How to Report Cybercrime and Online Fraud in Ethiopia (2026)

Ethiopia's digital payments have grown fast, and so have the scams that follow them. The National Bank of Ethiopia (NBE) warned banks in April 2026 about fraudsters using hacked or impersonated WhatsApp, Telegram, Facebook, email, SMS and phone accounts to ask for urgent money transfers, and Ethio telecom runs its own fraud-awareness pages covering mobile-money and SIM-swap fraud. This guide sets out what the official sources say about stopping the loss, who to report to, and how to try to get your money back. One honest caveat first: we found no police cybercrime unit named on the Federal Police website and no web form for fraud reports. The Federal Police's EFPApp is described on its app-store listing as a way to report crimes to the police with evidence, so the realistic routes are your bank or mobile-money provider, the national cyber emergency hotline, and the police (by phone, in person or through EFPApp). Act fast, because most recovery options depend on how quickly you contact the provider.

Primary sources (all read on 21 October 2026): ETHIO-CERT (INSA) · Information Network Security Administration (INSA) · Ethiopian Federal Police Commission · National Bank of Ethiopia: Financial Consumer Protection · M-PESA Ethiopia (Safaricom Ethiopia) · telebirr (Ethio telecom) · Ministry of Justice law portal

First: stop the loss

1. Contact your bank or mobile-money provider immediately. Use the number on the provider's own official page, not a number a caller or message gave you. Our verified directory lists contact points for Commercial Bank of Ethiopia, Awash Bank, Bank of Abyssinia, Dashen Bank and M-PESA Ethiopia, and the full list is on our Ethiopia bank fraud help page. If you used M-PESA, go straight to the reversal steps below.
2. Stop sending money and stop sharing codes. The NBE's April 2026 instruction to banks says customers should not send money based only on a request received through social media, messaging apps, email, SMS or an unsolicited call, and should check any financial request by speaking directly to the person or through official channels. It also says never to share PINs, passwords, OTPs or verification codes with anyone.
3. If your phone, SIM or a linked device is lost, stolen or compromised, say so at once. The NBE tells customers to notify their financial institution immediately. M-PESA says that calling 733 to report a lost or stolen line gets the line barred and the M-PESA account frozen. telebirr's page says you must immediately call its contact centre to suspend the service after a loss or theft. Ethio telecom says to report a lost SIM or device on 994 or 127, or by SMS to 9090.
4. Keep evidence: the transaction SMS or confirmation, the receiver's number or account, screenshots of chats, call times and any reference numbers you are given. The NBE's complaint process later asks for records of phone calls (dates, times, numbers and notes) and bank or account statements, so start collecting them now.
5. Secure your accounts. Change passwords and, if a messaging account was taken over, check its linked-devices list (see the scam section below).

Who to report to

• Your bank or mobile-money provider: always first, and in writing where you can. For the NBE route later, you will need to show that you complained to the provider.
• National cyber emergency hotline (ETHIO-CERT): ETHIO-CERT, part of the Information Network Security Administration (INSA), publishes 933 as its toll-free hotline for reporting cyberattacks. Its website calls the line an emergency line available 24/7. ETHIO-CERT describes its services as incident monitoring, response and threat analysis. Its pages do not say that it recovers lost money for individuals, so treat it as a reporting and technical-response channel alongside the police.
• INSA online: INSA's website has a "Report a cyber issue" page with a message form, and its FAQ says that any government institution, private company or individual experiencing a cyber-attack, data breach or suspicious digital activity should report it to INSA.
• Police: the Computer Crime Proclamation gives the police and the public prosecutor joint power to investigate computer crimes, with the prosecutor leading the investigation. The Ethiopian Federal Police Commission's website does not name a cybercrime unit or a web form for fraud reports. A February 2026 public notice on its site lists toll-free lines 990, 991, 987 and 816 and the "EFPApp" citizen engagement application for reporting suspicious activity. That notice was about security for an African Union summit, not about fraud, EFPApp's Google Play listing, published by the Ethiopian Artificial Intelligence Institute, describes it as an app to report crimes to the Federal Police, attach evidence and track the report, though it does not mention fraud specifically. Use these as general police contact points and ask where to file a fraud complaint. See who handles cybercrime in Ethiopia for how we track the agencies.
• Ethio telecom (fraud calls, messages, lost SIM): its fraud-awareness page says to dial 994 or 127, or send an SMS to 9090, when you suspect spam or fraudulent messages.
• National Bank of Ethiopia (unresolved complaints): see the money section below.

Reporting does not by itself return your money, but it creates a record with the right bodies. Report even if you lost nothing, since the report may help others.

Getting your money back

Ethiopia uses the birr (ETB). What you can do depends on how you paid, and speed matters most.

