ScamX CMS

Category: Reporting

  • Reporting a Scam in South Africa: The Ombud, a Case Number and a Free ID Flag

    South Africa gives you a free ombud that can order a bank to put things right, a free identity-protection registration that most people have never heard of, and a police process that still means standing at a counter. Here is the order that works.

    The bank, immediately

    Call the fraud line and report it. Everything that follows turns on what the bank did before and after that call, so note the time and get a reference.

    The police case number

    Open a criminal case at a police station — in person, because that is how you get the case number, and the case number is what your bank and the ombud will ask for. The MySAPS app is useful alongside it, and Crime Stop on 08 600 10111 takes anonymous tip-offs.

    The National Financial Ombud

    Since March 2024 there is one ombud for banks, credit providers and insurers, replacing the separate offices people still search for. It is free, on 0860 800 900, and it investigates whether your bank acted fairly — its published test is whether the bank’s conduct contributed to the loss and whether it met its obligations before and after you reported.

    Three practical points. Complain to the bank first; if you have not, the bank gets 21 working days to respond once the ombud takes it. Its decision does not bind you — you keep the right to go to court. And it cannot compel parties outside its jurisdiction, which explicitly includes crypto platforms and gambling operators, so money that went that way is beyond its reach.

    There is no South African rule requiring reimbursement for a transfer you were tricked into authorising. What you can press is the bank’s own conduct: its authentication records, its alerts, its monitoring, and what it did to recover the funds once you told it.

    If your identity was used

    The Southern African Fraud Prevention Service offers Protective Registration, and it is free. It flags your ID number on the database its member credit providers check, so a new application in your name gets extra scrutiny. If someone has opened accounts using your details, this is the most useful thing you can do in an afternoon, alongside the free credit report you are entitled to once a year.

    The same organisation runs Yima at yima.org.za — note the .org.za, the .co.za version is not it — where you can report a scam and check a suspicious link. Be clear what it is: a record-and-warn service whose stated purpose is preventing the next person from being caught. It does not investigate or recover money.

    Investments, and checking before you pay

    The Financial Sector Conduct Authority is on 0800 20 37 22, and its site lets you check whether a person or firm is authorised and read its published warnings. Do that before you invest, not after. It refers individual complaints to the ombud and acts itself on wider misconduct.

    One body that is not a reporting route, despite its name coming up constantly: the banking industry’s risk information centre. It is an industry body with no consumer reporting mechanism.

    What to have ready

    The SAPS case number, the bank’s complaint reference, your account and the recipient’s details, the dates, times and amounts, your device and OTP records, and all correspondence with the bank. If someone is complaining on your behalf, the ombud needs a signed written mandate.

    The most impersonated name in the country

    SARS, by a distance — its own site catalogues hundreds of named scams, refreshed constantly. It never asks for passwords, one-time codes, banking PINs or eFiling credentials by email, SMS or phone, and it has a dedicated route for a compromised eFiling profile. If a message about a refund or a summons arrives, go to the SARS site yourself rather than through the link.

    And the page itself

    Whoever hosts the scam site and whoever sold its domain can take it down, usually the same day, if you send them the exact address and a screenshot. That is the fastest result available to anyone, and it needs no case number.

  • Reporting a Scam in Nigeria: Ask Your Bank for a PND and a Hold Message

    In Nigeria the fastest lever is one most victims never pull, because nobody tells them it exists. Your bank’s fraud desk can place a no-debit restriction on the account that received your money and send an electronic hold message to the receiving bank. Ask for both, by name, on the day.

    The bank fraud desk, and the exact words to use

    Under a longstanding central bank circular, every bank must run a fraud desk that blocks or places no-debit restrictions on accounts when a fraud complaint arrives, and must honour hold instructions sent between banks through the industry switch. You cannot contact that switch yourself. Your bank is the trigger.

    So say it plainly: ask for a PND on the recipient account, and ask them to send the hold message to the receiving bank. If the person you are speaking to hesitates, ask for the fraud desk directly and mention the circular.

