Costa Rica - Reporting Cyber Crime
If you have been the victim of a scam, financial fraud or cryptocurrency-related crime in Costa Rica, you should act as quickly as possible.
The most important steps are to:
Report the crime to the Organismo de Investigación Judicial (OIJ) or the Ministerio Público
Notify your bank, cryptocurrency exchange or payment provider
Preserve all available evidence
Identify any cryptocurrency exchanges or other service providers that received the funds
Avoid sending any further money
Keep your police or case reference number for subsequent enquiries
If there is an immediate threat to your safety or an emergency is taking place, call 911.
Report the Crime to the OIJ
The Organismo de Investigación Judicial (OIJ) is Costa Rica's judicial investigative police and is one of the main authorities responsible for investigating fraud and other criminal offences.
A victim can attend any OIJ office in Costa Rica and provide details of what happened.
OIJ states that:
Costa Rican nationals and foreign nationals can report crimes
You do not need a lawyer to make a report
There is no charge for filing a complaint
You should provide as much information as possible about the offence and the people involved
A report can be made at any OIJ office, even if the offence occurred elsewhere in Costa Rica
The case can subsequently be transferred internally to the appropriate investigating office
The OIJ's San José complaints office and regional delegations provide complaint services 24 hours a day, 365 days a year.
OIJ Confidential Information Line
The OIJ also operates the Centro de Información Confidencial (CICO).
Telephone: 800-8000-645
The line operates 24 hours a day and can be used to provide confidential information concerning criminal activity.
The confidential information line should not be confused with making a formal criminal complaint. If you are the victim of fraud and require an official case to be opened, attend an OIJ office or report the matter through the appropriate judicial reporting route.
Report the Crime to the Ministerio Público
A fraud victim can also make a criminal complaint through Costa Rica's Ministerio Público — Public Prosecutor's Office.
A complaint can be made at the nearest FiscalÃa.
The Ministerio Público states that a person can approach the nearest Prosecutor's Office even if that office is not ultimately responsible for the case. The matter can then be transferred to the appropriate jurisdiction.
Depending on the circumstances and available systems, electronic submission may also be possible through Costa Rica's judicial online services. Victims should confirm the appropriate reporting method with the relevant FiscalÃa.
For complex fraud and cyber-enabled crime, Costa Rica also has specialist prosecutorial capability, including the FiscalÃa Adjunta contra la Ciberdelincuencia.
Contact Your Bank Immediately
If money was sent through a:
Costa Rican bank
International bank
Credit or debit card
Payment service
Money transfer provider
Cryptocurrency exchange
contact the provider's fraud or compliance department immediately.
Tell them that the transaction is connected to suspected fraud and ask whether they can:
Stop the transaction
Recall the transfer
Flag the receiving account
Preserve transaction records
Preserve account information
Contact the receiving financial institution
Provide a fraud or investigation reference number
Do this even if you have already reported the crime to the OIJ or Ministerio Público.
Do not wait for the police investigation to progress before notifying your bank or payment provider. Financial institutions and law enforcement perform different functions and both should be contacted as early as possible.
Complaints Involving Costa Rican Financial Institutions
The Superintendencia General de Entidades Financieras (SUGEF) supervises Costa Rica's regulated financial system.
If the issue concerns the conduct of a SUGEF-supervised financial institution, the victim should generally complain to the institution first.
SUGEF states that complaints against supervised institutions normally require the institution's own administrative complaint process to have been exhausted before escalation to SUGEF. If no response is received within 10 business days, a complaint may potentially be submitted to SUGEF.
Suspected Unauthorised Financial Businesses
If the scam involves a person or business that appears to be:
Taking deposits without authorisation
Conducting financial intermediation without authorisation
Conducting unauthorised currency exchange
Claiming falsely to be a regulated bank or financial institution
the matter can also be reported to SUGEF.
SUGEF specifically advises anyone who believes they are the victim of fraud or a scam to notify the Ministerio Público immediately.
Investment Scams
If the fraud involves a purported:
Investment platform
Broker
Securities company
Investment adviser
Trading scheme
Public offering
consider checking whether the organisation is registered with the Superintendencia General de Valores (SUGEVAL).
SUGEVAL accepts complaints relating to entities and participants operating within Costa Rica's regulated securities market. It also publishes warnings concerning organisations claiming to operate in or from Costa Rica without the necessary registration or authorisation.
A regulatory complaint does not replace a criminal report. If money has been obtained through deception, the matter should still be reported to the OIJ or Ministerio Público.
If Cryptocurrency Was Involved
If cryptocurrency was sent as part of the scam, preserve the blockchain evidence immediately.
