Regime-controlled security certificates could turn online banking access into an open door for surveillance.
For the past two years, Iran’s banks have repeatedly been hacked, knocked offline, and cut off from technology they rely on to secure online transactions. Now their customers face a dilemma: to use ordinary banking services safely, they may have to trust security infrastructure controlled inside Iran—infrastructure that could give the authorities extraordinary access to their internet traffic.
This summer, Iranian e-banking customers began receiving security alerts from their web browsers, warning them not to proceed in signing into their online accounts. The Central Bank of Iran (CBI) eventually attributed the problem to the revocation of their foreign-provided technical and security certificates. On August 15, it released a statement telling users they could ignore the security warnings and log in, effectively normalizing risky behavior. “Until the issue is resolved, users can bypass the error message displayed by their browser to access the services they need,” the statement concluded.
Far from being resolved, the certificate problem spread, and Iranian banks were ultimately forced to migrate from their existing .com or .net addresses to the domestic .ir domain, requiring users to manually install root certificate authority (CA) as trusted on their devices. This raises users’ level of protection against third-party hacks. But manual installation of a root certificate carries a different, broader security risk. According to an Iranian IT professional interviewed by Resanegar, Tehran Bureau’s economic unit, it gives the certificate authority the power to issue certificates trusted by the device for virtually any website, potentially allowing whoever controls the authority to impersonate websites across the internet.
Unlike publicly trusted certificate authorities, a domestic authority may operate without the same transparency and independent oversight. If the authority is malicious or compromised, an attacker could exploit that trust to carry out a man-in-the-middle (MITM) attack, intercepting and potentially reading users’ encrypted traffic. The IT professional says,
“By installing the root certificate they provide, you’re giving that CA, which is essentially the government, the power to impersonate the entire internet on that device, without any transparency or oversight.”
Despite the poor quality of internet services in Iran, much of it by design thanks to the authorities’ appetite for restricting or cutting access at any time, and some of it due to dated infrastructure and isolation from the international community, the country has developed a growing market for online banking and neobank services.
Neobanks are digital-first institutions that typically operate with lower overhead costs than traditional banks, with lower barriers to entry allowing them to offer lower fees, streamlined services, and a more convenient banking experience.
Iran’s neobanks, however, are not necessarily the standalone, digital-first entities that emerged in other markets. Many are backed by traditional banks and function as online extensions of existing institutions.
There are currently 30 neobanks operating in Iran. Some, such as Hamrah Shahr Plus (a subsidiary of Bank Shahr), function primarily as online banking apps but are now classified as neobanks by Iranian technology news websites; others were established as neobanks from the outset. Forbix (a subsidiary of EN Bank), for example, touts itself as Iran’s first neobank for businesses, while Innoobank describes itself as the country’s first neobank focused on technology and innovation. Bama, meanwhile, was launched with a focus on empowering underserved neighborhoods.
Rather than reflecting any sort of transformative development, much of Iran’s digital banking ecosystem has been built on top of and depends on the country’s existing banking infrastructure rather than replacing it. That dependence means that newer digital banking services remain exposed to the vulnerabilities of the traditional banking system, which has come under repeated cyberattacks and struggled to maintain and modernize its technology.
A banking system under cyber assault
Since around the time Masoud Pezeshkian assumed the presidency, on July 28, 2024, Iranian banks and the technology providers that support them have faced a series of major cyberattacks, disrupting banking services and, in some cases, compromising or destroying data.
The vulnerability of the Islamic Republic’s banking system became apparent just a few weeks after Pezeshkian took office, when the ransomware group IRLeaks attacked Tosan, a major Iranian banking-technology provider whose core banking software was used by at least eight banks, including Eghtesad Novin, Shahr, and Saman. The attack demonstrated how a vulnerability in a technology provider could potentially affect multiple financial institutions at once. IRLeaks later claimed responsibility for attacks on SnappFood and as many as 23 insurance companies.
In March 2025, the Codebreakers hacking group claimed to have stolen data belonging to 42 million Bank Sepah customers, for which it demanded a $42 million ransom. (While that may seem a surprisingly large clientele in a country with a population of about 93 million, it is not uncommon for Iranians to have accounts at multiple banks, for reasons ranging from employers’ exclusive payroll relationships to individual account incentives.) When Bank Sepah officials rejected the claim, the hackers responded by releasing the personal bank account information of a bank official. In April 2025, Mohammad-Amin Aghamiri, secretary of the Supreme Council of Cyberspace, downplayed the incident as “not a hack, just the theft of data.”
The attacks continued to escalate. On June 17, during the 12-day war, the hacker group Predatory Sparrow announced that it had attacked Bank Sepah, blaming it for financing Iran’s armed forces, and claimed to have erased much of the bank’s data. Pasargad Bank was also affected by the attack, resulting in the suspension of all its banking services. It took Bank Sepah nearly four months to recover, with many customers reporting difficulty accessing transaction histories, obtaining one-time passwords (OTPs) for online transactions, and making loan repayments.
State and state-aligned media reported that Pasargad was able to restore normal operations within ten days. But the Iranian IT professional, who spoke with Resanegar on condition of anonymity, says the bank has still not fully recovered from the attack.
“Its website still has a lot of problems. Some of its internal systems don’t work, and the service is still very unstable. For example, someone might try to log in three times, with all their credentials valid, and still get blocked. Then they try to make a card-to-card transfer or a Sheba [Iran bank account identifier] transfer, and the service isn’t available, or the bank suddenly blocks them for 24 hours and tells them they can’t use the service at all. Eventually, things start working again, but the system is not stable enough for you to feel confident that the bank will always provide services when you need them.”