    Two more things to extract from that call: a complaint tracking number, which the bank must give you within 24 hours, and the date. Those are what everything later depends on.

    The police and the EFCC

    The Nigeria Police cybercrime centre takes reports at nccc.npf.gov.ng and [email protected]. The EFCC takes petitions at efcc.gov.ng/SubmitPetition and lets you follow them at efcc.gov.ng/TrackPetition.

    One correction that wastes a lot of people’s time: the “Complaints” page on the EFCC site is for reporting EFCC staff misconduct, not scams. Petitions are the right channel. Its zonal office emails are the state-level layer if your case has a location.

    If the bank stalls: the central bank

    The rule is explicit. Complain at the branch where the issue arose and give the bank two weeks. Escalate to the Director of Consumer Protection at the central bank — [email protected], or a letter lodged at any branch — if the bank fails to acknowledge within three days, fails to issue a tracking number, or misses the published resolution timelines.

    Those timelines are worth quoting at your bank. Wrong account debits: one working day. Internet banking fraud, ATM fraud and scam mails: three working days, two more on review. Fraudulent withdrawals: fourteen, then seven. You have 30 days from the bank’s decision to demand a second review, and 90 days to escalate to the central bank.

    On refunds, be careful what you expect. The consumer protection regulations require refunds of unauthorised debits and excess charges with interest — that is bank-side error. There is currently no Nigerian rule requiring a bank to reimburse someone who was tricked into making a transfer themselves; the guidelines on that are still a draft.

    The other desks

    Ponzi and investment schemes go to the Securities and Exchange Commission, which also lets you check whether an operator is registered before you pay. SIM and telecom problems go to the Communications Commission on 622, free from any network; you can stop spam texts by sending STOP to 2442. A data breach goes to the data protection commission, and marketplace or goods disputes to the consumer commission. Be realistic about those last ones: they record, they do not recover.

    What to have ready

    Your BVN and NIN, your own account and bank, and above all the recipient’s account number, account name and bank — that is what a no-debit restriction is placed on. Add the transaction reference or session ID, the exact date, time and amount, your bank’s tracking number, and screenshots of the alerts.

    Two local warnings

    The EFCC has publicly warned about gangs in fake EFCC uniforms stopping young people outside eateries and motorists on the road. The rule that settles it: the EFCC does not collect money or valuables at the roadside.

    And check which SIMs are registered against your NIN. A line taken out in your name and used by someone else is both a fraud risk and a way to find yourself implicated in somebody else’s case.

    The website

    The hosting provider and the domain registrar can take a scam page offline within hours of a clear abuse report. No Nigerian agency can do it that fast, and the two efforts do not conflict.

  • Reporting a Scam in Saudi Arabia: Absher, Kollona Amn and 330330

    Saudi Arabia routes scam reporting through channels you probably already have on your phone: Absher for the fraud report, Kollona Amn for the police report, and your bank for the money. The trick is knowing which does what, and which of the numbers circulating online are simply wrong.

    The bank, within minutes

    Call your bank’s 24-hour line and report it. For card fraud this is not just advice, it is the trigger for liability: under the central bank’s credit card rules, the issuer carries responsibility for card operations only from the moment it receives your report. Every minute before that is yours.

    Those rules also give you a clock to hold the bank to. The card must be suspended immediately, and the processing of an unauthorised-use claim must not exceed seven business days, including reversing the amount. That is specific to credit cards — no equivalent published deadline exists for mada, debit or account transfers, and there is no Saudi rule requiring a refund when someone was talked into authorising a payment or sharing an OTP.

    Absher and Kollona Amn

    Absher carries a Financial Fraud Reports service under Public Security, introduced in 2024. Kollona Amn, the Public Security app, is where a criminal report goes, including impersonation of your identity — there is no separate identity theft service. Kollona Amn is an app only; it has no website.

