Summary

The Kurdistan Region of Iraq (KRI) is undergoing a major structural transition from cash-based public-sector salary distribution toward electronic banking through the Kurdistan Regional Government’s (KRG) “MyAccount” (Ar: Hesabi – حسابي / Krd: Hazhmari Mn – هەژماری من) initiative (Kurdistan Regional Government, 2023). While this digital transformation aims to enhance administrative efficiency, expand formal financial inclusion, and reduce systemic reliance on physical cash, it simultaneously introduces novel cyber-security vulnerabilities, institutional friction, and digital-literacy barriers. This research paper examines the structural architecture of the MyAccount initiative, the socio-technical factors aggravating user vulnerability, and the emerging threat landscape across the region. By synthesizing empirical implementation data with cybersecurity analyses, the paper evaluates how financial-inclusion strategies can inadvertently create new attack vectors when rapid technology adoption outpaces public digital literacy and localized defense mechanisms. Finally, actionable policy recommendations are proposed to mitigate digital exploitation while safeguarding public-sector payroll systems.

1. Introduction and Contextual Background

For decades, public-sector financial administration in the Kurdistan Region of Iraq operated almost exclusively via physical cash distributions. Government ministries, security forces, pensioners, and martyr families historically received monthly compensation through localized cash-dispensing desks within public institutions (Kurdistan Regional Government, 2023). This reliance on cash created severe operational inefficiencies, heightened security risks during physical transit, and severely restricted the growth of commercial banking across the region.

To modernize its financial infrastructure, the KRG 9th Cabinet launched the “MyAccount” initiative (Hesabi in Kurdish) in 2023 under the direction of the KRG Prime Minister’s Office (Kurdistan Regional Government, 2023). The program was designed to integrate public-sector employees into the formal banking system by digitizing payroll distributions, issuing internationally recognized payment cards, and expanding the regional banking network (Kurdistan Regional Government, 2023).

Despite these strategic goals, transitioning a population with limited historical access to modern retail banking into a fully digital ecosystem presents significant systemic challenges. Fraudsters and cybercriminals frequently target newly banked populations who lack established digital security habits. Consequently, evaluating the security architecture and user readiness of the MyAccount rollout is vital for ensuring long-term financial resilience.

2. Structural Architecture of the MyAccount Program

The MyAccount initiative functions as a public-private partnership coordinated between the KRG, participating commercial banks, and the Central Bank of Iraq (CBI). Under CBI regulations, participating commercial banks are vetted and onboarded to open accounts, issue debit cards, and deploy financial infrastructure throughout the KRI (Iraq Business News, 2023).

2.1 Implementation Metrics and Infrastructure Expansion

Since its inception in 2023, the MyAccount initiative has achieved substantial operational growth:

• Target Population:The program encompasses public-sector beneficiaries, including civil servants, security personnel, pensioners, and social welfare recipients (Kurdistan Regional Government, 2023; Amanat Bank, 2026).
• Beneficiary Registration:Over 1,000,000 public-sector beneficiaries have formally registered bank accounts through the program (Channel 8, 2026; Gulan Media, 2026; KRG Gov 2026).
• Active Electronic Salary Disbursement:By early 2026, the KRG Ministry of Finance and Economy successfully distributed monthly salaries digitally to over 836,500 beneficiaries (for the Month 6 / June payroll) (Gulan Media, 2026; Xelk 2026).
• ATM Deployment:Participating financial institutions expanded the regional automated teller machine (ATM) network to 638-800 (based on different resources) ATMs deployed across the Kurdistan Region (Gulan Media, 2026; Xelk 2026; My Account.GOV 2026).

Table 1 presents the verified regional distribution of electronic salary card disbursements across the KRI governorates for September 2026.

Table 1: Regional Distribution of Electronic Salary Disbursements (Sep 2026)

Source: My Account Official Page (Sep 2026).

2.2 Participating Financial Institutions

To provide beneficiaries with consumer choice and foster market competition, the KRG onboarded a consortium of commercial banks licensed by the Central Bank of Iraq (Iraq Business News, 2023, 2024). Prominent participating institutions include:

• Region Trade Bank (RT Bank)(Iraq Business News, 2023)
• BBAC Bank(Iraq Business News, 2023)
• Cihan Bank(Iraq Business News, 2023)
• National Bank of Iraq (NBI)(Iraq Business News, 2023)
• Iraqi Islamic Bank (IIB)(Iraq Business News, 2024)
• Bank of Baghdad(Iraq Business News, 2024)
• Trade Bank of Iraq (TBI)(Iraq Business News, 2024)

These institutions issue payment cards (primarily Visa and Mastercard networks) and provide digital banking access through proprietary mobile applications (Iraq Business News, 2024, 2025; Amanat Bank, 2026).

3. Socio-Technical Vulnerabilities and Threat Landscape

While electronic banking offers convenience, rapid adoption among first-time banking clients creates acute socio-technical vulnerabilities. Threat actors operating within Iraq and the wider region exploit technical unfamiliarity, linguistic gaps, and organizational trust.

