Crypto scam in Nigeria: where to report it and what to bring

If you have been defrauded in crypto in Nigeria, do two things today: file the report with the police, and put the wallet addresses on public record.

The police report opens a criminal case. The public record works immediately — the address becomes visible to exchange compliance teams, to investigators, and to the next person who searches it before sending money.

The first hours decide most of it. Stolen crypto moves through wallets in minutes and reaches an exchange within hours. Documented that early, there is at least a chance a compliance team freezes it. Swapped, bridged and cashed out, there is not.

Key takeaways

• The Nigeria Police Force takes cybercrime reports through the National Cybercrime Centre (NPF-NCCC) portal at nccc.npf.gov.ng. It has a dedicated category for cryptocurrency and digital-asset fraud, and it asks you for the suspect's wallet address by name.
• The Force's older reporting site, incb.npf.gov.ng, is dead — the NPF said so itself when it launched the new one and told the public to discard the old link. Guides still send people there.
• You can also walk into any police station. The portal runs alongside that route, not instead of it. The NPF's Complaint Response Unit is not a fraud desk — it handles complaints about police conduct.
• The EFCC does not take a "complaint". It takes a petition — a written one — and gives you a petition number you can track.
• The SEC covers digital-asset business and publishes registers worth checking. It does not investigate the crime and it does not get your money back. An SEC Approval-in-Principle is not a licence, and platforms lean on that gap.
• Without destination addresses and transaction hashes, there is nothing in your report for anyone to work with.

What to do in the first hours

Stop sending money. There is almost always one more payment — a withdrawal fee, a tax clearance, a gas fee to unlock the balance. That money never comes back.

Then, in this order:

1. Copy every destination address and transaction hash. They are in your wallet history or your exchange's transaction log. This is the single most important thing in the report — one without addresses cannot be traced by anyone.
2. Screenshot everything before it disappears. Full WhatsApp and Telegram threads, not crops. The profile that contacted you. The website. The dashboard showing your fake profits. These sites go offline within days of a payout stopping.
3. Call your bank if any leg went through a bank transfer or a card, and ask them to flag the beneficiary account.
4. Tell the exchange you sent from, and give them the receiving address so compliance can flag it.
5. File the report — the NPF-NCCC portal, a police station, or both.

Where to report

Nigeria Police Force National Cybercrime Centre — nccc.npf.gov.ng

This is the Force's official channel for cybercrime, run by the NPF-NCCC in Abuja. You create an account, file the report, and track it from the same dashboard, where you can also message the officer handling it. Filing anonymously is possible.

Two things about the form are worth knowing before you sit down with it.

It has a top-level category called Cryptocurrency & Digital Asset Fraud, with sub-categories for exchange fraud, NFT and digital-asset scams, rug pulls and DeFi fraud, and wallet-address spoofing. You are not squeezing a crypto case into a generic "internet fraud" box.

And it asks for the suspect's wallet address as its own field, separately from yours, and separates what you lost through a bank from what you lost in crypto. It also asks for the state and local government area. Gather the addresses first — they are answers on the form, not attachments to it. A tracking number comes back at the end.

Any police station

You can report at the nearest police station in person, and for many people that is the more practical route. Bring the documentation printed, and on a flash drive as well.

A report that says only "I was scammed online" does not carry an investigation. The addresses, the hashes and the timeline make it a case.

One wrong turn to avoid: the Force describes its Complaint Response Unit as the unit that receives and resolves complaints of police professional misconduct. It is not a fraud desk.

The EFCC — write a petition, not a message

The Economic and Financial Crimes Commission is the right destination when the scheme is a Ponzi, a fake investment platform, or an operation that took money from a lot of people.

The vocabulary matters, because it changes what you send. The EFCC works from a petition — a written account of what happened, submitted online at efcc.gov.ng or delivered to the nearest Zonal Directorate, each listed on the site with its own address and email. Online submissions return a petition number you can check the status of. There is also an official mobile app, the EFCC Eagle App. The Commission is reachable on +234 99 044 000 or +234 809 332 2644, and at [email protected].

Use the petition form. The EFCC's dedicated cybercrime channel, the EC2R2 centre, is still published as "coming soon", so there is no crypto-specific intake to wait for.

Attach the addresses and hashes. A petition that describes the emotional shape of the fraud but contains no on-chain data is a story, not a case file.