    For emergencies, the number depends on where you are: 911 in Riyadh, Makkah and the Eastern Province, 999 elsewhere.

    If the bank does not fix it: SAMA

    Complaints go to the bank first. Its first-level response is due in five business days, a second-level escalation in three, and only then does the central bank take the complaint through its complaint management system — which replaced the old SAMA Cares service in July 2025, so any guide pointing you at that name is out of date. The consumer line is 8001256666.

    Scam texts and calls

    Forward the message itself to 330330, free, run by the communications regulator; its call centre is 19966. Forward it rather than retyping it, and do not delete the original — the message is the report.

    Be clear on the limit: the regulator states that fraud crimes are outside its jurisdiction. It blocks senders and filters networks. It does not recover money. One useful tell it publishes: legitimate marketing messages carry the -AD sender tag; fraudulent ones arrive from unknown numbers with no tag.

    Businesses and investments

    Complaints about a licensed business go to the Ministry of Commerce on 1900 or through its Balagh Tejari app, which the ministry says are its only authorised channels. Investment offers belong with the Capital Market Authority, which takes complaints and violation reports through its investor protection pages — and requires a copy of your ID, or the complaint is not considered.

    Two corrections worth carrying

    First, the Ministry of Commerce has twice warned about fake websites claiming to file commercial reports for you. It never asks for card numbers, passwords or verification codes, and never requires you to install an outside app. The top search result for how to report a scam can be the scam.

    Second, if you have seen 1909 described as an anti-fraud hotline, it is not; that number belongs to an unrelated authority. Ministry of Interior services are impersonated more than any other brand here, which is why the official app stores and absher.sa itself are the only addresses worth trusting.

    What to have ready

    Your national ID or Iqama, the mobile number registered with your bank and with Absher, a working Nafath login, the account the money came from, the transaction references, and the bank’s complaint reference with its date.

  • Reporting a Scam in the UAE: eCrime, Aman and Sanadak

    Reporting a scam in the UAE means knowing which emirate you are in, because the police channels are emirate-specific even though the law is federal. There is also one federal route that works anywhere, and a separate body for complaints about your bank.

    Your bank first

    Call the number on your card and ask for the transaction to be stopped and the card blocked. Nothing in the rest of this page moves money; only the bank can, and only while the transfer is still reachable.

    The police report

    The federal route is the Ministry of Interior’s app, which carries the eCrimes service and works in every emirate. In Dubai, ecrime.ae takes you into Dubai Police’s cybercrime service. In Abu Dhabi, the service is Aman, on 8002626, by SMS to 2828, or at aman.adpolice.gov.ae. The Public Prosecution also runs an app, My Safe Society, for reporting cybercrime directly. For anything urgent, 999.

    These open a real case under the federal cybercrime law, which has been in force since January 2022. They investigate and prosecute. None of them is a refund button.

    If the complaint is about your bank: Sanadak

    Sanadak is the independent unit set up by the Central Bank to handle complaints against banks, finance companies and insurers, and it is free. There is one gate: you must complain to the institution first and then wait fifteen calendar days before Sanadak will take the case. It also will not touch a matter that is in court, already settled, duplicated, or outside the Central Bank’s remit.

    Note what that route is for. It decides whether your bank treated you properly. It is not a claim against the scammer, and there is no published UAE rule requiring a bank to reimburse someone who was tricked into authorising a payment. Ask your bank what applies to your case and get the answer in writing.

    What to have ready

    Your Emirates ID, the transaction references and IBAN, screenshots, the sending numbers and web addresses, and — for Sanadak — the bank’s own complaint reference and the date you raised it, because that is what starts the fifteen-day clock.

    The local trap worth knowing

    Dubai Police have warned about something specific to this moment: people searching online for where to file a consumer complaint land on cloned “consumer protection” sites that harvest their banking details. A gang impersonating consumer protection staff has been arrested for exactly this. In other words, the search for how to report a scam is itself being targeted.

