Cyber Crime in Nepal: Types, Laws, Cyber Bureau & How to Stay Safe

Cyber crime in Nepal (साइबर अपराध) has grown from a fringe problem into one of the country's fastest-rising categories of criminal complaints. According to Nepal Police Cyber Bureau annual data, registered complaints surged from about 2,301 in FY 2076/77 to over 14,000 in FY 2081/82 — a six-fold jump in five years. Most complaints are related to social-media harassment, online financial fraud, sextortion, phishing, and identity theft. This guide explains what cyber crime is in the Nepali context, the ten most common types, the governing cyber law (Electronic Transaction Act 2063), the role of the Cyber Bureau of Nepal Police, recent 2024–2025 cases, and practical prevention tips — all verified against primary Nepal Police and Law Commission sources.

What Is Cyber Crime? (साइबर अपराध भनेको के हो?)

Cyber crime (साइबर अपराध) is any criminal activity that uses a computer, smartphone, digital network, or the internet as the means of the crime or the target of the crime. In Nepali usage, cyber crime covers everything from someone hacking your Facebook account and posting from your name, to sophisticated phishing networks draining money from eSewa/Khalti wallets, to deepfake videos being circulated through TikTok and Instagram.

Broadly, three categories apply:

• Crimes against persons — cyber-bullying, harassment, sextortion, defamation, stalking, impersonation

• Crimes against property — online fraud, phishing, card/OTP theft, e-wallet fraud, ransomware

• Crimes against government & institutions — hacking state portals, unauthorised access to databases, spreading disinformation

Cyber Crime in Nepal — 2024 / 2025 Statistics

The scale of cyber crime in Nepal is visible in official Cyber Bureau data:

Over 80 percent of these complaints are related to social-media misuse (hate speech, defamation, fake IDs) and financial fraud. The vast majority originate from — and target — users in Bagmati, Koshi, Gandaki, and Lumbini provinces.

Top 10 Types of Cyber Crime in Nepal

1. Hacking & Account Takeover (खाता हाक)

The most common form — unauthorised access to Facebook, Instagram, Gmail, or banking accounts, often after the victim clicks a phishing link or uses a weak password. Attackers then impersonate the victim, post from the account, or ask friends for money. Prosecuted under ETA Sections 45 and 46.

2. Online Financial Fraud & Phishing

Fraudsters pose as banks, Nepal Telecom, NEA, IRD, or government offices, sending SMS or Viber messages with fake links. Victims enter OTP or PIN and funds are instantly withdrawn from mobile wallets or bank apps. Prosecuted under ETA Section 51 + Banking Offence & Punishment Act 2064.

3. Sextortion & Revenge Porn

An attacker (often posing as a young woman) befriends the target on Facebook/Instagram, extracts intimate content on video call, then threatens to leak it. A hugely growing category — do not pay, screenshot everything, and report to the Cyber Bureau within 24 hours. Prosecuted under ETA Section 47 + Muluki Code Sections 294, 295 + Privacy Act 2075.

4. Identity Theft & Fake Profiles

Cloned Facebook profiles using stolen photos, fake Tinder/Bumble accounts, or forged citizenship photocopies used to open bank accounts. Cross-cuts ETA Section 47 with Muluki Section 295 (unauthorised photo publication).

5. Cyber-bullying, Trolling & Online Harassment

Targeted harassment of women, journalists, and public figures via coordinated posts, doxxing, or pile-on. Section 47 is the usual charge, though the Supreme Court has directed that it should not be used against legitimate free speech.

6. Deepfake & AI-Generated Content

A new category rising sharply from 2024 — AI-generated nudes or fake audio clips of celebrities, politicians, and ordinary women. Prosecuted under Section 47 + Muluki Section 295 while a dedicated AI law is drafted.

7. E-Commerce & Marketplace Fraud

Fake Daraz-style sellers, Facebook Marketplace scams (advance payment, no delivery), fake hotel/trekking bookings targeting tourists. Prosecuted under ETA Section 51.

8. Data Breach & Leak

Unauthorised export of customer databases, leaked citizenship photocopies, PII resold on Telegram channels. Prosecuted under ETA Section 48 (breach of confidentiality) + Individual Privacy Act 2075.

