If you need to report cybercrime in Kosovo, knowing where to seek help and what evidence to preserve can make a significant difference after an online scam, hacked account or suspected data theft.
Cybercrime can affect individuals, families and businesses. Common incidents include fraudulent payment requests, phishing messages, identity theft, compromised social media accounts and unauthorized access to computer systems.
The Kosovo Police provides an official cybercrime reporting service, while national cybersecurity response organizations publish security alerts and provide channels for reporting certain technical incidents.
However, reporting a crime to the police and reporting a technical security incident to a computer emergency response team are not necessarily the same process.
This 2026 guide explains how to report suspected cybercrime in Kosovo, what to do immediately after an incident, how to preserve evidence and how to protect your accounts and personal information.
1. What Is Cybercrime?
Cybercrime refers to criminal activity involving computers, networks, digital accounts or information systems.
Some offenses directly target digital systems, while others use the internet as a way to commit traditional crimes such as fraud or extortion.
Examples include:
- Unauthorized access to computer accounts.
- Online financial fraud.
- Identity and credential theft.
- Phishing and fraudulent websites.
- Malicious software attacks.
- Ransomware.
- Unauthorized access to business systems.
- Certain forms of online threats and extortion.
Not every suspicious message is necessarily a completed criminal offense. Nevertheless, reporting attempted fraud can provide useful information to the competent authorities.
2. Who Investigates Cybercrime in Kosovo?
The Kosovo Police is the principal law-enforcement authority for reporting suspected criminal activity.
Its official website provides a dedicated Report Cyber-Crime service and general crime-reporting information.
The police also maintains specialist investigative capabilities for cybercrime.
In March 2026, the Kosovo Police announced its participation in an international investigation involving allegations of unauthorized access to computer systems and theft of identities and credentials.
The announcement identified the Directorate for Investigation of Cybercrimes as the participating investigative unit.
Official website: https://www.kosovopolice.com/
Important: A cybersecurity response team can provide technical coordination or incident handling, but it should not automatically be treated as a substitute for a criminal complaint to the police.
3. How to Report Cybercrime in Kosovo: Step by Step
If you believe you have experienced online fraud, account theft or another cybercrime, follow these general steps.
Step 1 — Stop the Immediate Damage
Stop communicating with a suspected scammer and avoid making additional payments.
If an account is compromised, begin securing it from a trusted device.
Step 2 — Protect Financial Accounts
If payment information or banking access may be compromised, contact your bank immediately using its verified official contact information.
Step 3 — Preserve Evidence
Keep relevant messages, transaction references, website addresses, screenshots and account notifications.
Step 4 — Contact the Kosovo Police
Use the official Kosovo Police website, its crime-reporting service or an appropriate police station.
Step 5 — Explain the Incident Clearly
Describe what happened, when it occurred, which accounts were affected and whether money or personal data was lost.
Step 6 — Provide Supporting Information
Follow the authorities’ instructions for submitting evidence securely.
Step 7 — Keep the Report Reference
Retain any reference number or acknowledgment provided.
Step 8 — Continue Securing Your Accounts
Change compromised credentials, review account recovery settings and monitor for further suspicious activity.
Reporting promptly is important, but an investigation or recovery of lost money cannot be guaranteed.
4. Official Kosovo Police Reporting Channels
The Kosovo Police website provides both general crime-reporting information and a dedicated cybercrime reporting option.
Official website: https://www.kosovopolice.com/
The published general reporting contact numbers include:
| Contact | Number |
|---|---|
| Police emergency | 192 |
| General crime reporting | 0800 19 999 |
| Additional published police number | 038 550 999 |
For an immediate threat or emergency, use the appropriate emergency police channel.
For non-emergency online incidents, visit the official website and locate the Report Cyber-Crime section or contact the police for guidance.
The availability and operation of online submission forms can change. Confirm that you are using an official police website before sharing information.
5. What Information Should You Include in a Cybercrime Report?
A clear report helps explain the incident.
Prepare the following information where available:
- Date and approximate time of the incident.
- Description of what happened.
- Relevant website addresses.
- Usernames or account identifiers.
- Phone numbers or email addresses used by the suspected scammer.
- Screenshots of relevant communications.
- Transaction references.
- Details of affected devices or accounts.
- Information about unauthorized access.
- Any steps already taken to secure your accounts.
Avoid altering screenshots or editing messages in ways that could affect their evidential value.
Do not send your passwords, one-time verification codes or private authentication keys as ordinary evidence.
If the police need additional information, follow their official instructions.
6. How to Report an Online Scam in Kosovo
Online scams can involve fake shops, misleading investment offers, fraudulent advertisements or impersonation of legitimate organizations.