How you paid	What to do
M-PESA	Request a reversal through the app, SMS to 789 or a call to 733. It needs the receiver's consent. See the next section.
telebirr	Call the toll-free 127 contact centre at once and give the transaction ID from the telebirr SMS. telebirr's FAQ says a wrong transfer can be reversed (it says within 48 hours) only if the money is still in the other party's account, and that you can reverse it yourself by sending the transaction ID to a dedicated short code within 30 seconds (the FAQ does not name the code). Ethio telecom says it resolves complaints within 3 days at most. This is a process for mistaken transfers, not a guaranteed refund for fraud. More on telebirr contact points.
Bank transfer or card	Call your bank at once and report the fraud in writing. Ask what it can do to stop or recall the payment. If it does not resolve the matter, use the NBE complaint route below.
Cash, crypto or other apps	The official pages we read describe no recovery process for these. Report to the police and the provider, and be wary of anyone who contacts you offering to recover the money for a fee.

If your bank or provider does not resolve it: the National Bank of Ethiopia

The NBE's Financial Consumer Protection and Education Directorate (FCPED) handles complaints about financial products and services. Its page lists mobile money, mobile banking and ATM transactions among them, and "fraud in connection with customers' account" among the complaint issues. The steps it publishes are:

1. Complain to your provider first and give it the chance to resolve the matter.
2. Go to the NBE if it is unresolved. The NBE says it will only review a complaint if the issue remains unresolved within 10 business days after your provider has had the chance to address it, or if you are not satisfied with the provider's decision.
3. Submit the complaint using the online form on nbe.gov.et/fcpe, by phone on 6230, or in person at FCPED (Sudan Street, Addis Ababa). Include the completed form, your provider's final written response, copies of correspondence, records of phone calls, account statements and any agreements.

The NBE says it may reject a complaint that is outside its mandate, that a court has already resolved, or that is currently in a court process. The NBE page does not promise a refund. It is a complaint-handling route against the institution.

M-PESA: the official reversal process

M-PESA Ethiopia is run by Safaricom Ethiopia. Its contact page and FAQ set out how to ask for a reversal after sending money to the wrong person or business. This is a process for mistaken or erroneous transfers, and it depends on the other party. It is not a guarantee against fraud.

1. Choose one of three routes. (1) Send the whole M-PESA transaction notification message by SMS to 789. (2) In the M-PESA Safaricom app, tap the Reverse transaction icon on the confirmation page or on the transaction in your history, then pick a reason such as wrong amount or wrong recipient. (3) Call 733 and select Request a Reversal.
2. Watch for the SMS. After you request a reversal you get an SMS from the header "Reversal" saying the request has started. Safaricom then begins engaging the other party and says you can expect an update within 12 hours.
3. Understand the limits. Reversing a transaction requires the consent of the receiver. A reversal is not possible if the unintended recipient refuses or has already used the funds, and requests for historical transactions are also not possible.
4. Know what can be reversed. M-PESA lists Send Money, agent withdrawal, deposit and airtime transactions as reversible when transferred to the erroneous party.
5. Money received from abroad sent to a wrong number: the sender must contact the money transfer organisation used. M-PESA says that if the funds are still in the wrong number's account, it will work with that organisation to complete a reversal within 72 hours.

Protect your PIN. M-PESA's FAQ says the contact centre will never ask for your M-PESA PIN, and that you should never give anyone your PIN, your PUK, your ID details, your year of birth or your account balance over the phone. It also describes a Customer Name Check service that lets you confirm the recipient's name or number before completing a transaction.

Limits. Wallet balance and daily transaction limits are set by the National Bank of Ethiopia and depend on your account level. M-PESA's own FAQ currently gives figures that conflict with each other, so check the limit for your account in the app or by calling 733 rather than relying on a number here.

Scams official sources warn about

• Impersonation of people you know. The NBE's April 2026 instruction says fraudsters increasingly use WhatsApp, Telegram, Facebook, email, SMS and unsolicited or fake calls to impersonate individuals and request urgent transfers, often through hacked or impersonated accounts. Call the person directly before sending anything.
• Telecom and mobile-money social engineering. Ethio telecom lists social engineering by SMS, email, social media or calls, vishing (phone scams that trick you into giving out information or moving money), SIM swap, account takeover and "wangiri" missed-call scams. For telebirr, it says fraudsters call or text with wrong information, pose as known organisations, ask for one-time passcodes, or get victims to install a fake app that looks like a bank's and runs USSD in the background. It tells customers never to share a PIN, password or one-time passcode, not to return a "refund" for a package supposedly sent by mistake, and not to answer strangers who ask for airtime or telebirr money. It also says Ethio telecom staff will never ask you to share your PIN or password.
• WhatsApp "vote" link scam. In an August 2026 advisory, ETHIO-CERT described messages from compromised friends' accounts asking for votes in a contest. The link leads to a fake WhatsApp-style page, and the victim is tricked into linking the attacker's device to their account. ETHIO-CERT's advice, relayed from a security firm, is to check Linked Devices in Settings, log out of unfamiliar devices, never scan a QR code or enter a pairing code you did not start, and verify unexpected requests through another channel.
• Fake "verification" emails to business pages. A July 2026 ETHIO-CERT advisory describes a phishing campaign offering a "verified badge" to Facebook Business users, which asks you to log in on a fake page and enter your MFA code. It says the real verification service is paid, and starts inside the Facebook app, not by email.
• Pre-infected budget phones. An October 2026 ETHIO-CERT advisory, citing a security researcher, says some low-cost Android phones bought from online marketplaces may ship with malware in the firmware that cannot be removed by normal means.

