Reporting Cybercrime via Absher, my.gov.sa, and Kolonna Amn — Saudi Arabia
Sourced from Saudi royal decrees, regulations, and ministerial decisions. Written in plain language for general understanding — this is educational content, not legal advice. Our editorial standards
What is this right?
Saudi Arabia provides three equivalent online channels to file a cybercrime complaint, all feeding the same Public Security Department + Public Prosecution pipeline. The legal framework is the Anti-Cyber Crime Law 2007 (Royal Decree M/17): Article 3 covers defamation and harm via IT devices (up to 1 year / SAR 500,000); Article 4 covers unauthorised access + blackmail / coercion (up to 5 years / SAR 3,000,000); Article 5 covers unauthorised access to government systems; Article 6 covers offences against public morality / privacy / family values via electronic means; Article 7 covers attacks on critical infrastructure; Article 8 covers terrorism / national security cybercrime (heavier penalties).
The investigation runs through the Public Prosecution (Niyaba), which reviews the report, analyses digital evidence, requests forensic / technical reports, summons relevant parties, and decides whether to refer the case to court or dismiss it. The Ministry of Interior and the Communications, Space and Technology Commission (CST) share operational enforcement. For pure cybersecurity-vulnerability disclosure (not victim complaints), the National Cybersecurity Authority (NCA) at nca.gov.sa is the right channel.
When does it apply?
- Online fraud, phishing, account takeover, identity theft, blackmail, sextortion, or impersonation in Saudi Arabia.
- An investment / crypto / trading platform operating through Saudi phone numbers, bank accounts, or social-media advertising.
- An unsolicited message asking for OTP, banking details, or document copies on behalf of a Saudi entity (SAMA, Absher, Customs, GAZT/ZATCA, courier).
- A fake job offer, fake landlord, or fake delivery scam targeting KSA residents.
- Online harassment or cyberstalking — see Data Privacy & Digital Rights category for sexual-harassment overlap with the Anti-Harassment Law 2018.
Filing a Cybercrime Report in Saudi Arabia
- Pick the channel that matches your KSA account setup. Absher if you already have an Absher account (most Saudi residents do): open the Cybercrime Report service. my.gov.sa for the National Platform Cyber Crime Reports service. Kolonna Amn app if you want one app for harassment, cybercrime, and human trafficking reports.
- Identify the Anti-Cyber Crime Law Article that fits. Article 3 (defamation / IT-device harm); Article 4 (unauthorised access + blackmail / coercion); Article 5 (unauthorised access to govt systems); Article 6 (offences against morality / privacy via electronic means); Article 7 (critical infrastructure); Article 8 (terrorism / national security cybercrime). Citing the article sharpens triage.
- Attach evidence. Screenshots of WhatsApp / SMS / social-media threads, full email headers, transaction receipts, recording of voice calls, fake-website URLs. The Public Prosecution review depends on the documentary record.
- For SIM-swap or telecom-side scams, parallel a complaint to CST (Communications, Space and Technology Commission). CST has operational power over Saudi telecom operators to investigate fraudulent SIM activity.
- For purely security-vulnerability disclosure (not as a victim), use NCA's incident-report channel at nca.gov.sa. NCA is the cybersecurity authority for critical-infrastructure protection — different scope from the cybercrime victim route.
- Cross-reference all case numbers on a one-page timeline. SAMA escalation will ask for them.
What should you NOT do?
- Don't post details on Saudi social media before the official report is filed. The Anti-Cyber Crime Law Article 3 (defamation, up to 1 year / SAR 500,000) and Article 6 (offences against privacy / morality) can attach to public commentary that names individuals. Keep facts in official channels first.
- Don't expect a personal investigator for small cases. Like national cybercrime intake systems in other jurisdictions, the value of the report is unlocking the bank / SAMA / civil-court routes, not guaranteeing prosecution.
- Don't pay 'recovery agents' charging an upfront fee. SAMA and Public Security repeatedly warn these are common KSA-targeted scams.
- Don't ignore a verified callback from Public Prosecution. Verify the caller by phoning back to the Niyaba's published number, but engage genuinely once verified.
Common Questions
What's the difference between Absher, Najiz, and Kolonna Amn?
Absher is the Ministry of Interior's flagship citizen-services platform — covers most government interactions including the Cybercrime Report service. Najiz is the Ministry of Justice's court-services platform — for filing civil and commercial cases and tracking judicial proceedings. Kolonna Amn ("We are all security") is a Public Security Department app focused specifically on security reporting — harassment, human trafficking, and cybercrime. All three feed the same downstream investigation pipeline; choose based on what other services you also need.
What if the scammer is overseas?
File the cybercrime complaint anyway — bank-side recovery through SAMA's framework operates on your Saudi bank regardless of where the scammer sits. International prosecution depends on mutual legal assistance treaties and Interpol coordination and rarely produces individual recovery, but the criminal-case reference supports the bank-side case.
Does the Anti-Cyber Crime Law cover deepfake content?
Yes, through Articles 3 (defamation / IT-device harm) and 6 (offences against morality / privacy via electronic means). The prohibition is on the use of electronic means causing reputational damage, blackmail, or invasion of privacy — the synthetic-vs-real distinction is not the legal bar. AI-generated content used for blackmail also attracts Article 4 (blackmail / coercion).
Is the National Cybersecurity Authority (NCA) the same as cybercrime investigators?
No. The NCA is Saudi Arabia's national cybersecurity regulator — its mandate is critical-infrastructure protection, national cybersecurity strategy, and security-vulnerability disclosure. The Public Security Department + Public Prosecution are the criminal-investigation agencies that handle individual cybercrime victim reports under the Anti-Cyber Crime Law 2007. For a victim of fraud or harassment, file via Absher / my.gov.sa / Kolonna Amn, not NCA.
When does it apply — reporting cybercrime via absher, my.gov.sa, and kolonna amn?
Online fraud, phishing, account takeover, identity theft, blackmail, sextortion, or impersonation in Saudi Arabia.An investment / crypto / trading platform operating through Saudi phone numbers, bank accounts, or social-media advertising.An unsolicited message asking for OTP, banking details, or document copies on behalf of a Saudi entity (SAMA, Absher, Customs, GAZT/ZATCA, courier).A fake job offer, fake landlord, or fake delivery scam targeting KSA residents.Online harassment or cyberstalking — see Data Privacy & Digital Rights category for sexual-harassment overlap with the Anti-Harassm...
How do I report a cybercrime in Saudi Arabia?
Pick the channel that matches your KSA account setup. Absher if you already have an Absher account (most Saudi residents do): open the Cybercrime Report service. my.gov.sa for the National Platform Cyber Crime Reports service. Kolonna Amn app if you want one app for harassment, cybercrime, and human trafficking reports.Identify the Anti-Cyber Crime Law Article that fits. Article 3 (defamation / IT-device harm); Article 4 (unauthorised access + blackmail / coercion); Article 5 (unauthorised access to govt systems); Article 6 (offences against morality / privacy via electronic means); Article 7...
What should you NOT do — reporting cybercrime via absher, my.gov.sa, and kolonna amn?
Don't post details on Saudi social media before the official report is filed. The Anti-Cyber Crime Law Article 3 (defamation, up to 1 year / SAR 500,000) and Article 6 (offences against privacy / morality) can attach to public commentary that names individuals. Keep facts in official channels first.Don't expect a personal investigator for small cases. Like national cybercrime intake systems in other jurisdictions, the value of the report is unlocking the bank / SAMA / civil-court routes, not guaranteeing prosecution.Don't pay 'recovery agents' charging an upfront fee. SAMA and Public Security...