If you suspect you have been defrauded:
- Stop communicating with the suspected scammer.
- Do not send further payments.
- Contact your bank or payment provider immediately.
- Save the advertisement, website address and communications.
- Preserve transaction confirmations.
- Report the incident to the Kosovo Police.
- Report the suspicious account or advertisement to the relevant online platform.
Be cautious of people who promise to recover stolen money in exchange for an upfront fee.
Such offers may themselves be fraudulent.
7. Phishing Emails and Fake Websites
Phishing is a method of tricking people into revealing information or visiting malicious websites.
A phishing message may impersonate:
- A bank.
- A government institution.
- A delivery company.
- A telecommunications provider.
- An online marketplace.
- A social media platform.
- A familiar business or contact.
Warning signs include unusual website addresses, urgent demands, unexpected attachments and requests for passwords or authentication codes.
However, sophisticated messages may contain convincing logos and professional language.
Instead of opening a suspicious link, independently navigate to the organization’s official website.
If you entered credentials on a fraudulent page, change the affected password using the legitimate service.
8. Fake Electricity Payment and Delivery Messages
Kosovo’s national cybersecurity response organization, KOS-CERT, published warnings during 2026 concerning fraudulent text messages.
A January 2026 warning addressed SMS messages falsely claiming to concern electricity payments.
A May 2026 warning addressed fraudulent campaigns distributed through SMS and iMessage.
Such messages may pressure recipients to pay an alleged outstanding bill or visit an unofficial payment page.
To reduce risk:
- Do not pay directly through an unexpected message link.
- Verify bills through the service provider’s official channels.
- Check the website address carefully.
- Avoid entering card details on unfamiliar websites.
- Report suspicious messages through appropriate official channels.
These examples demonstrate that phishing is relevant to everyday services in Kosovo, not only large international technology platforms.
9. What to Do If Your Facebook or Instagram Account Is Hacked
If someone gains unauthorized access to your social media account, act quickly.
First, attempt recovery through the platform’s official security procedures.
For Facebook, use:
https://www.facebook.com/hacked
For Instagram, use:
https://www.instagram.com/hacked
When possible:
- Change your password.
- Secure the email account associated with the profile.
- Enable two-factor authentication.
- Review unfamiliar devices and active sessions.
- Remove unauthorized connected applications.
- Warn contacts about suspicious messages sent from your account.
- Save evidence of threats, extortion or fraudulent transactions.
If the incident involves suspected criminal activity, report it to the relevant law-enforcement authority.
A police report does not automatically guarantee that a platform will restore access to an account.
10. What to Do If Your Email Account Is Compromised
Email access can be especially sensitive because an attacker may use it to reset passwords for other services.
If you suspect unauthorized access:
- Open the provider’s official account-recovery page.
- Change the password from a trusted device.
- Enable an appropriate second authentication factor.
- Review recent sign-in activity.
- Remove unfamiliar recovery email addresses and phone numbers.
- Check forwarding rules and mailbox filters.
- Review connected applications.
- Secure other accounts that depend on the email address.
If you cannot regain access, use the provider’s official recovery process.
Do not trust third-party services promising guaranteed account recovery.
11. What If Your Bank Card Details Were Stolen?
If you entered card information on a fake payment page or notice unauthorized transactions, contact your bank immediately.
Explain what happened and ask whether the payment method should be blocked or replaced.
You may also need to:
- Dispute unauthorized transactions through the bank’s procedure.
- Review other recent transactions.
- Change compromised online banking credentials.
- Secure associated email and telephone accounts.
- Retain transaction evidence.
- Report suspected fraud to the police.
Your bank determines the available payment-dispute procedures under its rules and applicable law.
Reporting quickly can improve the chance of preventing additional losses, but reimbursement is not guaranteed.
12. What Is KOS-CERT?
KOS-CERT is Kosovo’s national cybersecurity incident coordination and response organization.
It publishes warnings about cybersecurity threats and contributes to the exchange of relevant security information.
Its official website provides alerts about vulnerabilities and fraudulent messages.
Official website:
KOS-CERT’s role concerns cybersecurity incident coordination and technical response.
For suspected theft, fraud or another criminal offense, contacting the Kosovo Police remains important.
The correct reporting route may depend on the nature of the incident and the organization affected.
13. How to Report a Technical Cybersecurity Incident to GovCERT
Kosovo also has GovCERT XK, a government computer emergency response function operating within the Agency for Information Society (ASHI).
GovCERT publishes a technical incident-reporting procedure.
Its official reporting page states that no separate reporting form is currently published and that eligible incidents can be reported directly by email.
Official incident-reporting page:
https://govcert.rks-gov.net/reporting.php
Published contact email:
The published service hours are Monday to Friday, 08:00–16:00, excluding Kosovo public holidays.
