller claiming to be "SAMA-approved", "CMA-licensed" or "the official Saudi crypto platform" is lying by definition. Check regulator lists only at sama.gov.sa and cma.gov.sa; a licence number printed on a brochure means nothing until you find it there.
Is there an official Saudi cryptocurrency I can buy early?
No. There is no official Saudi coin, riyal coin, NEOM coin or Vision 2030 token. In 2019 the Ministry of Finance warned that "CryptoRiyal" and "SmartRiyal" tokens marketed with the riyal name and national emblem were unauthorised and that using the Kingdom's name for crypto marketing would face legal action. In February 2025 a fake "KSA memecoin" was promoted from a hijacked conference account. Anything sold as "official" is a scam.
Someone on P2P paid me and asked me to release the crypto before the money shows. What do I do?
Do not release. Escrow exists so that you only hand over coins after the riyals are visible in your own banking app or STC Pay balance, not in a screenshot or an SMS. If the buyer pressures you, let the order time out or open an appeal with the exchange. Also check that the sender's name matches the buyer's verified name; third-party payments are the classic set-up for a later chargeback or a frozen account.
Can I sell my Pi or Bee coins to a buyer on Telegram?
Treat every such offer as a scam. The Pi Core Team never asks for your 24-word passphrase, "KYC helpers" who ask for it are stealing your wallet, and "sell your Pi for SAR" groups either take your coins first or your riyals first. Bee Network tokens cannot be withdrawn at all, so any "BEE for sale" offer is fake. If you want price exposure to Pi, use a listed exchange such as CEX.IO, which trades it as an IOU.
I was scammed. Where do I report it in Saudi Arabia?
Report to the police immediately through 911 or the reporting services on the Absher platform, and call your bank's fraud line from the number on your card or in the app so transfers can be flagged. The 2019 Standing Committee asked the public to report crypto offers through the SAMA and CMA websites. If the loss happened on an exchange, open a case in the app and export the order history. Keep every screenshot and wallet address; blockchain records are permanent evidence.
Can a "recovery service" get my stolen crypto back?
Almost never, and most "recovery experts" who contact victims are the second scam. Confirmed on-chain transfers cannot be reversed, and nobody can "hack it back" for a fee paid in advance. Legitimate recovery happens only when coins land on an exchange that freezes them on a police request. Report to the police, notify the receiving exchange if you can identify it, and ignore anyone who found you on social media promising a guaranteed return of funds.
Sources and references
- SAMA — Standing Committee warning on virtual currencies (12 Aug 2018)
- CMA — Standing Committee statement on virtual currencies
- SAMA — Ministry of Finance warning on virtual currencies and the "CryptoRiyal" tokens (Aug 2019)
- Cointelegraph — Saudi Arabia warns of crypto scammers posing as government projects (2019)
- Unlock Blockchain — Crown Prince impersonated to launch a fake memecoin (Feb 2025)
- Argaam — Public Prosecution charges 14 over unlicensed digital currencies (Oct 2023)
- Gulf News — Riyadh police: five arrested over SR 11.8m fraud, proceeds sent abroad in Bitcoin
- Binance Square — how to sell crypto safely on P2P (escrow, confirmation, appeals)
- Pi Network — KYC and mainnet migration update (Sep 2026)
Ready for your first coin?
Sign-up and the ID check take a few minutes. Then buy Bitcoin, USDT or Pi with a Visa or Mastercard, or with Apple Pay.
Global platform operating since 2013 · registered with FinCEN (US) and the FCA (UK). Check availability in your country before signing up.
