No Phone, No Salary: The privacy threat behind Syria’s Sham Cash app

Skyline International for Human Rights (SIHR) expresses concerns over the mandatory use of the “Sham Cash” e-wallet for disbursing public sector salaries starting May 2025. While recognizing the country's shift towards more open governance under President Ahmad al-Shar’, the launch of this digital payment system raises serious concerns about transparency, digital security, and the protection of citizens' data and rights, particularly as public trust in institutions is being rebuilt.
 
Syrian officials have promoted Sham Cash as a modern digital solution to facilitate salary disbursements in response to Syria’s ongoing financial crisis and sanctions-induced banking limitations. However, analysis by independent media outlets has revealed critical flaws that cast doubt on the platform’s integrity and safety. Chief among these is the app’s lack of availability through official app marketplaces, such as Google Play or Apple’s App Store. Instead, users must download it via direct links or third-party APK files—an inherently unsafe practice that bypasses standard security vetting processes and leaves users vulnerable to malware, spyware, and potential surveillance.

Beyond its technical vulnerabilities, the app’s operational opacity is deeply concerning. Despite Sham Cash’s growing role in Syria’s public finance system, there is no clear information on the legal entity responsible for managing user data. The app is linked to Cham Bank, a money exchange office in Idlib that is registered in Turkey but lacks international recognition. Additionally, Al-Haram and Al-Fouad, two of Syria’s largest money transfer companies, are collaborating with Sham Cash to facilitate salary disbursements. Notably, transactions conducted through Sham Cash bypass both the Central Bank of Syria and the global banking system, which raises significant concerns regarding the transparency and oversight of these financial operations.

The app’s development background remains similarly opaque. Some sources identify North Soft, a Turkish software firm, as the developer, while others suggest possible ties to Turkcell, Turkey’s largest telecommunications company. Without an officially named parent company or legally accountable entity, users face serious legal and privacy risks, with no guarantees regarding the protection of their data or financial security.

Just as alarming is the app’s lack of a clear, publicly available privacy policy explaining how user data is collected, stored, or shared. The app is known to collect sensitive personal information, such as national ID numbers, full names, contact details, employment data, and, in some cases, even biometric data. This situation forces citizens to trust an opaque system with their most sensitive data, with no clear protections or accountability mechanisms in place. While a Terms of Use exists, it includes a sweeping clause allowing the operators to change the agreement “at any time, without the need to notify you,” with continued use constituting acceptance of any changes. This absence of a formal privacy framework, combined with the ability to alter user terms unilaterally, leaves individuals highly vulnerable to shifting data practices, surveillance risks, and a complete lack of informed consent.

The mandatory nature of Sham Cash's implementation is equally troubling. Currently, more than a million public employees have been informed by the Ministry of Finance that their salaries will only be accessible through the app, effectively eliminating other payment methods. For many Syrians without smartphones, stable internet access, or digital literacy, this policy amounts to a form of exclusion and coercion. Rather than expanding financial inclusion, the app risks exacerbating the digital divide, especially for older people, rural communities, and women who may lack the necessary technological resources or skills.

In light of these concerns, we strongly call on the Syrian authorities to:

1. Immediately pause the mandatory use of the Sham Cash application until substantial improvements are made in its privacy practices, data security measures, and overall functionality.
2. Conduct a thorough, independent review of the app to examine the identity and legal status of the company behind it, assess the technical vulnerabilities, and evaluate its data collection and storage practices to ensure compliance with international privacy standards.
3. Engage with civil society, digital rights experts, and affected communities through public consultation processes to ensure that digital transformation efforts reflect the needs and rights of all Syrians, particularly marginalized groups.

A democratic transition in Syria requires more than institutional reform; it demands transparency, consent, and protections in every aspect of public life, including the digital realm. The Sham Cash case is a critical test of whether Syria’s new leadership is willing to uphold those principles as it shapes the country’s technological future.