GovCERT asks incident reporters to provide information such as affected systems, time of observation, a description of the incident and supporting technical evidence.
Its constituency and responsibilities are defined by its official charter. It should not be presented as a universal replacement for police reporting or customer-support services.
14. Cybercrime Reporting vs. Cybersecurity Incident Reporting
These procedures serve different purposes.
| Suspected incident | Appropriate first response |
|---|---|
| Online financial fraud | Contact the bank and Kosovo Police |
| Identity theft or extortion | Kosovo Police |
| Hacked social media account | Official platform recovery; police if criminal activity is suspected |
| Suspicious text message | Avoid the link; report to relevant platform, operator or appropriate authority |
| Cyberattack affecting a government system | Internal incident team and relevant government cybersecurity reporting channels |
| Security vulnerability affecting an organization | Responsible system owner and appropriate incident response team |
One incident may require more than one notification.
For example, a business hit by a ransomware attack may need technical assistance, a police report and additional regulatory or contractual notifications.
15. Kosovo’s Cybersecurity Law
Kosovo’s principal cybersecurity legislation is Law No. 08/L-173 on Cyber Security, published on 27 February 2023.
The law establishes a framework for protecting network and information systems and organizing cybersecurity responsibilities.
Relevant administrative measures include provisions concerning:
- Cybersecurity incident notification.
- Registers of cyber incidents.
- Cybersecurity risks and threats.
- Restrictions or temporary suspension of affected systems.
- Institutional cybersecurity responsibilities.
These regulatory provisions are particularly relevant to organizations and entities within the law’s scope.
They should not be interpreted as requiring every individual who receives a suspicious text message to complete a formal institutional cybersecurity notification.
Official source:
https://gzk.rks-gov.net/ActDetail.aspx?ActID=70933&langid=2
16. Cybercrime Risks for Small Businesses in Kosovo
Small businesses can face cyber threats even when they do not operate sophisticated technology infrastructure.
Potential risks include:
- Compromised business email.
- Fraudulent supplier invoices.
- Stolen website administrator credentials.
- Unauthorized social media advertising.
- Data theft.
- Ransomware.
- Fraudulent online orders.
- Compromised payment accounts.
Business owners should establish basic security procedures before an incident occurs.
Useful measures include unique passwords, multifactor authentication, limited administrative permissions, software updates and tested backups.
Staff should also know how to verify unusual payment instructions.
A business should never rely solely on the apparent sender name of an email requesting an urgent transfer.
17. What If Your WordPress Website Is Hacked?
A compromised WordPress installation can affect customer information, published content and search-engine reputation.
Warning signs may include:
- Unrecognized administrator accounts.
- Unexpected redirects.
- Unknown plugins.
- Suspicious changes to website files.
- Malware warnings.
- Unusual server activity.
- Unauthorized advertisements or scripts.
If compromise is suspected, secure hosting access, preserve relevant logs and involve a qualified technical professional.
Restore from a verified clean backup only after identifying the likely cause of compromise.
Update vulnerable software, rotate credentials and review administrator access.
Website owners handling personal data may also need to assess legal notification obligations.
18. How to Protect Yourself Against Online Scams
No security practice eliminates every risk, but several measures can substantially reduce exposure.
Use unique passwords. Avoid reusing the same credentials across unrelated services.
Enable multifactor authentication. An authenticator application or security key may offer stronger protection than passwords alone.
Keep software updated. Install security updates for devices, browsers and applications.
Verify payment requests. Contact the intended recipient through a separate trusted channel.
Be careful with links. Independently visit official websites.
Maintain backups. Keep important information in secure, recoverable storage.
Review account notifications. Investigate unfamiliar sign-ins and password resets.
Limit personal information sharing. Do not send identity documents or account credentials without a legitimate reason.
These measures are relevant for residents, visitors and businesses operating in Kosovo.
19. Can You Recover Money Lost to an Online Scam?
Recovery depends on several factors, including how the payment was made, how quickly the incident is reported and the payment provider’s rules.
Bank transfers, card transactions, cryptocurrency transfers and other payment methods may have different recovery possibilities.
A police report can support the documentation of a suspected offense but does not automatically reverse a completed transaction.
If money has been lost:
- Contact the payment provider immediately.
- Ask about blocking, recalling or disputing the transaction.
- Preserve transaction records.
- Report suspected criminal activity.
- Avoid further payments to anyone promising guaranteed recovery.
Be particularly suspicious of individuals claiming to be investigators or recovery specialists who demand payment before providing assistance.
20. What Should Foreign Residents and Tourists Do?
Foreign visitors and residents can also become victims of online scams while in Kosovo.
