How to File a CSA Complaint in Ghana (2026 Guide)

Filing a CSA complaint Ghana means reporting cybercrime, data breaches, or online fraud to the Cyber Security Authority, the statutory body that investigates digital threats under Act 1038. This guide walks you through the complaint process, required documents, expected timelines, and what happens after you submit, whether you’re a mobile money fraud victim in Accra, a business facing a data breach in Kumasi, or an individual targeted by a phishing scam in Takoradi.

The Cyber Security Authority was established in 2020 and operates under the Ministry of Communications and Digitalisation. Its mandate includes incident response, public education, and coordinating with law enforcement on cyber investigations. If you’ve lost money to a scam or your data has been compromised, the CSA is the first national agency to contact.

TL;DR

• The CSA accepts complaints via online form, email (cert@csa.gov.gh), or in-person at their Accra office
• You need basic info: your contact details, incident description, evidence (screenshots, transaction IDs, dates)
• Response times vary: acknowledgment within 2 business days, full investigation 7 to 30 days depending on complexity
• The CSA does not reverse transactions or issue refunds directly, but they coordinate with Bank of Ghana, telcos, and police for enforcement
• Complaints are free, no filing fee required

Who the CSA Is and What They Handle

The Cyber Security Authority is Ghana’s national computer emergency response team (CERT). Established by the Cybersecurity Act, 2020 (Act 1038), the CSA:

• Monitors cyber threats to critical national infrastructure
• Coordinates incident response for cyberattacks on government, banks, telcos, and private sector
• Educates the public on digital security best practices
• Works with Ghana Police Cyber Crime Unit, Bank of Ghana, National Communications Authority, and National Intelligence Bureau

What falls under CSA jurisdiction:

• Mobile money fraud (fake agents, phishing links, SIM swap attacks)
• Data breaches (leaked customer databases, hacked accounts)
• Ransomware and malware targeting Ghanaian entities
• Phishing emails and SMS scams
• Online investment fraud (Ponzi schemes, fake trading platforms)
• Identity theft and impersonation
• Distributed denial-of-service (DDoS) attacks on Ghanaian websites

What does NOT fall under CSA jurisdiction:

• Physical theft of phones or laptops (report to Ghana Police)
• Debt collection disputes (report to Bank of Ghana or National Insurance Commission)
• Telecom billing disputes (report to National Communications Authority)
• Content moderation issues on social media (report to platform itself)

If your complaint involves financial loss via mobile money, you should file with both the CSA and the Bank of Ghana’s fraud reporting unit.

How to File a CSA Complaint: Three Channels

1. Online Complaint Form (Fastest)

Visit the CSA website at csa.gov.gh and navigate to Report an Incident (usually in the main menu or footer).

Required fields:

• Full name
• Phone number (Ghana mobile number, starts with 0)
• Email address
• Incident type (dropdown menu: phishing, fraud, malware, data breach, other)
• Date and time of incident
• Detailed description (500 words max)
• Attachments (screenshots, transaction receipts, email headers, up to 5 MB total)

Pro tip: Write your description in a text editor first, then paste. Include transaction IDs, phone numbers involved, exact amounts in GHS, and timeline. Example:

“On 2026-04-20 at 3:15 PM, I received an SMS claiming to be from MTN Ghana asking me to verify my MoMo PIN via a link (mtn-verify-gh[.]com). I clicked the link and entered my details. Within 10 minutes, GHS 850 (April 2026) was debited from my wallet (transaction ID MTN20260420151022). I did not authorize this transaction. My MTN number is 0241234567. The SMS originated from sender ID ‘MTN-ALERT’.”

You’ll receive an auto-reply email with a case reference number (e.g. CSA-2026-04-1234). Save this for follow-up.

2. Email to CERT (For Complex Cases)

Send detailed complaints to cert@csa.gov.gh. Use this channel if:

• Your complaint involves multiple victims (coordinate with others first)
• You’re reporting on behalf of a company (include company registration number)
• You have large attachments (log files, forensic reports over 5 MB)

Subject line format: [FRAUD REPORT] Brief description - Your Name

Example: [FRAUD REPORT] MoMo SIM swap attack, GHS 3,200 stolen - Kwame Mensah

Attach evidence as PDFs or ZIP files. Include your phone number in the email body for callback.

3. In-Person at CSA Office (Rare, for Sensitive Cases)

Address:
Cyber Security Authority
No. 5 Sixth Avenue Extension, Ridge
Accra, Ghana

Operating hours: Monday to Friday, 8:00 AM to 5:00 PM (closed on public holidays)

Bring:

• Valid Ghana Card or passport
• Printed evidence (screenshots, bank statements, police report if you filed one)
• USB drive with digital evidence copies

In-person filing is useful if you’ve already filed with police and need to coordinate, or if the case involves a data breach at your employer and you’re the designated point of contact.

What Happens After You File

Step 1: Acknowledgment (1 to 2 Business Days)

The CSA sends an automated or manual email confirming receipt. Your case reference number is your tracking ID. Example:

“Your complaint (Case CSA-2026-04-1234) has been received. Our team will review within 2 business days. If we need additional information, we’ll contact you via the phone number or email provided.”