For general how-to guidance, see our wider cybercrime help hub.

The law and your data

Computer Crime Proclamation No. 958/2016 (7 July 2016) is listed as in force on the Ministry of Justice's law portal. Among its offences:

• Illegal access to a computer system, data or network (Article 3): simple imprisonment of up to three years or a fine of 30,000 to 50,000 birr, or both, with heavier penalties for certain targets.
• Computer-related fraud (Article 10), for example fraudulently causing a person to act against their rights by distributing misleading computer data or misrepresenting status: rigorous imprisonment of up to five years and a fine of up to 50,000 birr. Causing someone economic loss by changing or deleting computer data for gain can bring up to ten years in serious cases.
• Electronic identity theft (Article 11): producing, obtaining, selling, possessing or transferring data identifying another person's electronic identity without authorisation, punishable with simple imprisonment of up to five years or a fine of up to 50,000 birr.

Article 23 gives the public prosecutor and police joint power to investigate, with the prosecutor leading. Article 24 requires service providers to retain computer traffic data for one year, which is one more reason to report promptly rather than wait.

Personal Data Protection Proclamation No. 1321/2024 was published in the Federal Negarit Gazette on 24 July 2024 and, under its Article 70, took effect that day. The Ministry of Justice's law portal hosts the Gazette text. A data controller must notify the supervisory body of a personal data breach within 72 hours of becoming aware of it, and a data subject can submit a written complaint to that body, which must notify its decision within 21 days. A decision can be appealed to the Federal High Court within 60 days. The proclamation names the Ethiopian Communications Authority as that body. We found no amendment as of 21 October 2026, but check the current position before relying on it. This page is general information, not legal advice.

FAQ

Can I report online fraud to the police online in Ethiopia?

We could not find a named police cybercrime unit or a web form for fraud reports on the Federal Police Commission's website. The Federal Police's EFPApp (Citizen Engagement Application) is described on its Google Play listing as a way to report crimes, attach evidence and track your report, and the police also publish toll-free lines (990, 991, 987 and 816). Use those channels and ask how to file a fraud complaint. You can also report cyberattacks to ETHIO-CERT on the 933 hotline and through INSA's online "Report a cyber issue" page.

I sent money by M-PESA to a scammer. Can I get it back?

Request a reversal straight away through the app, by SMS to 789 or by calling 733. M-PESA says a reversal needs the receiver's consent and is not possible if the receiver refuses or has already used the funds, so recovery is not guaranteed. Also report the number to your provider and the police.

Does ETHIO-CERT or INSA get my money back?

Their published pages describe incident monitoring, response and threat analysis, not recovery of funds for individuals. Reporting to them still helps the authorities track and respond to cyber incidents, but your money-recovery route runs through your bank or provider, the NBE complaint process and the police.

My bank is not helping. What can I do?

Complain to the bank first and keep its reply. If it is unresolved within 10 business days, or you are not satisfied with its decision, you can complain to the NBE's FCPED using the online form or by calling 6230. The NBE may reject cases already resolved by, or currently before, a court.

My phone or SIM was lost or stolen. What should I do?

Report it immediately. For M-PESA, call 733 so the line is barred and the account frozen. For telebirr, call the toll-free 127 centre to suspend the service. Ethio telecom also asks you to report lost SIMs and devices on 994 or 127, or by SMS to 9090. Then tell your bank, since the NBE says customers should notify their institution at once if a linked phone, SIM or device is lost, stolen or compromised.

Sources: ETHIO-CERT · INSA · Ethiopian Federal Police Commission · NBE: Financial Consumer Protection · NBE customer fraud awareness instruction (April 2026) · M-PESA Ethiopia · telebirr · Ethio telecom: fraud awareness · Computer Crime Proclamation, Ministry of Justice · Ethio telecom: cyber awareness · Ethio telecom: frequent fraud types · telebirr FAQ · Personal Data Protection Proclamation (Gazette) · ETHIO-CERT: WhatsApp scam advisory · ETHIO-CERT: Facebook Business advisory · ETHIO-CERT: pre-installed malware advisory · EFPApp (Google Play)

If you have been targeted, you are not alone. See our country-by-country cybercrime help hub for step-by-step reporting and recovery guides.