    Use addresses on u.ae or the official app stores, and treat any page that asks for your card number or an SMS code as the fraud rather than the remedy. The same goes for video calls from people in police uniform — an established local technique — and for anyone asking you to approve a UAE PASS request you did not initiate.

    The website itself

    If the scam ran through a site, its hosting provider and domain registrar can take it down, usually within hours of a clear report that names the exact address. That is faster than any police process, here as everywhere.

  • Reporting a Scam in Vietnam: The Old Portal Is Gone, and 156 Does More Than You Think

    Start with a correction, because almost every Vietnamese guide still gets this wrong. The national scam reporting address that has been printed everywhere since 2023, on the old cyberspace portal, no longer exists — the domain resolves to nothing at all. Reports sent there go nowhere. The national cyber security centre’s current reporting portal is at canhbao.ncsc.gov.vn.

    The bank first, because nothing else holds the money

    Call your bank’s hotline the moment you realise, and go to the police the same day. Vietnam has no consumer reimbursement rule for scam transfers — none of the 2024 and 2025 reforms create a right to a refund — so everything depends on reaching the money before it is withdrawn or moved on. That window is hours.

    What those reforms did do is make transfers traceable. Since 1 July 2024, any transfer above ten million dong needs a face check against your chip ID or VNeID data, and once your transfers pass twenty million in a day, every further transfer that day needs one however small. That is identification, not insurance: it helps investigators name the account holder afterwards. Statements that victims “can get their money back” because of it are describing traceability, not a refund.

    The police report is the only route that can investigate

    File a written report — đơn trình báo or đơn tố giác tội phạm — at your ward or commune police station, in person. There is no online consumer intake for this. Bring your chip ID card, the sending and receiving account numbers and names, the amounts and exact times, the bank names, and screenshots of the whole conversation, which in most cases means Zalo or Messenger.

    156, for the calls and the texts

    The national spam and scam line is 156, free to call, and it also takes structured SMS reports. The syntax matters: for a spam SMS send S (number) (description), for a nuisance call V (number) (description), and for a scam call LD (number) (description). Telecoms operators act on these — a reported number gets forced re-verification, then one-way suspension, then two-way, then termination. It can kill a number. It cannot recover a dong.

    The check almost nobody uses

    You can text a domain name to 156 and be told whether it is a genuine registered site. It is free, it takes seconds, and it is a distinctly Vietnamese tool that barely anyone uses. Do it before entering anything on a site that arrived in a message.

    One thing that is not a scam checker, despite its name: the trusted-network directory is an opt-in certification list that organisations apply to join. A site being absent from it means nothing at all.

    The reporting portal is a warning system, not a case system

    Be clear about what the national portal does. It aggregates warnings. It does not open a case for you, does not give you a case number, and does not recover money. Report there so that others are warned, and go to the police for your own case.

    The scam that comes second, wearing a badge

    The cyber security centre has itself published a warning about a site impersonating it and advertising “help getting your scammed money back, 99.9% success”. This is the most reliable pattern there is: the recovery service that finds you after you have been scammed is the second scam, and it will wear the branding of the police or of the agency you just reported to.

    The other pattern to know: a caller claiming to be the police or a traffic inspector persuades you to install an app or open a link, takes control of the phone, and empties the account from your own device. No Vietnamese agency asks you to install anything to resolve a case.

    And the site

    If the scam ran through a website, the company hosting it and the registrar that sold the domain can take it down, usually within hours of a clear report with the exact address and a screenshot. That is quicker than any official channel, in Vietnam as everywhere else.

  • Reporting a Scam in the Philippines: The Five-Day Hold and Who Starts It

    The Philippines now has a real mechanism for holding scammed money in place, and it comes with the tightest deadline in the region. Miss it and the hold expires. The rule that surprises people: the clock starts with your bank or e-wallet, not with the police.

    Your bank or e-wallet, immediately

    Under the central bank’s 2025 rules, the only consumer action that triggers a hold on scammed funds is a complaint to your own institution’s 24-hour fraud reporting channel. Report inside the app or on the published hotline, and get a ticket number in writing. A police report alone does not start the process.