During the war with the US and Israel that started this past February 28, Bank Sepah again came under attack, as did Bank Melli, Iran’s oldest national bank. According to Economy Minister Ali Madanizadeh, there were sometimes 10,000 cyberattacks a day targeting the two banks. While Bank Melli’s disruptions were limited to its neobank Baam and several of its physical branches, Bank Sepah faced a far more serious situation. Its services were severely disrupted between March 9 and 31 and its data center was bombed on March 10.
On June 13, cyber attacks on the Melli, Tejarat, Saderat and Tose’e Saderat banks disrupted their card services, online banking, mobile banking, and ATMs. Informatics Services Corporation (ISC), the software provider for all four banks, said it had swiftly repaired the affected software system, but that repeated cyberattacks were making it difficult to ensure its stability.
These attacks have exposed not only weaknesses in individual banks’ security systems but the technological constraints of the banking system as a whole. ISC has also pointed to banks’ reliance on IBM mainframes, saying that sanctions have prevented Iranian banks from receiving direct technical support from IBM for years, leaving them without direct assistance from the manufacturer when they needed it most.
And the consequences of Iran’s technological isolation are not confined to traditional banks and their legacy systems. This September, the impact extended to the country’s newer digital banking services, including neobanks, as SSL certificate errors began appearing on customers’ screens.
The emerging SSL crisis
The issue of SSL/TLS certificates had first come to Iranians’ attention the previous month, when the CBI publicly addressed customers’ online access issues and the revocation of its technical and security certificates. Once it became clear that the SSL certificate revocations were no longer limited to CBI-affiliated websites, Iranian banks were forced to change certificate providers or move their domains. According to Mehrak Mahmoudi, editor in chief of Peyvast, a monthly IT management and communication technology publication, “banks spent considerable sums obtaining certificates from various providers, but each time, their certificates were revoked,” sometimes within a few hours.
The repeated changes created another problem: users could no longer be certain which domain belonged to their bank, making it easier for phishing attempts to appear credible. A message telling a customer that their bank had moved to a new website could no longer be dismissed as obviously suspicious.
A similar situation unfolded in Russia, beginning in March 2022 and continuing with a new wave of certificate revocations in June 2026 that affected websites beyond the banking sector. Several American and other Western certificate authorities revoked certificates issued to sanctioned Russian banks and stopped issuing or renewing certificates for some Russian domains. Russia responded by establishing its own domestic root certificate authority.
Like Russia, Iranian banks decided to abandon temporary measures and seek a permanent solution by switching from international SSL certificates to certificates issued by Iran’s root certificate authority.
Under this system, a bank generates a certificate signing request (CSR) within its secure infrastructure and submits it to a domestic intermediate certificate authority operating under Iran’s root certificate authority to have the required certificate issued.
Technically, a domestic certificate serves the same basic purposes as an SSL certificate issued by a foreign certificate authority: it enables the bank’s service to establish an encrypted connection with the user, with a certificate chain in place to verify the certificate’s authenticity.
The problem is that Iranian root certificates are not included in, or automatically trusted by, common browsers and operating systems. The same was true in Russia, where domestic certificates were trusted by Russian browsers such as Yandex and Atom. As the industry professional interviewed for this article observes:
“When this happened in Russia in 2022 and the CAs revoked the certificates of all its banks, Russia did exactly what they are doing here. But Chrome and Firefox wouldn’t accept it. Only domestic browsers like Yandex would accept it.”
The fix is simpler for banking apps, as a bank can embed the certificate chain required to trust a domestic certificate in its own app. The app then recognizes certificates issued under the domestic chain, so users do not have to obtain the root certificate themselves or install it on their phones to use the app.
The industry professional interviewed by Resanegar, who uses HiBank, the neobank owned by Karafarin Bank, says he has not experienced any issues with the app and suspects the bank may have directly embedded the certificate chain.
The process is more complicated for users accessing their banks through a personal computer. Mahmoudi says they have to install the Iranian SSL certificate in their browsers themselves:
“[This] makes the process somewhat difficult. When they try to install it, a series of messages appear in Persian. Users read them and then think, why am I being asked to agree to such things, and they might opt not to agree to the terms and conditions.”
The industry professional says some users may not know how to install the certificate or even be able to do so, and may simply stop using the service rather than go through the process.
“You can’t really tell people, ‘You have to come here, download this file, open it here, install it, and then everything will work.’ A lot of people simply won’t do that. It’s partly a matter of digital literacy: they may not know what it is or have the technical knowledge to install it.”
Security risks of a domestic root certificate
Digital literacy aside, users also need to know what they are installing, where to obtain it, and how to verify that the certificate is authentic. This makes clear the importance of public communication, something Mahmoudi says has been lacking.
“There has also been insufficient communication with the public. The Central Bank has remained silent, the banking network has remained silent, and all of them have stayed silent, waiting for something to happen before taking a position.”
That lack of clarity creates another security risk. An attacker could send users a file or software package presented as a “new bank certificate” or a “Central Bank security certificate,” exploiting confusion around changing banking domains and certificates to persuade them to install malicious software or make unsafe changes to their devices.
The use of manually installed root certificates for state surveillance is not unprecedented. In 2019, the Kazakh government asked citizens to install a security root certificate that would allow authorities to intercept HTTPS traffic to websites such as Google and Facebook. Google, Mozilla, and Apple responded by blocking the root certificate in their browsers.
The industry professional argues that the domestic root certificate will give the government the ability to impersonate websites or manipulate data, which he considers very “attractive” to the regime.
“Especially given the existing examples, if someone does a little reading and research, they probably won’t install it, because it completely compromises your security. People who have anonymous accounts on X and elsewhere would effectively no longer be anonymous. You could see their IP address and where they’re located, and once you know their IP and location, you can potentially track them in real time.”
He concludes that he will definitely not be among those installing the Islamic Republic’s root certificate.