How to report cybercrime to Nepal Police

Before you confront anyone, before you tell the person you are going to the police, and before you delete anything out of embarrassment, capture the evidence. Confrontation is what causes an account to be deleted, and a deleted account frequently takes the entire evidential record with it.

Take full-screen screenshots, not cropped ones. A cropped image of a message proves almost nothing, because it removes the sender identity, the timestamp and the address bar. A full-screen capture on a computer, showing the browser address bar with the complete URL, is worth an order of magnitude more than a photograph of a phone screen.

Copy the URLs themselves as text, straight from the address bar, and paste them into a document. Do not retype them. A single mistyped character in a profile URL turns a specific, findable account into nothing. For social media, capture the profile URL, the post URL and the account's numeric ID where the platform shows one, because display names change and IDs do not.

Record the timeline. Write down, in plain order, when each thing happened: first contact, what was said, when money moved, when the threats started. Include dates and times. Investigators work from timelines, and a complainant who arrives with one is immediately easier to help.

Preserve the original device data where you can. Do not factory-reset a phone, do not uninstall the app, and do not clear a chat history in the belief that removing it protects you. If the harassment is on a device your family shares, take the device out of circulation rather than wiping it.

Keep every financial record: transaction IDs, wallet reference numbers, bank statements, screenshots of the payment confirmation, and any receipt the other party sent. In fraud cases the transaction trail is what makes the case tractable, because money leaves a record even when messages do not.

Finally, save copies somewhere the attacker cannot reach — an email to yourself, a cloud folder, a copy on a relative's device. If the offender has access to your account, your evidence is inside their reach until you move it out.

The Cyber Bureau accepts complaints through its own online complaint page, by email, and in person at its office in Kathmandu. District Police Offices across the country also receive cybercrime complaints and route them onward, which matters if you are not in the valley.

A complaint needs your identity. Attach a scan or photograph of your citizenship certificate, national ID, passport or driving licence. This is not bureaucratic obstruction — an identified complainant is what allows a case file to be opened and, if it proceeds, prosecuted. Where the victim is a minor, a parent or guardian files.

Write the complaint as a plain narrative in the order events happened. Say who you are, what happened, when, on which platform, what the offender's account details are, what you have lost, and what you want done. Attach the evidence you gathered rather than describing it.

Be specific about the harm. 'Someone is harassing me' gives an investigator nothing to work with. 'A Facebook account using my photographs has sent messages to eleven of my contacts demanding money, and the account URL is X' gives them a starting point, an offence, and a place to send a preservation request.

Include the offender's details in every form you have them: phone number, email, wallet ID, bank account number, profile URLs, and any name they used. In fraud cases the receiving account number is frequently the most actionable single item in the file.

Follow up. Get a reference for your complaint, keep the acknowledgement, and note the name of the officer handling it if you attend in person. Cases move when somebody keeps asking about them, and Nepal's police are not unusual in that respect.

If your complaint involves ongoing danger — threats of violence, a stalker who knows where you live, a child at risk — say so explicitly and in the first line. That changes how a complaint is triaged, and burying it in paragraph six does not.

If money has left your bank account, digital wallet or card, the sequence changes. Contact the bank or wallet provider immediately, on its published fraud number, and ask them to freeze the account and attempt to recall or hold the transfer. This is time-critical in a way that police reporting is not, because funds that have been moved onward and withdrawn are effectively gone.

Do this even if you feel foolish. Fraud staff at banks deal with this every day and are not going to judge you, and the delay caused by embarrassment is measured in exactly the window during which recovery is possible.

Then change the credentials on everything connected: the banking password, the wallet PIN, the email account that receives the one-time passwords, and any account sharing that password. If your email was compromised, treat everything that can be reset through that email as compromised too.

File the police complaint alongside, not afterwards. Banks routinely require a police complaint reference before they will pursue a recall or open a formal dispute, and the sooner you have one the sooner that process starts.

Nepal Rastra Bank's Financial Information Unit is the national body handling financial intelligence, and the central bank sets the rules that banks and payment providers follow on fraud handling and customer protection. If your bank is unresponsive or refuses to act, escalating within the regulatory framework is a legitimate next step.

Be extremely wary of the second scam. Fraud victims are targeted again by people offering to recover the lost money for an advance fee, often claiming to be lawyers, hackers or police contacts. No legitimate recovery service works that way, and paying one is how a single loss becomes two.

Sextortion and intimate-image blackmail is the case people are most ashamed to report and most need to. The pattern is consistent: contact through a social platform, a rapid move to video chat, a recording, then demands for money escalating indefinitely. The critical advice is that paying does not end it — it identifies you as someone who pays. Capture everything, block, do not pay, and report.

Fake and cloned profiles are the volume complaint. Someone copies your photographs and name, then messages your contacts asking for money or sending abusive content. Report the profile to the platform for impersonation at the same time as you file with the Bureau; platform takedown and police investigation are separate tracks that both need starting.

Account takeover — losing control of Facebook, an email account or a wallet — needs immediate credential recovery through the platform's own process as well as a police complaint. Where the account was used to defraud your contacts, tell them directly and quickly. A message from you to your own contact list stops more losses than any complaint will.

Online investment and cryptocurrency fraud is heavily targeted at Nepal, often routed through messaging groups and often presented as a foreign-exchange or trading platform with a convincing dashboard. The dashboard is a website; the money is gone. Report it, and report the recruiter as well as the platform, because the recruiter is frequently the only party inside Nepali jurisdiction.

Harassment, doxxing and defamation online are offences, and the fact that they happen on a platform hosted abroad does not put them outside Nepali law when the offender is in Nepal. Nepal's Electronic Transactions Act is the principal statute used, and its provisions on offences committed through electronic media are the basis on which many of these cases proceed.

Complaints about a telecom or internet service — spam SMS, unauthorised charges, a number used repeatedly for fraud — can also go to the Nepal Telecommunications Authority, which regulates operators and runs its own complaint channel. That does not replace a police complaint about the underlying crime but it addresses the service side.

Set expectations honestly. The Cyber Bureau handles a large volume with limited specialist capacity, and much of the evidence it needs sits with platforms and payment processors outside Nepal, reachable only through formal requests that take time. Cases involving an identifiable Nepali bank account or phone number move faster than cases that end at an anonymous foreign platform.

That is a reason to file well, not a reason not to file. A complaint with a Nepali receiving account number, a local phone number and a clean timeline can be actioned. A complaint describing an anonymous foreign profile with no financial trail often cannot, however serious it feels.

Your complaint still matters even when your own case cannot be solved. Fraud is industrial and repetitive — the same accounts, scripts and recruiters appear across many victims — and complaints are what let investigators see the pattern. The account that could not be traced from your single report becomes traceable when six reports name it.

Keep a copy of everything you submitted, and keep following up politely and in writing. Ask for a reference, ask what the next step is, and ask when you should check again.

If the matter is serious and you can afford it, legal advice is worth having early. A lawyer can tell you whether your facts fit the offence you think they do, whether a civil claim runs alongside the criminal complaint, and what the limitation period is for your particular situation — and limitation periods in this area are shorter than people expect.

Finally, close the door behind you. Change passwords, turn on two-factor authentication everywhere it is offered, review which apps have access to your accounts, and tighten your privacy settings. A very large share of repeat victimisation happens because the original access route was never closed.