3.1 Digital Literacy and Human Vulnerabilities

A significant proportion of the public-sector workforce-particularly elderly pensioners, rural beneficiaries, and low-income civil servants-possess limited digital and cybersecurity literacy. In international financial inclusion literature, first-time digital banking users consistently exhibit higher susceptibility to social engineering, credential sharing, and unauthorized third-party assistance (World Bank, 2022).

In the KRI context, this vulnerability manifests in several observable behaviors:

• PIN and Card Sharing:Beneficiaries unaccustomed to self-service ATMs occasionally disclose Personal Identification Numbers (PINs) or entrust physical payment cards to relatives, money exchangers, or acquaintances to execute withdrawals.
• Misunderstanding Authentication Protocols:First-time users frequently fail to recognize the confidential nature of One-Time Passwords (OTPs), making them susceptible to social-engineering solicitations.
• Reliance on Informal Intermediaries:Rural pensioners facing physical distance from active ATMs sometimes rely on third-party intermediaries who charge unauthorized fees or compromise account credentials.

3.2 Phishing and Social Engineering Mechanisms

Threat actors targeting digital payment users in Iraq employ various social engineering tactics to harvest credentials and manipulate victims:

• SMS Phishing (Smishing) and Instant Messaging:Fraudsters distribute fraudulent messages via SMS, WhatsApp, Telegram, and Viber impersonating official entities, claiming that account access will be suspended unless credentials are verified.
• Social Media Impersonation:Threat actors set up fake Facebook and Instagram pages posing as official banking institutions or government assistance portals. In March 2025, Iraqi cybersecurity and law enforcement authorities issued warnings regarding fraudulent links on social media designed to harvest user credentials (Kurdistan 24, 2025).
• Voice Phishing (Vishing):Scammers make direct phone calls posing as bank customer service agents or KRG support staff, requesting OTPs, full card numbers, or CVV codes under the guise of system upgrades.

3.3 The Localized Linguistic Barrier

A critical factor compounding cybersecurity risk in the Kurdistan Region is the linguistic context of digital financial services:

• Application Interfaces:Commercial banking applications in Iraq predominantly default to Arabic or English. While some participating institutions offer Sorani Kurdish interfaces, user experience design and security alerts are frequently unstandardized.
• Terminology Inconsistency:Public awareness materials often lack standardized, easily recognizable Kurdish terminology for technical terms such as Two-Factor Authentication, One-Time Password (OTP), or Phishing.
• Potential Risk of Machine-Translated Threats:Broad cybersecurity research highlights that generative AI and automated translation tools allow attackers to generate localized phishing lures at negligible cost (ENISA, 2023). While documented large-scale Sorani-language phishing campaigns remain limited, the accessibility of automated translation presents a growing potential risk for Kurdish-speaking users.

Table 2 provides an analytical framework illustrating how structural socio-technical factors compound security risks for digital salary recipients.

Table 2: Vulnerability Amalgamation Framework for Digital Salary Recipients

Source: Author’s analytical framework based on international digital inclusion and security literature (World Bank, 2022; ENISA, 2023).

4. Institutional Mitigation and Technical Safeguards

To protect the integrity of the MyAccount ecosystem, public and private stakeholders must coordinate technical, administrative, and educational safeguards.

4.1 Technical Countermeasures

Participating commercial banks, in alignment with CBI technical standards, maintain multi-layered digital defenses:

• Automated Fraud Monitoring:Real-time transaction monitoring to detect anomalous withdrawal patterns or velocity anomalies.
• Multi-Factor Authentication (MFA):Mandating OTP verification for out-of-band mobile transactions and online payments.
• Biometric Integration:Implementation of biometric verification within mobile banking platforms to reduce reliance on static passwords.

4.2 Regulatory Oversight and Public Communication

The Central Bank of Iraq and KRG authorities periodically release public notices advising citizens against disclosing sensitive banking information to unverified channels (Kurdistan 24, 2025). However, bridging the gap between high-level institutional warnings and end-user behavior requires continuous, localized awareness initiatives.

5. Strategic Recommendations

To ensure the long-term sustainability, security, and trust of the MyAccount initiative, the following recommendations are offered for policy-makers and financial institutions:

1. Standardize Kurdish-Language Security Interfaces:

Financial institutions participating in MyAccount should mandate fully localized Sorani and Badini Kurdish interfaces across all mobile apps, ATM screens, and SMS notifications, utilizing standardized cybersecurity terminology.

2. Establish Dedicated Support Desks:

Deploy specialized digital assistance personnel at major public-sector workplaces and banking branches to assist first-time users-especially pensioners-without compromising PIN safety.

3. Implement Public Cybersecurity Awareness Campaigns:

The KRG, in partnership with participating banks, should execute targeted multi-channel educational campaigns across television, radio, and social media explicitly demonstrating common smishing, vishing, and social media scam tactics.

4. Foster Daily Usability to Enhance User Trust:

Participating commercial banks and the KRG should accelerate the rollout of digital payment infrastructure, such as point-of-sale (POS) terminals and merchant integration, to support everyday retail transactions, thereby building public trust by transforming payroll accounts into fully functional daily bank accounts.