    The institution can hold the funds for up to five calendar days at first. Within those same five days you have to give it a sworn complaint, an affidavit or a police report — otherwise the hold cannot be extended and the money is released. After that the hold can be extended by 25 more days, to a hard cap of 30, beyond which only a court can go further.

    This is why the police report matters even though the police will not refund you: it is the document that keeps the hold alive, and it is accepted faster than a notarised affidavit.

    Where to report the crime

    The Cybercrime Investigation and Coordinating Center runs the anti-scam hotline 1326 and takes reports at [email protected]. The police anti-cybercrime group is at acg.pnp.gov.ph and [email protected]. The NBI cybercrime division takes reports at [email protected] and on (02) 8523-8231.

    Two corrections worth having. The NBI has moved to the Filinvest Cyberzone in Pasay City; the old Taft Avenue address is now the clearance centre only, and some official handouts still print it. And if you search for the anti-cybercrime group, use the address above — the similar-looking pnpacg.ph serves a certificate for a different name and will throw a browser security error.

    The central bank, and what it can order

    The central bank’s consumer assistance route is a second-level one: it is a claim against your bank, not against the scammer, and it only opens after your bank has had the complaint. Use the BOB chatbot on the central bank’s site or its official Facebook page, and keep the reference number it issues. It can order restitution from your bank where the bank is at fault, for civil claims up to ten million pesos.

    Investment offers belong with the Securities and Exchange Commission, through its ticketing portal at imessage.sec.gov.ph. The older address printed on several government handouts now redirects to an unrelated education site.

    What the new law does and does not give you

    The Anti-Financial Account Scamming Act took effect in August 2024. It criminalises money muling and social engineering, and it lets investigators reach behind bank secrecy. What it does not do is give you a right to be reimbursed. If the money is caught within the holding window and the recipient cannot justify it, it goes back to you — that is the realistic path. If it has already been cashed out, there is no statutory refund.

    One clause deserves a warning of its own. Because lending or letting someone use your financial account is now an offence, the classic follow-up con — “we will process your refund, just let us route it through your account” — can make the victim criminally liable. So can filing a knowingly false report. Say what happened, and nothing more.

    What to have ready

    The transaction reference number, the source account name and number, the exact amount, the mode, the date and time, the receiving institution and beneficiary if you know it, a government ID, screenshots, your earlier support chats, and a plain written account of why you are disputing the transaction.

    Two local specifics

    The most impersonated organisation is your own bank — the law itself defines social engineering as someone misrepresenting themselves as acting for a financial institution. The central bank’s own line is worth repeating: it will never ask for your PIN, password, account or card number, passbook or ID.

    And check the address of the government super-app carefully. The official domain is e.gov.ph. A hyphenated lookalike hosted abroad is not it.

    The page itself

    None of these agencies takes a scam website down quickly. Its hosting provider and its domain registrar can, usually within hours of a clear abuse report naming the exact address.

  • Reporting a Scam in Malaysia: 997, the 24-Hour Clock and Semak Mule

    Malaysia has one number worth memorising and a 24-hour clock attached to it, plus a check-before-you-pay service that is genuinely one of the best in the region. It also has a widely-recommended website that is not the official one, so start with that.

    997, within 24 hours — and the gap in the hours

    The National Scam Response Centre is 997, and if money has moved, it is the only route with a chance of stopping it. Bank Negara states the condition plainly: the call must be made within 24 hours of the incident, and within operating hours, which are 8am to 8pm daily including weekends and public holidays.

    Read those two sentences together and you find the gap. A scam at nine on a Friday night cannot reach 997 until Saturday morning. In that window, call your own bank’s 24-hour fraud line immediately — every Malaysian bank has one — and call 997 when it opens.

