People looking for health insurance documents online are being warned to watch out for fake websites that could steal their personal information. The National Social Security Fund (CNSS) has warned that fraudsters are impersonating the institution to collect sensitive data, particularly through websites offering fake certificates linked to mandatory health insurance, known as AMO.
In a warning posted on its official Facebook account, the fund said the websites were seeking people’s full names, dates of birth, national identity card numbers and CNSS registration numbers.
The CNSS urged citizens not to share personal information on unfamiliar websites and to check that online services are official before submitting their details.
It said its digital services were available only through two official websites: www.cnss.ma and www.macnss.ma.
The warning comes as health insurance coverage expands to more people across the country. The CNSS manages social security and health coverage for more than 22 million beneficiaries, including private-sector employees, self-employed workers and low-income households covered by the state-supported AMO Tadamon scheme.
The wider rollout of health insurance has brought more people into the system, including workers who may have less experience using online public services. This can create opportunities for fraudsters to exploit people who are unfamiliar with official websites.
How the scams work
Fraudsters may use website addresses that resemble official CNSS portals or circulate links through Facebook, WhatsApp and Telegram. Some promise quick access to health insurance certificates, help with registration or cash payments.
These websites may collect identity details that can be used for identity theft or to gain access to online accounts. In some cases, fraudsters may also seek bank account information, known in Morocco as a Relevé d’Identité Bancaire (RIB), to redirect medical reimbursements.
Fake AMO certificates may also be sold in exchange for illegal processing fees. Such documents are not valid when presented to hospitals or other healthcare providers.
The personal information at risk includes national identity card numbers, CNSS registration numbers, full names and dates of birth. Bank account details are also sensitive and should not be shared with unverified services.
What the law says
Morocco’s personal data protection framework is governed by Law No. 09-08, which regulates the collection and use of personal information. The National Commission for the Control of Personal Data Protection (CNDP) oversees the framework.
Articles 53 to 64 of the law provide for criminal and financial penalties for certain violations involving personal data.
Law No. 07-03 also addresses cybercrime, including illegal access to computer systems and digital fraud.
The CNSS has issued previous public warnings about fraudulent links and text messages claiming that people qualify for reimbursements or social assistance.
The fund has also introduced additional account security measures, including multi-factor verification and automatic text-message alerts when important details, such as bank account information, are changed on the MaCNSS portal. The CNSS and the CNDP have also stepped up public warnings about unofficial applications and websites requesting identity numbers.
Official social security services are increasingly being integrated into the country’s wider digital public services system, with the aim of making access more secure and reducing reliance on unofficial intermediaries.
How to protect yourself
The CNSS advises citizens to use only its official websites, www.cnss.ma and www.macnss.ma, and to avoid submitting personal details to unknown platforms.
People seeking assistance can contact the fund through its support numbers: 3939 (Allo CNSS) or 0520 19 40 40.
Citizens should be particularly cautious of messages promising immediate payments, reimbursement eligibility or health insurance documents in exchange for personal information or fees.
