If someone hacks into a person’s email account and uses it to fraudulently sign a contract on their behalf, what crimes have actually been committed?
At minimum two distinct offenses: unauthorized access to a private account under Article 14 of Law No. 175/2018 (imprisonment of no less than one year and/or a fine of EGP 50,000–100,000), and forgery/falsification of the resulting electronic signature under Law No. 15/2004 (imprisonment and/or a fine of LE 10,000–100,000). Both can be prosecuted together, since the E-Signature Law’s penalty applies without prejudice to other applicable laws.
Is the victim of the hacked account also liable for anything, or only the attacker?
Generally, only the attacker bears criminal liability, provided the victim did not knowingly facilitate or negligently enable the intrusion in a way that itself violates a legal duty (for example, a company manager whose negligence enabled an employee’s fraud, which carries its own separate liability discussed under Law 15/2004). An individual victim whose account was genuinely compromised without their fault is not criminally exposed by the incident itself.
If a contract was signed using a forged electronic signature obtained through hacking, does the underlying contract automatically become void?
Not automatically — this mirrors the general rule for denied or invalid signatures: the forged signature loses its evidentiary value as proof of that party’s consent, but the contract’s fate depends on whether other independent evidence establishes agreement. Where no other consent exists, the contract is typically unenforceable against the victim; where the victim later ratified or acted consistently with the contract, other evidence could still be relevant.
What penalty applies if someone creates a fake account or email impersonating another person specifically to execute a fraudulent electronic signature?
Under Article 24 of Law No. 175/2018, creating a fake email, website, or personal account in someone else’s name is punishable by imprisonment of no less than three months and a fine between EGP 10,000 and 30,000 — and this would typically be charged alongside the forgery offense under Law 15/2004 if the fake account was used to execute a fraudulent signature.
What evidence should a victim gather immediately after discovering their electronic signature was forged through unauthorized account access?
Access logs, timestamps, device and IP data associated with the unauthorized use, and any available audit trail from the signing platform or email provider — since Law No. 175/2018 grants this kind of digital evidence the same evidentiary weight as material criminal evidence, provided it meets the technical conditions in the law’s executive regulations. Preserving this evidence immediately, before logs are overwritten or accounts are further altered, is critical to both the criminal complaint and any related civil dispute over the contract itself.
Unauthorized access to a signing account and the forgery of the resulting signature are frequently treated as a single incident by clients — but under Egyptian law, they trigger two distinct, overlapping legal frameworks, each with its own penalty structure, and understanding both is essential to accurately advise a client whose signature has been compromised.
The Two Legal Frameworks at Play
Law No. 15 of 2004 (E-Signature Law) directly criminalizes the forgery itself. Without prejudice to more severe penalties in the Penal Code or other laws, imprisonment and a fine of not less than LE 10,000 and not more than LE 100,000 (or either penalty) applies to whoever destroys, damages, or falsifies a signature, electronic medium, or electronically written message through imitation, modification, or alteration, or who knowingly uses a falsified or damaged signature.
Law No. 175 of 2018 (Anti-Cyber and Information Technology Crimes Law) separately criminalizes the access that often precedes forgery. Under Article 14, individuals who intentionally gain access to or hack a website, private account, or protected information system — or who unintentionally and unduly continue such access — face imprisonment of no less than one year and/or a fine between EGP 50,000 and 100,000. Where the intrusion targets a state-owned or governmental information system, Article 20 raises this to imprisonment of no less than two years and a fine between EGP 50,000 and 200,000. Separately, Article 24 criminalizes creating a fake email, website, or personal account in the name of a real individual or organization, punishable by imprisonment of no less than three months and a fine between EGP 10,000 and 30,000 — directly relevant where an attacker impersonates a party’s identity to fraudulently execute a signature.
This means a single incident — someone hacking into a person’s email or signing platform account and using it to forge their electronic signature on a contract — can trigger liability under both laws simultaneously: the unauthorized access itself under Law 175/2018, and the resulting forged signature under Law 15/2004, with courts applying whichever combination of charges the facts support, since Law 15/2004’s penalty applies without prejudice to more severe penalties available elsewhere.
Evidentiary Value of Electronic Traces
One provision worth highlighting for practitioners: Law No. 175/2018 provides that evidence derived from devices, systems, or any information technology means carries the same evidentiary value and force as material criminal evidence, provided the technical conditions in the law’s executive regulations are met — meaning the digital forensic trail left by a hacking or forgery incident (access logs, device identifiers, IP data) is not merely supporting context but can itself constitute formal criminal evidence.