How to Report Cybercrime in Kenya: DCI, KE-CIRT, Safaricom, ODPC and Court-Ready Evidence

Kenya’s digital economy runs on mobile money, online banking and social platforms, and criminals follow the money. A June 2026 report from the National Computer and Cybercrimes Co-ordination Committee (NC4) described more than three billion cyberattacks in a single quarter, with Nairobi the national hotspot and cyber harassment among the leading reported offences in the Nyanza region. The Communications Authority’s own KE-CIRT/CC counted about 2.36 billion detected threat events between April and June 2026, down roughly 30 percent from the previous quarter but still enormous.

Most victims lose the most valuable hours deciding who to tell. This guide removes that guesswork. It is written from a forensic investigator’s perspective: what you do in the first hour decides whether your money can be traced, whether an arrest is possible and whether your evidence will stand up in a Kenyan court.

Where to report, by type of incident

Several agencies share responsibility. Use this table to choose your first call, then follow the full process below.

The 8-step process to report cybercrime in Kenya

1. Stop the loss and secure your accountsDo not send more money, do not argue with the fraudster and do not “test” the scammer’s link again. Change passwords from a clean device, enable two-step verification and log out of all other sessions. Never share your M-Pesa PIN with anyone; Safaricom states it will never ask for it.
2. Preserve evidence before anything disappearsScreenshot with the URL, date and time visible. Save the original messages, voice notes, emails and call logs. Do not delete the chat, block the number or uninstall the app yet. See the full checklist below.
3. Alert your bank, Safaricom or mobile operator within minutesSpeed is the only real chance of freezing funds. Give the transaction code, amount, time and the receiving number or account. Be aware that where a recipient disputes a reversal, Safaricom has said the sender must engage the recipient or escalate through law enforcement, so do not rely on a reversal alone.
4. Report to the DCI and obtain an OB numberUse the toll-free line, the WhatsApp channel or a police station. In practice, the hotline and WhatsApp channel are designed for anonymous intelligence; if you want a case opened, an OB number and a police abstract (often needed by banks and insurers), you will need to identify yourself and record a statement.
5. Report technical incidents to the National KE-CIRT/CCEmail [email protected], call +254 703 042 700 or +254 730 172 700, or use the www.ke-cirt.go.ke portal. This is the right channel for malicious websites, phishing campaigns, malware, account compromise and attacks on organisations.
6. Lodge an ODPC complaint if personal data is involvedIf a company or institution misused or exposed your personal data, a data subject can file a complaint with the Office of the Data Protection Commissioner through its online complaint form. Complaints are for natural persons (or someone they authorise), not for companies.
7. Report the account or content to the platformUse the in-app report tools on Facebook, Instagram, X, TikTok, WhatsApp and Telegram to request removal or suspension. Quote your OB number. Platform reporting does not replace a police report; it limits ongoing harm.
8. Follow up in writing and escalate if neededNote the investigating officer’s name and file reference. Follow up politely every one to two weeks. If the matter involves significant sums, a company, or a foreign party, instruct an advocate and a digital forensic expert early so that evidence is acquired properly.

Evidence checklist: what to bring when you report

Investigators can only act on what you can show them. Bring everything on this list, in original form where possible.

• Your identification, phone number and email address, and a short written timeline of what happened
• The scammer’s phone numbers, names, email addresses, usernames, profile URLs, wallet addresses and bank or paybill details
• Full M-Pesa statement (not just a screenshot of one message) and the transaction codes involved
• Bank statements and any fraud-desk reference numbers or emails
• Screenshots showing the full page, URL, date and time; screen recordings of live scam pages
• Original emails with full headers, not forwards or printouts
• Exported WhatsApp or Telegram chats, voice notes, call logs and SMS
• Contracts, invoices, ads, listings or documents the scammer sent, including image files with their metadata intact
• The device itself (phone or laptop) if it was compromised, switched off and left untouched

Official channels directory

Numbers and portals change. Confirm them on the agency’s own website before relying on them, and treat any “agent” who asks for a fee to “open” a police file as a red flag.

What the law says in 2026

Cybercrime in Kenya is governed mainly by the Computer Misuse and Cybercrimes Act (Cap. 79C, originally Act No. 5 of 2018), supported by the Evidence Act (Cap. 80) and the Data Protection Act, 2019. The Act was amended by the Computer Misuse and Cybercrimes (Amendment) Act, 2025 (No. 17 of 2025), assented to on 15 October 2025 and in force from 4 November 2025.

Offences you are most likely to report

Recent legal developments every reporter should know

• “Fake news” offences were struck down. On 6 March 2026 the Court of Appeal declared sections 22 (false publications) and 23 (publication of false information) unconstitutional. The Office of the Director of Public Prosecutions has appealed to the Supreme Court. If your complaint is only that someone said something untrue about you, the realistic remedy is usually civil, under the Defamation Act, rather than a criminal complaint under those sections.
• Cyber harassment remains on the statute book, but parts of the 2025 amendments are contested. The Court of Appeal declined to strike down section 27. Separately, on 2 July 2026 the High Court declared section 6(1)(ja) and section 27(1)(b) of the 2025 Amendment Act unconstitutional. The position is still developing, so report genuine threats and harassment regardless; the police and the ODPP decide which charge fits the facts.
• Service providers have stronger duties. The 2025 amendments tightened obligations on internet and telecommunications providers to assist investigations, which matters when investigators need subscriber or log data.
• Virtual assets are within reach. The amended definition of “asset” now covers virtual property, so crypto and online accounts can fall within the Act.