Potential incidents include fraudulent accommodation listings, fake payment links, stolen accounts and identity misuse.
If an incident occurs:
- Contact the Kosovo Police when appropriate.
- Notify your bank or financial institution.
- Preserve information about the suspected offense.
- Contact the relevant online platform.
- Notify your home country’s authorities or consular representatives where appropriate.
Cross-border cases may involve authorities in more than one jurisdiction.
Do not assume that a foreign bank, online marketplace or embassy can replace a criminal report to the competent local authority.
21. Cybercrime Reporting Checklist
If you believe you have been affected by a cybercrime, use this checklist:
- Stop contact with the suspected scammer.
- Avoid sending additional money.
- Preserve relevant messages and links.
- Save screenshots and transaction references.
- Secure affected email and online accounts.
- Change compromised passwords.
- Enable multifactor authentication.
- Contact your bank if financial information is involved.
- Use official account-recovery procedures.
- Report suspected criminal activity to the Kosovo Police.
- Contact the relevant cybersecurity response organization if applicable.
- Keep police or incident-report references.
- Monitor for further suspicious activity.
- Avoid fraudulent recovery services.
- Review device and account security afterward.
22. Frequently Asked Questions
How do I report cybercrime in Kosovo?
Contact the Kosovo Police through its official reporting channels. Its website includes a dedicated Report Cyber-Crime service.
What is the Kosovo Police emergency number?
The official website lists 192 as the police emergency number.
Can I report online scams to the Kosovo Police?
Yes. Suspected online fraud can be reported to the competent police authorities.
What should I do if my Facebook account is hacked?
Use Facebook’s official account-recovery process, secure the associated email address and report suspected criminal activity where appropriate.
Can I report a phishing SMS?
Suspicious messages may be reported through relevant official channels, operators and platforms. Do not follow the message’s payment links.
What is KOS-CERT?
KOS-CERT is a national cybersecurity incident coordination and response organization that publishes alerts and supports cybersecurity resilience in Kosovo.
What is GovCERT Kosovo?
GovCERT XK is a government cybersecurity incident response function within the Agency for Information Society.
Is cybercrime reporting the same as reporting a technical incident?
No. A criminal complaint to law enforcement and a technical cybersecurity incident report can involve different authorities and processes.
Can I recover stolen money after an online scam?
Recovery may be possible in some circumstances, but it depends on the payment method and applicable procedures. There is no guarantee.
Which law governs cybersecurity in Kosovo?
Law No. 08/L-173 on Cyber Security is a principal legislative framework, alongside other applicable criminal, data-protection and related legislation.
23. Official Sources and References
- Kosovo Police — Official Website — Crime reporting, cybercrime reporting and police contact information.
- Kosovo Police — International Cybercrime Investigation, March 2026 — Official information on specialist cybercrime investigations.
- Kosovo Official Gazette — Law No. 08/L-173 on Cyber Security — Principal cybersecurity legislation and related administrative rules.
- KOS-CERT — National Cybersecurity Response — Cybersecurity alerts, incident response information and public warnings.
- GovCERT Kosovo — Incident Reporting — Official technical incident reporting guidance and contact information.
- GovCERT Kosovo — Official Charter — Responsibilities, scope and organizational framework.
- Kosovo Police — Organized and Serious Crime Threat Assessment 2025 — Official analysis of cybercrime and fraud methods.
Final Thoughts
Knowing how to report cybercrime in Kosovo is an important part of protecting yourself against online fraud, identity theft and unauthorized account access.
The Kosovo Police provides official crime-reporting channels, while cybersecurity response organizations such as KOS-CERT and GovCERT play different roles in technical incident coordination.
When an incident involves money, account access or personal information, the immediate priority should be to reduce further harm, preserve relevant evidence and contact the appropriate organizations.
A clear report, timely communication with financial institutions and stronger account security can help limit the consequences of an incident.
However, no reporting method guarantees that lost funds will be recovered or that a compromised account will be restored.
For the latest procedures, always consult the Kosovo Police and the relevant official cybersecurity authorities.
Photo Credits & Image Disclosure
The featured image is AI-generated for illustrative purposes. It depicts a fictional phishing email warning on a laptop alongside a smartphone displaying digital security symbols, in a conceptual office setting inspired by Prishtina, Kosovo. The screens, warning messages and security indicators are fictional and do not represent an actual cybercrime incident, official police reporting interface or genuine security notification.
Editorial Disclaimer
This guide provides general information based on public sources reviewed in November 2026. It is not legal advice, an emergency response service or a substitute for professional cybersecurity assistance. Reporting procedures, institutional responsibilities and available services may change. In an emergency, contact the competent authorities immediately.