Nafath Safety: What to Do with an Unexpected Approval…

The official Nafath app listings describe Requests for login and other activity from integrated applications. If a request appears when you have not started an action, treat it as unexpected. Do not approve it to make it disappear, and do not read its details to a caller or sender. This guide gives a calm, conservative response: stop, protect the prompt, verify the service through a route you open yourself, and use current official help if you remain concerned. It does not claim to diagnose an account or replace the provider’s security instructions.

First response: do not approve a request you did not start

An authentication approval can affect access to an account or connected service. If you were not just trying to use a provider, do not approve the request. Avoid guessing that it is a harmless test, a duplicate message or a technical error; the public information cited here does not establish why any individual prompt appeared.

Do not tap a choice simply because a notification is interrupting you or someone says that approval will cancel a payment, stop a lock or confirm that you are the account holder. A request should match an action you knowingly initiated. When it does not, pause and verify independently.

If you can safely close or dismiss the notification without approving it, do so and keep the phone under your control. Do not share the request number, code, screenshot or account details with the person who contacted you. Use the verified provider’s own help route for next steps.

Check what you were doing at the time

Ask whether you recently opened a verified government or private-service website and intentionally started a sign-in or other task that might use Nafath. The Saudi government describes National Single Sign-On for participating providers, so context with a particular connected service matters. A prompt without such context is not something to approve.

If you did start a task, independently return to the provider’s official website or app and confirm that you are still on the expected service. Do not navigate using a link supplied by an unsolicited caller or message. Check the address and use the current official instructions for the service you intended to access.

The request feature described in the Nafath store listings can cover login and other requests from integrated applications. That description does not identify the origin of a specific notification. If you cannot match it to your activity, leave it unapproved and ask the provider through a verified channel.

Do not share codes, numbers or screenshots

Treat any approval code or request number displayed during identity verification as sensitive. Do not tell it to a caller, paste it into a chat, publish a screenshot or forward a notification. A person who asks for it has not proved that they represent the service, even if they know your name or mention Nafath.

A screenshot may reveal more than one code. It can also expose names, timestamps, service labels or other personal information. Do not post the screen on social media to ask strangers whether it is genuine. Instead, open official help independently and describe the issue without disclosing secrets.

This independent guide will never ask you to send a password, OTP, identity number, biometric information, session token or Nafath request detail. Anyone asking for those items in order to explain the page is not following a safe support practice. Keep your phone and identity information private.

Watch for pressure and impersonation tactics

Unexpected authentication prompts can be paired with a call, text or social message that creates urgency. A stranger may claim they are cancelling a transaction, investigating fraud, helping with a government service or preventing a fine. Pressure is a reason to stop, not a reason to approve more quickly.

Do not install a remote-access app, share your screen or hand control of your phone to someone who contacted you unexpectedly. Do not follow shortened links or download an app file from a message. Open the service provider’s official site or its verified store listing using a route you choose independently.

A caller may know some information about you and still be unverified. Do not treat a familiar name, copied logo or local-looking number as proof. End the contact if you feel pressured, then look up current official help from the provider’s own website or app. This guide does not publish unverified support contacts.

If you already approved or disclosed something

If you approved a request you did not initiate or shared details with another person, stop further interaction and go directly to the official provider’s website or app. Use its current account-security instructions and support options. This article cannot determine what was accessed or prescribe a universal recovery sequence.

Do not use contact details from the unexpected caller or message to report the event. Independently find the provider’s official help route and explain what happened without sending passwords or codes in an open channel. Follow the provider’s advice about securing the affected account and any related service.

If you installed software or allowed remote access at someone’s request, avoid entering additional credentials while the device is under another person’s control. Use trusted official device guidance and the provider’s support route to understand safe next actions. The right response can depend on the device and account, so do not guess from this general article.

Verify the source and use a short safety checklist

Saudi government information describes the sign-on service as available through participating providers, not every website. Confirm whether the provider you intended to use actually offers Nafath by checking its own official sign-in information. A third-party request or a notification label alone cannot verify a service connection. Remember the core rule: no action started by you means no approval from you. Keep the prompt private, do not share a request number, and do not let a caller rush you. A legitimate sign-in should begin from the provider you chose, not from an unsolicited message or an unfamiliar link.

For app downloads, use the official Nafath Apple App Store or Google Play listing linked below and inspect the publisher details. Avoid APK mirrors or imitation pages. Keep the app updated through the store, but do not infer that an update will explain or resolve an unexpected request. If you did initiate a sign-in, verify the provider independently and follow the current official screen. The store listings describe Nafath requests from integrated applications, but they do not establish the exact process for every service. If in doubt, leave the prompt unapproved and consult the provider. Keep a private note of the service you were using and whether you initiated a sign-in, but leave codes and identity details out of that note. If you contact a provider, describe the general timing through its verified secure channel. Do not speculate publicly about who generated the prompt.

If a screen does not match the current official instructions or you cannot identify the provider, do not approve it. Close it and begin again from a verified official route only if you intend to take an action. For a personal security concern, use the provider’s current official support channel. Nafath-related prompts are identity-sensitive. An independent article cannot inspect your account, cancel a request or determine whether a third party accessed it. Use only verified official information for personal help, and never share credentials, biometrics or approval details with a stranger.

Frequently asked questions

What should I do with an unexpected Nafath request?

Do not approve it or share its details. Close it if possible, then independently verify the service through its official website or app.

Can I share a Nafath request number with support?

Treat request details as sensitive. Use the provider’s verified help channel and follow its current directions, but do not disclose codes to an unsolicited caller or public forum.

What if someone says the request is needed to cancel fraud?

Do not approve it based on that claim. End the contact and independently open the official service to find its current security guidance.

I approved a request by mistake. What now?

Stop interacting with the caller and go directly to the affected provider’s official site or app. Follow its current account-security guidance; this guide cannot diagnose the incident.

Does every unexpected prompt mean my account was hacked?

The cited public sources do not identify the cause of a particular prompt. Do not assume a diagnosis; leave it unapproved and verify through official support.

Official sources and further reading

Public-service pages and app listings can change. Follow the live instructions from the source before taking action.

Source review date: 2026-10-11. If a live official screen differs, follow the official screen.