Because the law is moving, a short consultation with an advocate is worthwhile for any serious case. This article is general information, not legal advice.

Making digital evidence admissible in a Kenyan court

A police report starts a case; admissible evidence wins it. Kenyan courts treat electronic evidence under sections 78A, 106A and 106B of the Evidence Act. Section 106B(4) requires a certificate describing how the electronic record was produced, identifying the device and confirming the reliability of the process. Courts have refused to rely on screenshots, emails and photographs filed without that certificate; for example, the High Court in Bhavna Patel Mandaliya v Chetan Aroon Solanki [2021] KEHC 1095 (KLR) emphasised that the section 106B conditions guard against manipulated electronic evidence.

In practical terms:

• Do not rely on casual screenshots for a high-value matter. Ask for forensic acquisition of the device, account or web page, with a hash value and chain-of-custody record.
• Keep the original device and the original files. Edited, cropped or forwarded copies are easy to challenge.
• Identify early who can sign the section 106B certificate: usually the person responsible for the device or the examiner who produced the output.

Playbooks for common scenarios

Fake M-Pesa confirmation or “sent to the wrong number” scam

Do not release goods or services based on an SMS alone; check the payment in your own M-Pesa app or statement. If you already lost money, forward the message to 333, call Safaricom with the transaction code, then report to the DCI. Keep the fake message, the scammer’s number and any chat.

SIM swap and account takeover

If your phone suddenly shows no network without explanation, use another phone to call your operator and bank immediately and ask for lines and accounts to be blocked. Then report the incident and request your bank and telco records, which an investigator will need to trace how the swap was authorised.

Romance, investment and gold or land scams (including from abroad)

Stop all payments. Record every payment route (M-Pesa, bank, crypto wallet). Foreign victims can use the DCI’s WhatsApp channel and should also report in their home country. Before sending anything further, read our guide on how to verify before you send money to Kenya.

Sextortion and leaked intimate images

Do not pay. Payment usually increases demands. Preserve the threats, report to the DCI, use the platform’s non-consensual image removal tools and consider urgent court orders through an advocate. For civil remedies and takedown strategy, see our Digital and Cyber Forensics service.

Business email compromise and corporate attacks

Isolate affected accounts, preserve mail server logs and email headers, notify your bank to attempt a recall, report to KE-CIRT/CC and the DCI, and notify the ODPC if personal data was exposed. Do not wipe or rebuild systems before a forensic image is taken.

What happens after you report

The National Police Service is typically the first responder in cybercrime matters, as noted in the Rapid Reference Guide on investigating and prosecuting offences under the Act that was published on the ODPP website in September 2026. Investigators may seek court orders to obtain data from telecom operators, banks and platforms; the ODPP then decides whether to charge.

Be realistic about timelines. Recovery of funds is uncommon, particularly once money has moved through several accounts or across borders, and Safaricom reversals are not guaranteed once a recipient disputes them. A prompt report still matters: it creates the paper trail for insurance and bank claims, links your case to other victims, and supports civil recovery later.

Mistakes that weaken a cybercrime case

• Waiting days before alerting the bank or Safaricom
• Deleting chats, blocking the scammer or wiping the phone before capturing evidence
• Paying “recovery agents”, “hackers” or “insiders” who promise to retrieve your money; these are frequently a second scam
• Reporting only by phone tip when you actually need an OB number or police abstract
• Filing screenshots as evidence without a section 106B certificate
• Confronting or threatening the suspect, which can expose you to counter-complaints

Frequently asked questions

Sources

• Directorate of Criminal Investigations, hotline 0800 722 203 and WhatsApp 0709 570 000 (Kenyans.co.ke, 22 July 2025; Capital FM, July 2025)
• National KE-CIRT/CC, Cybersecurity Report April to June 2026, 42nd Edition, Communications Authority of Kenya (ca.go.ke)
• Safaricom Fraud Awareness (safaricom.co.ke/fraud-awareness); K24 Digital on reporting via 333 and My One App
• People Daily, “Can you get your money back after a wrong M-Pesa transfer?”, 9 June 2026
• Office of the Data Protection Commissioner, File/lodge a complaint (odpc.go.ke/file-a-complaint)
• Computer Misuse and Cybercrimes (Amendment) Act, 2025 (No. 17 of 2025), Kenya Gazette Supplement No. 170, 21 October 2025; Digital Policy Alert entries on commencement and court rulings
• ARTICLE 19, “Kenya: Cybercrime provisions on false information are unconstitutional”; Committee to Protect Journalists, March 2026
• NC4 quarterly status report coverage, Standard and Eastleigh Voice, 24 June 2026
• ODPP, Rapid Reference Guide on Investigation and Prosecution of Offences under the Computer Misuse and Cybercrimes Act (odpp.go.ke, September 2026)
• Evidence Act, Cap. 80, ss.78A, 106A, 106B; Bhavna Patel Mandaliya v Chetan Aroon Solanki [2021] KEHC 1095 (KLR)

Disclaimer: This article is general information for educational purposes and is not legal advice. Ultimate Forensic Consultants Ltd is a forensic investigation firm, not a law firm or a law enforcement agency. Contact numbers and legal positions were verified on 26 October 2026 and may change; confirm with the relevant agency or an advocate before acting. Last updated 26 October 2026.