Step 2: Triage and Investigation Assignment (3 to 5 Business Days)

A CSA analyst reviews your complaint and assigns a priority level:

• Critical: Ongoing attacks on critical infrastructure, ransomware, large-scale data breaches
• High: Individual fraud cases over GHS 1,000 (April 2026), phishing campaigns targeting multiple victims
• Medium: Individual fraud under GHS 1,000 (April 2026), isolated incidents
• Low: General inquiries, non-urgent security questions

If your complaint is High or Critical, the CSA may contact you by phone within 24 hours for clarification.

Step 3: Coordination with Partner Agencies (7 to 30 Days)

The CSA does not arrest suspects or reverse transactions. Instead, they:

• Forward financial fraud cases to Bank of Ghana’s Payment Systems Department
• Alert Ghana Police Cyber Crime Unit if a crime has occurred
• Notify telcos (MTN, Telecel, AirtelTigo) if SIM swap or telecom fraud is involved
• Issue takedown requests for phishing sites to domain registrars and hosting providers
• Share threat intelligence with other African CERTs via AfricaCERT network

You should receive progress updates by email every 7 days. If you don’t, reply to your acknowledgment email with your case reference number.

Step 4: Outcome Notification (15 to 60 Days)

The CSA closes your case with one of these outcomes:

• Resolved: Phishing site taken down, suspect identified and referred to police, or funds frozen pending investigation
• Referred: Case transferred to Bank of Ghana, NCA, or police for further action (you receive the new reference number)
• Insufficient evidence: Not enough information to proceed (you can resubmit with more evidence)
• Outside jurisdiction: Issue falls under another regulator (e.g. content dispute belongs with NCA)

If your case is referred to police, the CSA provides technical support (digital forensics, IP trace) but the police handle arrest and prosecution.

Documents You Should Prepare Before Filing

Gathering evidence upfront speeds up the process:

For MoMo Fraud Cases

• Transaction history (request from your MoMo app or USSD *170#)
• Screenshots of suspicious SMS or calls
• Sender phone number or sender ID
• Date and time of fraudulent transaction
• Your MoMo registered number
• Police report reference number if you filed one (see how to spot fake MoMo agents for prevention tips)

For Phishing or Email Scams

• Full email headers (in Gmail: open email, click three dots, “Show original”)
• Screenshot of the phishing page
• Domain name of the fake site (e.g. mtn-verify-gh[.]com)
• Date you received the message
• Any financial loss incurred

For Data Breaches (Business or Individual)

• Description of data exposed (customer names, emails, phone numbers, passwords)
• How you discovered the breach (notification from third party, public leak, internal audit)
• Number of affected individuals
• Steps already taken (password resets, notifications sent, police report filed)
• Contact person’s name and title if filing on behalf of a company

Common Mistakes That Delay Your Complaint

1. Vague descriptions
“Someone scammed me” tells the CSA nothing. Include the “who, what, when, where, how much” in GHS.

2. Missing transaction IDs
The CSA and Bank of Ghana cannot trace a MoMo transaction without the transaction ID. Dig it out of your SMS history or MoMo app.

3. Filing duplicate complaints
Don’t email cert@csa.gov.gh and also fill the online form with the same details. Choose one channel. If you filed with police first, mention your police case number in the CSA complaint.

4. Expecting instant refunds
The CSA is not a bank. They investigate and coordinate, but getting your money back after MoMo fraud requires the telco or bank to reverse the transaction, which can take 14 to 45 days even with a police order.

5. Not following up
If you don’t hear back in 7 days, reply to the acknowledgment email with your case reference. The CSA handles hundreds of complaints monthly and email volume can cause delays.

Ghana-Specific Considerations

No filing fee: Unlike some jurisdictions, the CSA does not charge a fee to file a complaint. Any website or agent asking for payment to “expedite your CSA case” is a scam.

Language: The CSA accepts complaints in English. If you’re more comfortable in Twi, Ga, or Ewe, write your description in English using simple sentences or have a friend translate before submitting.

Telco cooperation timelines: MTN, Telecel, and AirtelTigo are required under the Cybersecurity Act to respond to CSA requests within 48 hours for critical incidents, 7 days for routine fraud investigations. If a telco ignores the CSA, the CSA can escalate to the National Communications Authority for enforcement.

Police referrals: The CSA refers fraud cases involving GHS 500 (April 2026) or more to Ghana Police Cyber Crime Unit automatically. For amounts under GHS 500 (April 2026), you should file a separate police report at your local station and attach the police case number to your CSA complaint.

Cross-border scams: If the scammer operates from Nigeria, Côte d’Ivoire, or another West African country, the CSA coordinates with that country’s CERT via ECOWAS CERT framework. Expect longer investigation times (30 to 90 days) and lower recovery rates for cross-border cases.

Data protection complaints: If a Ghanaian company mishandled your personal data (sold your number without consent, leaked your Ghana Card number), you should also file with the Data Protection Commission (DPC) at dataprotection.org.gh. The CSA handles the cybersecurity angle, the DPC handles the privacy violation angle.