    A warning about searching: nsrc.my is not the National Scam Response Centre. It is a privately run site that says so itself. The centre has no standalone website; it is reached by phone, and the official description of it sits on Bank Negara’s and the national financial crime centre’s own pages.

    Semak Mule, before you pay anyone

    semakmule.rmp.gov.my, run by the police commercial crime department, lets you check a bank account number, a phone number or a company against accounts already reported for fraud. Use it before paying any stranger — a marketplace seller, a deposit, an “agent”.

    Two caveats. A clean result does not mean safe; it means not yet reported. And the site currently serves a mismatched certificate chain, so your browser may warn you even though the certificate itself is genuinely the police’s. Do not let that train you into clicking through warnings elsewhere.

    The police report

    The commercial crime investigation department takes reports through ccid.rmp.gov.my and on 03-2610 1222. The report gives you a case number, which your bank will ask for. Run the receiving account through Semak Mule first and screenshot the result to attach.

    Calls, texts and content: MCMC

    Scam calls, SMS and online content go to aduan.mcmc.gov.my or 1800-188-030. If you have seen a complaint link on the regulator’s main site, it no longer works; the portal above is the live one. MCMC can block a number and order content taken down. It cannot recover money.

    If the bank is the problem

    Complain to your bank first and give it 14 calendar days. Only then does Bank Negara’s contact centre, BNMLINK on 1300-88-5465, take the matter — and what it regulates is your bank’s conduct, not the scammer. For a binding decision against a financial provider, the Financial Markets Ombudsman Service is free; it took over from the two older schemes at the start of 2025, and some official pages still link the old one.

    On refunds, be realistic: Malaysia has no verified statutory right to reimbursement for a scam payment you authorised. Kill switches and cooling-off periods exist as features individual banks offer, not as a guarantee you can claim.

    Two things to check before you believe a name

    The Securities Commission’s investor alert list and Bank Negara’s financial consumer alert list both now flag “potential clone entities” — operations that copy the name, logo and licence number of a genuine firm. Recognising the brand proves nothing. Check the entity itself on the list.

    The Macau Scam, and the trap after it

    The recurring pattern: a caller claims to be from the police, Bank Negara, the tax office, a court or a courier, tells you your name is tied to money laundering, and instructs you to move your money to a “safe account”. No Malaysian agency ever asks you to transfer money to clear your name.

    The second trap catches people who received scam money and passed it on. Their own account gets frozen and their name flagged as a mule. Bank Negara does not intervene in those decisions and keeps no blacklist — the appeal is to the bank, at its discretion. If money you did not expect lands in your account, do not move it; tell the bank in writing.

    The website itself

    If the scam has a site, the hosting company and the domain registrar can take it offline faster than any of the routes above, often within hours of a clear report.

  • Reporting a Scam in Singapore: The Kill Switch, 1799 and What the SRF Actually Covers

    Singapore gives you one number to call and one button that actually stops money moving, and they are not the same thing. Knowing which is which, in the first few minutes, is most of what determines how this ends.

    The Kill Switch, then 1799

    Every major bank in Singapore now has a kill switch inside its own app: one action that freezes all your current and savings accounts, including joint ones, and blocks PayNow, FAST, GIRO, telegraphic transfers, bill payments, standing instructions, card transactions and ATM withdrawals. If you think your credentials are compromised, use that first. It is the only instant action available to you.

    Then call the ScamShield helpline on 1799, free and around the clock. It gives advice and can transfer you straight through to the anti-scam teams at seven banks. Be clear about what it cannot do: it cannot file a police report for you, and it cannot give you updates about a frozen account.

    The police report is separate

    File it yourself at police.gov.sg under E-Services, or call 1800-255-0000. Use 999 if it is an emergency. Note that I-Witness, which looks like a reporting channel, is for passing on information and is explicitly not a police report — you will not be updated on the outcome.

    The police are unusually honest about the odds on their own website: once the money has left Singapore, the chance of recovering it is very low. Money that is seized is returned at the end of investigations, not when you report.