5. Expand ATM Geographic Distribution:

Accelerate the deployment of off-branch ATMs in semi-urban and rural sub-districts to minimize beneficiary reliance on third-party intermediaries for cash withdrawals.

6. Enhance Inter-Institutional Incident Reporting:

Establish a centralized threat-sharing mechanism between KRG IT authorities, the Central Bank of Iraq, and commercial banks to rapidly report and block fraudulent social media pages, phishing domains, and scam phone numbers.

6. Conclusion

The MyAccount initiative represents a crucial modernizing step for public financial management in the Kurdistan Region of Iraq. By shifting nearly one million public-sector beneficiaries into formal banking channels, the KRG is laying the groundwork for broader financial inclusion and economic modernization. However, the rapid pace of digitisation inherently introduces human and technical vulnerabilities that cybercriminals actively target. By strengthening localized Kurdish-language interfaces, enhancing end-user digital literacy, expanding secure infrastructure, and maintaining rigorous institutional safeguards, the KRG and its financial partners can protect public employees while building a resilient, secure digital economy.

References

• Amanat Bank. (2026). MyAccount Program – Modern Banking for Kurdistan’s Workforce. Amanat Bank Official Website. https://amanatbank.com/myaccount-program/
• Channel 8. (2026, June 2). KRG Begins Phased Transfer of MyAccount Project to Ministry of Finance. Channel 8 English. https://channel8.com/english/news/59200
• European Union Agency for Cybersecurity [ENISA]. (2023). ENISA Threat Landscape 2023. European Union Agency for Cybersecurity. https://www.enisa.europa.eu/publications/enisa-threat-landscape-2023
• Gulan Media. (2026, March 10). KRG Begins Digital Payment of February Salaries for Over 720,000 Beneficiaries. Gulan Media. https://mail.gulanmedia.com/en/story/356806/krg-begins-digital-payment-of-february-salaries-for-over-720,000-beneficiaries
• Iraq Business News. (2023, October 18). New Bank joins KRG’s MyAccount Initiative. Iraq Business News. https://www.iraq-businessnews.com/2023/10/18/new-bank-joins-krgs-myaccount-initiative/
• Iraq Business News. (2023, October 30). National Bank of Iraq (NBI) joins MyAccount Initiative. Iraq Business News. https://www.iraq-businessnews.com/2023/10/30/national-bank-of-iraq-nbi-joins-myaccount-initiative/
• Iraq Business News. (2024, March 12). Iraqi Islamic Bank (IIB) joins ‘My Account’ Initiative. Iraq Business News. https://www.iraq-businessnews.com/2024/03/12/iraqi-islamic-bank-iib-joins-my-account-initiative/
• Iraq Business News. (2024, April 12). Bank of Baghdad joins KRG’s Financial Inclusion Initiative. Iraq Business News. https://www.iraq-businessnews.com/2024/04/12/bank-of-baghdad-joins-krgs-financial-inclusion-initiative/
• Iraq Business News. (2024, May 13). Trade Bank of Iraq to join My Account. Iraq Business News. https://www.iraq-businessnews.com/2024/05/13/trade-bank-of-iraq-to-join-my-account/
• Iraq Business News. (2025, January 20). KRG, Visa Partnership to promote Financial Inclusion. Iraq Business News. https://www.iraq-businessnews.com/2025/01/20/krg-visa-partnership-to-promote-financial-inclusion/
• Kurdistan 24. (2025, March 15). Iraqi Ministry of Interior warns public against cyber fraud and deceptive links. Kurdistan 24 News. https://www.kurdistan24.net/
• Kurdistan Regional Government [KRG]. (2023). MyAccount Initiative Overview. Department of Information Technology & Prime Minister’s Office. https://myaccount.gov.krd/
• World Bank. (2022). Financial Inclusion and Digital Literacy in Developing Economies. World Bank Group. https://www.worldbank.org/
• Kurdistan Government Official (15 September 2026), Message from the Prime Minister about (My Account): https://gov.krd/government/the-prime-minister/activities/posts/2026/september/%D9%BE%DB%95%DB%8C%D8%A7%D9%85%DB%8E%DA%A9-%D9%84%DB%95-%D8%B3%DB%95%D8%B1%DB%86%DA%A9%DB%8C-%D8%AD%DA%A9%D9%88%D9%85%DB%95%D8%AA%DB%95%D9%88%DB%95-%D9%84%DB%95%D8%A8%D8%A7%D8%B1%DB%95%DB%8C-%D9%87%DB%95%DA%98%D9%85%D8%A7%D8%B1%DB%8C-%D9%85%D9%86/
• Xelk Media Network (14 July 2026), the “My Account” project; The number of participants is increasing: https://xelk.org/2026/07/14/44734/
• My Account Official Gov Page ( Sep 2026), More than 1 million public sector employees receive their salaries through my account: https://myaccount.gov.krd/news/over-1-million-public-sector-beneficiaries-paid-through-myaccount-kd/