The number on the phone has to be the number on the screen.

You will meet Nafath at the worst moment, which is every moment a Saudi website decides it believes you. The bank. The post office, when you attach the national address. A telecom shop, when the SIM has to sit on your iqama. Qiwa, when the work contract is the subject. Sometimes Absher itself. The page stops. It shows a number. Your phone buzzes. If you tap accept without looking, you have just told that service to continue. If you did not open that service, you have just told a stranger the same thing.

Nafath is the national digital identity login, the app named نفاذ, published by the National Information Center. The store listing describes it as a way to accept requests, to check identity with biometrics, and to reach government and private services with one login. It is not a second residency card and it is not a wallet. It is a key. Keys are small, which is why people hand them over.

This desk cannot see your Nafath, cannot approve a request, and will not ask you for the number on the screen. Download the app only from the official store listing under the National Information Center, the one titled نفاذ. A link in a WhatsApp group is not a store.

It is not Absher, and it will not work without it

People mix the names because both icons end up on the same home screen in the first month. Absher is the record: the iqama date, the exit visa, the fines. Nafath is the handshake other systems use to ask Absher’s world whether you are really you. You sign in to Nafath with the identity you already have, the national ID or the iqama, and the Absher password that goes with it. If Absher is not open yet, Nafath has nothing honest to attach to.

Do Absher first

A new resident who cannot get past the face scan is often a resident whose Absher account is still the sponsor’s unfinished job, or whose mobile number is still a shop’s SIM. Fix that before you collect a second app. The order is in the Absher note and the SIM note. Nafath on a tourist SIM, with a password you read out to a man in a chair, is not a setup. It is a loan of your name.

The face check is the point

The app is built around a check that the face and the record match, and around a request you accept or refuse. That is slower than a cousin tapping through it. Slow is the design. If a branch tells you the face check can be skipped “because the system is down,” come back another hour. A down system that only works when your phone is in someone else’s hand is the same story as a down Absher.

What a real request looks like

You are the one who starts it. You open the bank site, or Saudi Post, or whatever form you meant to open. You choose to sign in with the national login. The website shows a two-digit number, sometimes more, and tells you to confirm it in the app. You unlock Nafath yourself. The same number is sitting there. You accept. The website continues. Then you are done.

• The number on the site and the number on the phone are the same number.
• You can name the service you just opened. “The bank.” “The address.” “The SIM.”
• The request arrived in that minute, not during lunch an hour later.
• Your phone never left your hand.

Menus move. Do not treat a screenshot from last year as a map of the buttons. Treat the match between the two numbers as the map. If they do not match, you are approving a different request from the one in front of you. Refuse it and start again.

The request you did not start

This is the whole security lesson, and it is boring until it is not. A Nafath prompt can arrive because a website somewhere has your ID number and is waiting for you to bless a login. That website might be yours. It might be a person who bought your number, or guessed it, or kept a photo of the iqama from a shop. The app does not know your intentions. It knows that someone asked, and that you are allowed to say yes.

Reject it

If you are not, at that moment, staring at a login screen you opened, reject the request. Do not tap accept “to clear the notification.” Clearing it by accepting is the opposite of clearing it. Then change the Absher password from your own phone, on your own SIM, if the requests keep coming. Tell the bank or the employer in a plain sentence if a loan or a transfer could have been the target. Speed matters more than embarrassment.

Never read the number out

A helper who says “just tell me the number, it is faster” is asking for the same thing as the one-time code on Absher. Faster for him. If he is sitting beside you and you can see both screens, you can still tap your own phone. If he wants the phone, the answer is no. This is the same rule as the bank queue, written in the account note.

Where you will be asked, in a normal first month

You do not need Nafath to buy bread. You need it when a serious service is about to attach your name to something.

The address and the bank

Saudi Post’s national address flow often sends you through the national sign-on. So do banks, when they are tired of photocopies and want the record itself. Have the app working before you take a ticket at the branch. Discovering in the chair that your face scan fails, while twenty people listen, is how residents end up letting the officer hold the phone. Set it up at home, once, with the door shut. The address itself is a separate job: the short code.

Work

Qiwa, the labour side, uses the same family of login when a contract or a transfer is on the screen. HR may say “approve Nafath.” That can be legitimate, if you are looking at the contract and the number matches. It is not legitimate as a late-night message that says approve it and do not ask what for. Ask what for. A transfer of sponsorship is not a form you bless from a pillow.

The SIM

Some lines are activated with a digital check rather than only a fingerprint at the counter. Fine, if you are in the shop and you started it. Not fine if the shop keeps your iqama photo “to activate tonight.” Tonight is when the request will arrive on a phone that is not in the shop, and you will be tired, and you will tap yes.

When the app will not let you in

Most failures are dull. The interesting ones are told later, after someone has paid a fixer.

• The iqama is not in Absher yet. Wait for the sponsor’s side. A new app will not invent the record.
• The password is the one you used on a foreign website in 2019. Use the Absher password, then change it if you have been reading it aloud.
• The SMS never comes because the number on the account is not the SIM in your hand. Dual-SIM phones do this quietly.
• The face scan fails in a dark shop with a camera covered in fingerprints. Step outside, or go home. Do not let a brighter idea involve their phone.

A paid “Nafath activation” in a typing shop is the Absher shop wearing a new sign. Pointing at a menu is a small favour. Possession of the login is not a favour. If the official app rejects you, the next conversation is with the account you already have, not with a new password written on a napkin.

Set it up once, properly

After Absher opens on your own number, download نفاذ from the official store. Sign in with the iqama number and the Absher password. Finish the face check in daylight, in your own room. Lock the app with a code you do not reuse. Open one real service you already need, the address or the bank, and approve one request while you can see both screens. Then close it.

From then on the habit is short. You start the login. You match the number. You accept. If you did not start it, you reject it. You do not screenshot the request and send it to a group. The group does not need to know that your bank is asking.

If a label in the app worries you, describe the label in your own words on the contact page. Do not send the number, the password, or a screen recording of your face. We will tell you which note is closest. We will not tap anything.

Conclusion

Nafath is the key Saudi services use to check that the iqama and the person are one. Set it up yourself after Absher works, from the official app, on your own SIM. Approve a request only when you just opened that service and the number matches. Reject every other buzz. A shop can point. It cannot become the key.

Questions people actually ask

Is Nafath the same as Absher?

No. Absher holds the residency record. Nafath is the national login other services use to confirm you are that person. You generally need Absher working first. They sit next to each other on the phone. They are not interchangeable, and a password for one is not a toy for the other.

Should I approve a Nafath request I was not expecting?

No. A genuine one starts because you opened a bank page, a post office page, or a government form, and the number there is the number on the phone. A prompt that arrives while you are eating belongs to someone else’s attempt. Reject it. If they keep coming, change the Absher password from your own handset.

Can a shop log in to Nafath for me?

They should not. They can sit beside you and point. The face check, the approval, and the phone stay yours. A person who can accept those requests can walk into services with your name on the door.

Related notes

• Absher in the first week
• Opening a bank account
• The national address

Updated 23 October 2026. KSA GUIDE is independent and based in Riyadh. We are not Nafath, not Absher, and not the National Information Center. The number on your own screen is the one that counts.

Back to the journal