Hacking, OTP fraud, harassment and defamation online — what the Electronic Transactions Act, 2063 actually punishes, how the Cyber Bureau works, and the exact evidence to preserve before you complain.
Nepal's digital life now runs on wallets, social media and online marketplaces — and so does its newest crime wave. The Cyber Bureau of Nepal Police reports that the overwhelming majority of complaints concern social-media offences and online financial fraud: hacked accounts, phishing, OTP theft, sextortion, defamation and blackmail. The controlling statute remains the Electronic Transactions Act, 2063 (ETA), supported by Penal Code privacy and defamation provisions.
The offence map: ETA Sections 44–58
Chapter 9 of the ETA defines the core offences. Pirating or altering source code (Sec. 44), unauthorised access or hacking (Sec. 45) and damage to computer systems (Sec. 46) each carry up to 3 years' imprisonment and NPR 200,000 fines. Publication of illegal electronic material — obscene, hateful or defamatory content (Sec. 47) — carries up to 5 years and NPR 100,000, making it the heaviest cyber provision. Breach of confidentiality (Sec. 48), false digital-signature statements (Secs. 49–51) and computer fraud including OTP and wallet fraud (Sec. 51/52) carry up to 2 years with fines to NPR 100,000; abetment draws half measures.
Section 47 deserves special attention: it is both the most-prosecuted cyber provision and the most misused, having been deployed against journalists and social-media users. The Supreme Court has directed restraint — arrests require concrete evidence of the specific harm alleged (defamation, obscenity or hate), not merely an offensive post. Legitimate criticism remains protected speech.
Parallel laws that stack
The same act often breaches several statutes at once. Online fraud draws ETA computer-fraud plus Penal Code cheating and, on payment rails, the Banking Offence Act. Defamation online attracts Penal Code Sections 306–307 with an additional uplift for electronic or mass-media publication. Privacy violations invoke Penal Code Sections 293–298 and the Individual Privacy Act, 2075; offences against minors trigger the Children's Act, 2075. Prosecutors routinely charge the stack — and sentences can accumulate.
Filing with the Cyber Bureau
Complaints go to the Cyber Bureau (Bhotahiti, Kathmandu, or online at its portal) within 35 days of learning of the offence — a short clock that kills delayed complaints. Attach full URLs with dates and times, chat and email exports, transaction screenshots with IDs, call records for telephonic fraud, your citizenship copy, and a factual affidavit. Do not delete originals: metadata is evidence, and courts have rejected cases built on cropped screenshots alone.
How these cases are tried
Kathmandu District Court is the designated trial court for ETA offences. Investigation involves IP and device tracing, platform data requests and forensic imaging; trial turns on attribution — proving who typed, not just which account posted. Shared devices, spoofed accounts and hacked profiles are live defence issues, while the ETA's extraterritorial clause (Sec. 55) reaches acts abroad affecting Nepali systems.
Practical guidance
For victims: preserve first (screenshots with visible URLs, originals untouched), secure accounts from a clean device, then complain within 35 days. For businesses: breach playbooks, log integrity and prompt Bureau engagement position you as victim rather than accused. For the accused: Section 47 overreach, mistaken attribution and compounding avenues are tested early — speech cases especially need counsel before statements.
Key takeaways
- ETA §§ 44–52: hacking 3 yrs, illegal publication 5 yrs, computer fraud 2 yrs
- 35-day complaint clock to the Cyber Bureau — delay kills cases
- Same act often breaches ETA + Penal Code + Banking Act together
- Preserve originals with metadata; cropped screenshots fail in court
General information for public awareness — not legal advice for your specific situation. Consult an advocate →
Frequently asked questions
Someone is blackmailing me with private photos. What do I do first?
Preserve everything with URLs and timestamps, do not delete originals, secure your accounts from a clean device, and file with the Cyber Bureau within 35 days. Publication of such material attracts up to 5 years under Sec. 47 plus privacy offences.
Can police arrest for a Facebook post?
Only with concrete evidence of a specific offence — defamation, obscenity or hate — following Supreme Court restraint directives on Sec. 47 misuse. Mere criticism is not arrestable; threats and false criminal allegations can be.
I lost money to OTP fraud. Will I recover it?
Recovery runs through the criminal case (compensation orders) and parallel bank-dispute channels. Immediate reporting with transaction IDs maximises freezing chances before funds layer out.
References
- Electronic Transactions Act, 2063, Ch. 9 (Secs. 44–58) — Nepal Law Commission
- Nepal Police Cyber Bureau — complaint procedure and 35-day limitation
- National Penal Code, 2074, Secs. 293–298, 306–307 — privacy and defamation
Verify current wording and commencement at the Nepal Law Commission (lawcommission.gov.np) before relying on any provision. Reviewed by a Nepal-qualified advocate in November 2026.