What documentation to gather

• Every destination wallet address
• The transaction hash (TXID) of each transfer, with date and time
• Uncropped screenshots of the full conversations
• The exact URL of the platform, the profile, the group or the advert
• Bank transfer receipts and your crypto purchase receipts
• Names, phone numbers, emails and social handles used to contact you
• A timeline: first contact, each payment, last contact

Check before you pay — the SEC's registers

The Securities and Exchange Commission publishes three free checks. Find a Registered Operator confirms whether a firm is registered — every operator in Nigeria must be, before it starts trading. Known Investment Scams carries a schedule of illegal operators the SEC has sealed up. And the FinPort pages list operators admitted to its Regulatory Incubation and Accelerated Regulatory Incubation (ARIP) programmes, virtual-asset service providers among them.

Read that third list carefully, because it is the one being misused. Admission to ARIP means an entity holds an Approval-in-Principle, of which the SEC says: "it is not a final licence and remains conditional." A platform with an AIP — or claiming one — is not a licensed operator. A platform on none of these lists has no standing with the Commission at all.

Why the SEC is not where your case gets investigated

This costs people weeks, so it is worth being blunt.

Since the Investments and Securities Act 2025 replaced the 2007 Act, digital-asset business sits inside the SEC's world in a way it did not before. That is a real change. It does not make the SEC the place your case gets investigated. The Commission registers operators, publishes warnings, seals up illegal schemes, and takes tips on +234 209 462 1168 or [email protected]. Its digital-asset rulebook covers virtual-asset service providers and digital-asset exchanges. What it does not do is run a criminal investigation or recover funds.

The Central Bank is not that place either. Its consumer machinery is pointed at the institutions it supervises — a bank, a payment provider. A complaint about how your own bank handled a transfer belongs there. The fraudster does not.

The criminal route is the police and the EFCC. Everything else runs beside it.

Can I get my money back?

Sometimes. Much less often than the internet suggests.

It comes down to one question: did the funds reach a service with compliance obligations — an exchange, a payment processor — before they scattered? If they did, and there is a filed report to attach, there is a path. Through mixers, or into services with no cooperation, almost none.

Nobody can quote you a percentage honestly. Anyone who does it on a phone call, having seen not one transaction, is selling something.

Beware of "fund recovery" offers

A few weeks after the loss, someone offers to get your money back. Sometimes they say they are lawyers, sometimes they claim contacts inside the EFCC or a friend at an exchange. They want an upfront fee, a "processing charge", or remote access to your device.

It is the same network, or somebody who bought the victim list:

• They contacted you
• Money is required before anything happens
• The outcome is guaranteed
• Inside contacts are claimed

Reporting is free at every channel on this page. No government body in Nigeria asks you for an advance payment to return your funds. If someone claiming to be from the EFCC or the police asks for money, that is the second scam.

Why record the address publicly

A criminal case moves at the speed of one. A public record works the same afternoon.

Post the address, the hash and the website to Chainabuse and that entry becomes visible to exchange compliance teams, to investigators, and to anyone searching that address before they transfer. Chainabuse is free, open to everyone, and groups reports against the same address — so isolated losses turn into a pattern somebody can see.

Often the person it saves is not you. It is whoever searches that address two weeks from now and finds the warning.

Frequently asked questions

1. Where do I report a crypto scam in Nigeria?

Through the Nigeria Police Force National Cybercrime Centre e-reporting portal at nccc.npf.gov.ng, or in person at any police station. For Ponzi schemes and fake investment platforms, also submit a written petition to the EFCC at efcc.gov.ng.

2. Does the EFCC handle cryptocurrency fraud?

Yes, where the case is a financial crime — a Ponzi scheme, a fake investment platform, large-scale fraud. The EFCC works from a written petition rather than a phone complaint, and online submissions return a petition number you can track on its website.

3. Can the SEC recover my money?

No. The SEC registers operators, publishes warning lists and seals up illegal schemes, and digital-asset business falls within its remit since the Investments and Securities Act 2025. It does not investigate the crime or return funds. That requires the police report.

4. What does the police portal ask for?

Your account details, the incident category, the state and local government area, the amounts lost through a bank and in crypto separately, and the suspect's wallet address. Have the destination addresses and transaction hashes ready — they are fields on the form.

5. What if the platform said it was SEC-approved?

Check it against the SEC's registers. Admission to the Accelerated Regulatory Incubation Programme comes with an Approval-in-Principle, which the SEC states is not a final licence. "SEC-approved" is a claim scam platforms make freely, and it is checkable in a minute.

6. Is it worth reporting a small amount?

Yes. These operations run at scale and the same wallet address collects from dozens of victims. Small individual losses are how the large cases get built.

7. Is reporting to Chainabuse the same as reporting to the police?

No — do both. The police report opens the criminal case in Nigeria. The Chainabuse report makes the wallet address visible immediately to exchanges and investigators in every country the money might touch.