    The Shared Responsibility Framework is narrower than you think

    Since 16 December 2024, banks and telcos can be made to bear a scam loss under the Shared Responsibility Framework. It is a real protection, and it is far narrower than most people believe.

    It covers one shape of scam only: someone impersonates a business or government body, contacts you on a messaging platform, gets you to enter your banking credentials on a fake site or app, and then uses those credentials to make transactions you did not intend. All four of those have to be true.

    That means it does not cover investment scams, romance scams, job scams, e-commerce scams, or any case where you made the transfer yourself. It also excludes credit, charge and debit cards issued in Singapore. If your loss is one of those, the framework is not your route.

    Where it does apply, there is a waterfall: the bank pays if it failed one of its duties; if not, the telco pays if it failed one of its; if neither did, the loss stays with you. Two deadlines matter. Report to your bank as soon as you can and in any case within 30 calendar days of its alert, then supply your documents — police report, the message trail — within three days. The bank has 21 business days for a straightforward case, 45 for a complex one.

    If you disagree with the outcome, FIDReC handles disputes with the bank, free for consumers, and complaints about a telco go to IMDA.

    Restriction Orders, and what they are for

    Under the Protection from Scams Act, in force since 1 July 2025, police can order a bank to stop someone transferring money while they are being scammed. It is designed to protect a person mid-scam, usually one who does not believe their family, and it does not refund anyone. It is also rare: as of February 2026, twelve had ever been issued.

    If your own account gets frozen

    This happens to people who received scam money and passed it on, sometimes without knowing. The helpline cannot help you here. The route is a court application under the Criminal Procedure Code to release funds for basic living costs — rent or mortgage, food, medicine, utilities, taxes and insurance. Get advice early rather than waiting it out.

    What to have ready

    The date and time, how they contacted you, the full web address from your browser history, the phone number as one unbroken string, whether it was a normal call or WhatsApp, Telegram or Viber, screenshots, receipts, your bank’s transaction records, and the reference number of any report you have already made.

    Two local notes

    Government official impersonation is the largest loss category in Singapore, and ScamShield warns that scammers come back a second time posing as authorities offering to help. No agency will ever call you to recover your money for a fee.

    And if you are looking for scamalert.sg, it now redirects to ScamShield — the two services merged.

  • Reporting a Scam in Nepal: Go to the Police Before You Call the Wallet

    The most useful thing to know about reporting a scam in Nepal is the order, not the addresses. If money has just left your account, go to the police before you call the wallet’s helpline — because it is a written request from an investigating agency that forces a payment provider to freeze the funds immediately. A call to a call centre does not.

    The Cyber Bureau does not take complaints online

    Nepal Police’s Cyber Bureau sits in Bhotahiti, Kathmandu, and is reachable on +977 9851286770 and 01-5319044; extension 108 handles online-fraud follow-up. Its page at cyberbureau.nepalpolice.gov.np gives you a complaint form to download.

    You have to bring it in. The form can be typed or handwritten, but it is submitted in person, and email is accepted only if you genuinely cannot attend. Searching for an online cyber complaint form in Nepal is a dead end, and a lot of people lose days to it. There are no provincial cyber cells either — if you are outside Kathmandu, file at your district or ward police office and ask them to route it.

    Page two is the page that matters

    The fraud form has a transaction table: sender and receiver bank or wallet, account numbers, amounts, dates. Fill it in completely on the first day, even the parts you have to dig out of your statement. That table is what the police turn into the freeze request, and an incomplete one is the most common reason nothing gets frozen.

    Bring a copy of your citizenship certificate, screenshots with the profile and URL visible, and the scammer’s profile address. The Bureau’s forms are in Nepali.

    The wallet or the bank

    Every payment provider licensed by the central bank must publish a 24-hour grievance officer and toll-free numbers on its own site, so get the number from the provider’s website rather than from a search result — fake helpline numbers for wallets are a scam of their own here. Khalti, for instance, publishes 1660-01-5-8888.

