How to Report Cybercrime and Online Fraud in Kuwait (2026)

Kuwait has its own cybercrime unit, national telecom regulator and consumer-protection line at the central bank, so if you are scammed or hacked here, you report to Kuwaiti authorities, not to any foreign agency. Whether the fraud came through a phishing link, a scam call impersonating your bank, or a fake payment SMS, this guide shows you exactly who to contact, how to preserve evidence, and how to try to get your money back. Act fast: the sooner you tell your bank, the better your odds.

Primary sources: Ministry of Interior (ECCCD) · CITRA (Communication and Information Technology Regulatory Authority) · Central Bank of Kuwait

First: stop the loss

1. Contact your bank or card issuer immediately. If you sent money or shared card or OTP details, call the number on your card or statement, report the fraud, and ask the bank to stop or recall the payment and freeze the account. For card payments, ask about a chargeback. Our chargeback guide explains how.
2. Stop all contact with the scammer. Never share a one-time password, and never install remote-access software a caller asks for. That is the scam. Block the number, email and account.
3. Secure your accounts by changing passwords, signing out other devices and turning on two-step verification. If you clicked a link, see what to do after clicking a phishing link.
4. Keep evidence: screenshots of messages, payment references, phone numbers, account details and the URL of any fake site.

Who to report to

• Emergency or a crime in progress: call 112, widely reported as Kuwait's unified emergency number.
• Fraud, hacking or cybercrime: report to the Ministry of Interior's Electronic and Cyber Crime Combating Department (ECCCD) by phone or WhatsApp at +965 97283939.
• Scam calls, texts or suspicious links: report through the Sahel app, run by CITRA (the Communication and Information Technology Regulatory Authority), which also operates Kuwait's cybersecurity and incident-response functions. There is no separately branded "Kuwait CERT"; CITRA is the body to know.
• Banking fraud, unlicensed firms or spam: contact your bank first, then the Central Bank of Kuwait's Customer Protection Unit, or email [email protected] for unlicensed entities and [email protected] for spam and phishing messages impersonating banks.

Reporting does not by itself return your money, but it creates an official record and feeds national intelligence on fraud patterns. Report even if you lost nothing, because the information still helps stop the next victim.

Getting your money back

Kuwait uses the Kuwaiti dinar (KWD). How you paid decides your options, and speed is everything.

How you paid	What to do
Bank transfer	Call your bank within minutes to try to stop or recall the payment. Ask about its fraud policy and file a written complaint if it refuses to help.
Debit or credit card	Ask your card issuer for a chargeback and dispute the transaction in writing. Card payments carry the strongest protection.
Cash deposit, e-wallet or crypto	Rarely recoverable. Report to the platform and the ECCCD at once, and beware "recovery agents" who contact you afterward, that is usually a second scam.

Kuwaiti banks are not bound by an automatic reimbursement guarantee for authorised transfers. Report the fraud, file a formal claim with your bank, and escalate a refused claim to the Central Bank of Kuwait if the bank's own complaints process does not resolve it.

Scams that hit Kuwait

CITRA and the Ministry of Interior have flagged repeated patterns:

• Fraudulent websites and phishing links, the single largest category reported to Kuwaiti authorities, often mimicking government or banking portals.
• Scam calls impersonating officials or bank staff, pressuring victims to read out a one-time password or verification code.
• Fake payment links sent by SMS, disguised as delivery fees, refunds or utility bills, that lead to a spoofed payment page.

See how the underlying messaging trick works in our explainer on how phishing works and how to stop it.

The law and your data

Cybercrime in Kuwait, including unauthorised access and IT-enabled fraud, is prosecuted under Law No. 63 of 2015 on Combating Information Technology Crimes, in force since 12 January 2016. Kuwait does not have a general, comprehensive data-protection authority or law comparable to GDPR. The only binding data-protection rules are CITRA's Data Privacy Protection Regulation (DPPR), which applies specifically to the telecommunications sector following a 2024 amendment, not to businesses or organisations generally. If your data was mishandled outside telecoms, there is currently no dedicated national regulator to escalate to beyond the ECCCD for criminal conduct.

FAQ

Can I report a Kuwait-based scam to my home country's fraud agency instead?

You can also inform your own country's authorities, especially if you are an expatriate or visitor, but the crime happened under Kuwaiti jurisdiction. Report to the ECCCD or through the Sahel app so local investigators can act.

My email or social media account was hacked. Who do I tell?

Secure the account first: change the password, sign out other devices and turn on two-step verification. Report the incident to the ECCCD, especially if money, identity documents or business communications were affected.

I only received a suspicious message and lost nothing. Should I still report it?

Yes. Reporting scam calls, texts and phishing links through Sahel helps CITRA and the ECCCD track offenders and warn others, even when no money changed hands. Keep a screenshot before you block the sender.

Sources: Ministry of Interior (ECCCD) · CITRA · Central Bank of Kuwait

If you have been targeted, you are not alone. See our country-by-country cybercrime help hub for step-by-step reporting and recovery guides.