How the CSA Works with Other Regulators

The CSA is part of a network:

For routine MoMo fraud (fake agents, wrong number scams, reversal scams), file with CSA and Bank of Ghana simultaneously. The CSA investigates the technical side, BoG pressures the telco to freeze the recipient’s wallet.

For investment scams like Ponzi schemes, file with CSA, Securities and Exchange Commission, and police. The CSA tracks the digital footprint, SEC handles the securities violation, police handle the fraud prosecution.

What the CSA Cannot Do

Be realistic about CSA’s powers:

• Cannot reverse MoMo transactions directly. That’s the telco’s job (MTN, Telecel, AirtelTigo). The CSA can pressure them, but the telco makes the final call.
• Cannot arrest suspects. Only Ghana Police can arrest. The CSA provides evidence and technical support.
• Cannot hack back or retaliate against scammers. Ghana’s Cybersecurity Act prohibits unauthorized access, even against criminals.
• Cannot guarantee recovery of funds. If the scammer withdrew the money as cash and fled, recovery is near impossible. The best outcome is freezing the account before withdrawal.
• Cannot mediate civil disputes. If you hired a web developer who didn’t deliver, that’s a contract dispute, not a cybercrime. File a civil suit instead.

Success Rates and Realistic Expectations

As of March 2026, the CSA reports:

• Phishing sites: 78% takedown success rate within 48 hours (sites hosted in Ghana), 42% for sites hosted abroad
• MoMo fraud: 31% fund recovery rate when reported within 6 hours of the fraud, 12% when reported after 24 hours
• Data breaches: 100% notification to affected individuals when the breached entity cooperates, 60% when the entity is uncooperative or foreign-based

The CSA’s biggest success is early intervention. If you report a phishing campaign while it’s still active, they can take down the site before more victims lose money. If you report 3 weeks later, the site is already gone and the money is untraceable.

FAQs

How long does it take for the CSA to respond to my complaint?
Acknowledgment arrives within 1 to 2 business days. Full investigation and outcome notification takes 15 to 60 days depending on complexity. High-priority cases (ongoing attacks, large sums) get faster response.

Can I file a CSA complaint anonymously?
No. The CSA requires your name, phone number, and email to investigate and follow up. Your details are confidential and not shared publicly, but investigators need to contact you for clarification.

Does filing with the CSA replace filing a police report?
No. For fraud involving financial loss, you should file with both CSA and Ghana Police. The CSA provides technical expertise, police handle criminal prosecution. Each agency needs its own report.

What if the scammer used a foreign phone number or website?
The CSA can still help. They coordinate with foreign CERTs and Interpol for cross-border cases. Provide the foreign number or domain in your complaint, along with any evidence of how you were contacted.

Can I track the status of my complaint online?
Not yet. As of April 2026, the CSA does not offer an online complaint tracker. You must email cert@csa.gov.gh with your case reference number to request an update. The CSA is developing a portal for 2026 Q3.

What happens if I submitted fake evidence or made a false complaint?
Filing a false cybercrime report is an offense under Section 129 of the Cybersecurity Act. You can be fined up to GHS 12,000 (April 2026) or jailed up to 2 years. Only file complaints about real incidents with honest evidence.

Can I withdraw my complaint if I settle with the scammer privately?
Email cert@csa.gov.gh with your case reference and request closure. If the case has already been referred to police, you’ll need to contact the police station as well. Private settlements are legal, but if the scammer scammed others, the investigation may continue.

Does the CSA help businesses with cybersecurity audits or penetration testing?
The CSA offers advisory services and publishes cybersecurity guidelines for businesses, but they do not conduct paid audits. For pentesting, hire a licensed cybersecurity firm. The CSA website lists accredited service providers.

Related Reads

• Zoom out: Cybersecurity in Ghana: Protect Your Data, Money, and Identity
• Topic hub: MoMo Fraud Protection: Consumer Security Guide for Ghana
• Related deep-dives:
• Fake MoMo Agent Scams: How to Spot Them
• How to Report MoMo Fraud to Bank of Ghana
• Top MoMo Scams in Ghana (2026)
• Getting Your Money Back After MoMo Fraud

Closing

The Cyber Security Authority is your first line of defense when digital threats hit your wallet or data. Filing a complaint takes 10 minutes and costs nothing, but the evidence you provide determines whether the CSA can act fast enough to help. Screenshot everything, note transaction IDs, report within hours not days, and follow up if you don’t hear back in a week.

The CSA is still a young agency (established 2020), and response times improve every quarter as they hire more analysts and improve coordination with telcos and banks. Your complaint also feeds into national threat intelligence, helping the CSA issue public alerts about emerging scams like job offer MoMo fraud and romance scams via MoMo.

Stay vigilant, report promptly, and help build a safer digital Ghana. Follow our updates on X at @jbklutsemedia.

Sources

• Cyber Security Authority official website
• Cybersecurity Act, 2020 (Act 1038)
• Bank of Ghana Payment Systems Department
• Data Protection Commission Ghana
• National Communications Authority