    On compensation, be realistic: the central bank’s payment systems directive ties compensation to the institution’s own negligence, with no fixed sum and no “report within N days and you owe nothing” rule. Establishing that the provider failed is the work, which is another argument for a written, dated complaint.

    If the provider stalls: NRB Gunaso

    The central bank runs an online grievance portal at gunaso.nrb.org.np, which is trackable and genuinely useful — after the provider has had its chance. It is an escalation route. Nepal Police also has a general online grievance form and the 1113 hotline, but that channel records and forwards; it is not a cyber investigation.

    What is being impersonated right now

    Two patterns the Bureau has made arrests over: calls claiming to be your own bank asking you to “update your KYC”, and callers posing as staff of a wallet provider. More recently the central bank warned about fake accounts and fake QR codes intercepting donations to the disaster relief fund. A QR code is not proof of anything — it is a link in a costume.

    One correction about the national CERT

    Nepal’s government CERT web presence is not reachable, and the similarly named private body is not a government agency. Do not route a consumer scam report there expecting official action; the police are the route.

    The website

    If the scam ran through a site, report it to the company hosting it and to the registrar of its domain. They can take it down in hours without any of the above, and that is often the only quick win available.

  • Reporting a Scam in Sri Lanka: The Central Bank Can Order a Refund

    Sri Lanka has a route that can order your money back and a route that can get a scam page taken down, and neither of them is a police portal — because there is no working online police complaint channel. The online forms that turn up in search results are broken. Plan for a visit to a station.

    Your bank, first and in writing

    Complain to the bank, finance company or payment provider immediately. This is not just good practice: the Central Bank will not look at your case until the provider has had it. The provider has twenty-one days to respond.

    The Central Bank can direct a refund

    The Financial Consumer Relations Department at the Central Bank takes complaints on 1935, at [email protected], and through cbsl.gov.lk/en/fcrd. Under the 2023 financial consumer protection regulations it can direct a provider to refund you, and that direction binds the provider. For money lost through a licensed institution, this is the strongest card you hold.

    Three limits, all worth writing down. You have one year from the provider’s response to escalate. The department will not touch a matter older than three years. And if either side goes to court, it stops.

    One thing the regulations do not give you: an India-style rule where reporting within a set number of days makes your liability zero. There is no such window in Sri Lanka. What you are owed depends on your provider’s terms and on whether the loss was their failure — which is exactly why the written complaint and its date matter.

    The police report means going in person

    Report at your nearest police station; 119 for an emergency. The advertised online complaint services on the police domain do not work — both of them return an error page — so a physical visit is unavoidable for a criminal complaint. Note also that the old police.gov.lk website no longer loads; the current site is police.lk, though the old email addresses still work.

    The CID’s computer crime division can be reached at [email protected] and on 011 2381058. Its remit is social-media and content abuse rather than investment fraud, so match your complaint to the right desk or it will be handed on.

    SLCERT, for the site itself

    The national CERT takes reports on 101, at [email protected], and at cert.gov.lk/report_incident. It has real takedown reach with platforms and providers, which the police station does not. It cannot recover money. Use it for the fake page, the cloned profile or the compromised account, in parallel with everything else.

    The trap that turns a victim into a defendant

    Two local patterns deserve naming. The first is money-mule recruitment: a stranger offers a few thousand rupees to open a bank account in your name, and two months later the police arrive, because your account was the one the fraud passed through. The second is worse — under the Banking Act, someone who was drawn into a pyramid scheme and then recruited their own friends can be prosecuted rather than treated as a victim. If that is your situation, get legal advice before you file anything.

    What to have ready

    Your NIC, the transaction references and dates, the receiving account details, screenshots of every message with the sender visible, and the written complaint you sent the provider with the date it was sent.

    And the page

    Whoever hosts the site and whoever sold its domain name can remove it, usually the same day, if you send them the exact address and a screenshot. That is a separate message from any of the above and often the only one that produces a visible result quickly.