9. Ransomware, Malware & DDoS Attacks

Targeted at small businesses, co-operatives, and hospitals — systems encrypted until ransom is paid. Covered by ETA Section 46 (damage to computer system). In 2022–2024, several Nepali banks and state portals were hit in waves of attacks traced to foreign actors.

10. Digital Copyright & Software Piracy

Unlicensed use of software, pirated movies on Telegram, and cloned mobile apps. Prosecuted under ETA Section 44 + Copyright Act 2059.

Cyber Law in Nepal — Governing Framework

There is no standalone "Cyber Crime Act" in Nepal. Instead a combination of laws applies:

The complete ETA 2063 text (Nepali + English) is on Nepal Law Commission — lawcommission.gov.np. For a deeper read on penalties, see Punishment for Cyber Crime in Nepal — ETA 2063 Section-by-Section and the parent law Electronic Transaction Act Nepal.

Cyber Bureau of Nepal Police — Role & Contact

The Cyber Bureau is the specialised wing of Nepal Police (under the Central Investigation Bureau) established in 2017 to investigate cyber crime nationwide. It coordinates with Meta, Google, TikTok, Viber, and Interpol for evidence retrieval.

How to Report Cyber Crime in Nepal

1. Preserve evidence first. Screenshot the profile URL, chat, transaction, and caller-ID. Do not delete original messages — metadata is essential.

2. File online: visit cyberbureau.nepalpolice.gov.np, click "Online Complaint / उजुरी दर्ता", fill in your details and upload evidence. A reference number is sent by SMS/email.

3. File in person: inside the Valley — at Bhotahiti; outside the Valley — at your nearest District Police Office, which forwards to the Bureau.

4. Call the hotline 9851286770 for ongoing / urgent sextortion or live fraud.

5. The Bureau investigates, obtains subscriber info from platforms/telcos, and forwards the charge-sheet to the District Attorney for trial in the competent District Court.

A notarised affidavit certifying that the screenshots and chat logs are true and unaltered is often requested for court-ready complaints.

Recent & Landmark Cyber Cases in Nepal

• TikTok ban & reinstatement (2023–2024): the Government of Nepal banned TikTok in November 2023 citing social harm and offensive content, and lifted the ban in August 2024 after the platform appointed a Nepal liaison officer and committed to cooperate with law-enforcement requests.

• Supreme Court directive on Section 47 (2023): the Court held that ETA Section 47 must not be used to curb legitimate free speech; arrests for social-media posts now require specific evidence of defamation, obscenity, or hate.

• Co-operative & bank ransomware wave (2022–2024): multiple Nepali banks and state portals were hit by ransomware and DDoS attacks traced to foreign actors; Cyber Bureau worked with Interpol on attribution.

• Loan-app harassment crackdown (2024): dozens of unlicensed digital-loan apps were taken down after mass complaints about harassment, contact-list leaks, and photo morphing.

• Deepfake / AI wave (2024–2025): the Bureau began prosecuting AI-generated explicit images under Section 47 + Muluki Section 295 while a dedicated AI law is drafted.

How to Protect Yourself from Cyber Crime — Prevention Tips

Account & Device Security

• Use a unique, long password for every major account; prefer a passphrase of 12+ characters.

• Enable two-factor authentication (2FA) on email, Facebook, Instagram, banking, and e-wallet apps.

• Keep your phone, browser, and antivirus software up to date.

• Avoid logging in to financial apps on public Wi-Fi or friends' phones.

Financial Safety

• Never share OTP, PIN, CVV, or card photo — no bank or e-wallet will ever ask. Nepal Rastra Bank has issued repeated public warnings on this.

• Verify sellers before advance payment on Daraz / Facebook Marketplace.

• Check URL carefully — fraudsters use look-alike domains like esewa-support.com or khalti.app.login.com.

Social-Media Hygiene

• Do not accept friend requests from strangers, especially those asking for video calls.

• Limit who can see your profile photos and tagged pictures.

• Never share intimate content; screenshots can be taken even on "view-once" messages.

• Report fake / cloned profiles immediately through the platform's report feature and to the Cyber Bureau.

If You Are Already a Victim

• Do not pay any extortion demand — payment encourages repeat attacks.

• Lock your affected accounts, reset passwords, revoke all active sessions, and enable 2FA.

• Preserve evidence and file a complaint with the Cyber Bureau within 24 hours.

• For financial fraud, simultaneously inform your bank / e-wallet's fraud hotline — the first 60 minutes are critical for chargeback.