Where possible, record:
Transaction hashes / TXIDs
Sending wallet addresses
Receiving wallet addresses
Cryptocurrency used
Blockchain/network used
Amount transferred
Date and time
Exchange deposit addresses
Destination services
Screenshots of withdrawals
Exchange account information
Police or case reference number
If the funds reach a centralised cryptocurrency exchange, contact the exchange's:
Fraud team
Compliance team
Investigations team
Legal or law-enforcement response team
Provide the relevant transaction information and ask the service to preserve account and transaction records pending contact from law enforcement.
A cryptocurrency exchange may not disclose customer information, freeze an account or return funds solely because a victim asks them to. Formal legal or law-enforcement process may be required.
Cryptocurrency Regulation in Costa Rica
Costa Rica introduced important changes to its virtual-asset framework in 2026.
Law 10,961, reforming Law 7786, introduced requirements for Virtual Asset Service Providers (VASPs), including registration with SUGEF and obligations concerning anti-money laundering, customer identification, risk controls and reporting of suspicious transactions. The reform took effect in June 2026.
This may be relevant where a scam involves a cryptocurrency business operating from Costa Rica.
Registration or AML supervision should not be interpreted as a guarantee that a cryptocurrency business is financially safe, that customer funds are protected, or that stolen cryptocurrency can be recovered.
Preserve Your Evidence
Do not delete messages, emails, accounts or transaction records connected to the scam.
Preserve as much of the following as possible:
Bank statements
Payment receipts
SWIFT or international transfer information
Cryptocurrency transaction hashes
Wallet addresses
Exchange deposit and withdrawal records
Emails
WhatsApp messages
Telegram conversations
Full chat exports
Telephone numbers
Email addresses
Social-media profiles
Usernames
Website URLs
Domain names
Screenshots of websites
Investment dashboards
Screenshots showing account balances
Contracts
Invoices
Identity documents supplied by the suspects
Names and aliases used
Company information
Dates and times of communications
Voice messages
Photographs
A chronological timeline of events
Where cryptocurrency is involved, provide investigators with a tracing chart if one is available.
Any preliminary blockchain tracing chart should clearly distinguish confirmed on-chain transactions from assumptions, attribution hypotheses or investigative leads.
A preliminary chart should not be represented as a completed forensic blockchain examination unless a full forensic tracing process has actually been performed.
Do Not Send Any More Money
Once fraud is suspected, do not make further payments.
Be particularly cautious if you are told that additional money is required for:
Taxes
Withdrawal fees
AML clearance
Compliance fees
Verification fees
Security deposits
Wallet activation
Account unlocking
Release fees
Gas fees
Legal fees
Recovery fees
A scammer may show a large balance on a website or application while refusing to release it until another payment is made.
The displayed balance does not necessarily represent real assets.
Be Alert to Recovery Scams
Victims of fraud are frequently targeted a second time.
Someone may contact you claiming to be:
A cryptocurrency investigator
A recovery company
A blockchain expert
A lawyer
A hacker
A law-enforcement officer
An exchange employee
A regulator
An asset recovery specialist
They may claim that your money has already been located and can be released after another payment.
Be extremely cautious of anyone guaranteeing the recovery of stolen cryptocurrency or money.
No legitimate investigator can guarantee that assets will be frozen, seized or returned.
The First 24 Hours
For cryptocurrency fraud, the first hours following discovery can be particularly important.
Where possible, prioritise:
OIJ / police report → Bank or exchange notification → Identify exchange endpoints → Preserve evidence → Provide investigators with wallet addresses, TXIDs and tracing information
If stolen cryptocurrency reaches a centralised exchange, that exchange may hold:
Customer identity information
Email addresses
Telephone numbers
IP address information
Login records
Device information
Deposit records
Withdrawal addresses
Banking information
This can potentially turn an anonymous blockchain address into an identifiable investigative lead.
However, obtaining this information will normally require cooperation from the exchange and potentially a formal request from law enforcement.
If You Are Outside Costa Rica
If you are outside Costa Rica but the fraud involves:
A person in Costa Rica
A Costa Rican bank account
A Costa Rican company
A Costa Rican investment business
A cryptocurrency business operating from Costa Rica
Infrastructure or accounts located in Costa Rica
you should normally report the crime to your own local law-enforcement agency as well as the appropriate Costa Rican authority.
Provide investigators with:
Costa Rican bank details
Company information
Names
Telephone numbers
Email addresses
Cryptocurrency addresses
Transaction hashes
Exchange information
Payment records
A chronological account of events
Any blockchain tracing information
Your domestic law-enforcement agency may then be able to make formal enquiries of Costa Rican authorities or financial institutions through the appropriate international cooperation channels.
Last updated