How KCFR works

Three tiers, in plain English

Every search returns one of three results. Each one means something specific.

• No reports found. No one has filed a report with us about this identifier yet. This is a neutral result. It is not a clean bill of health.
• Unverified report on file. One or more people have filed a report citing this identifier, but a moderator has not yet corroborated it. The matched identifier and any siblings are shown in redacted form. Treat the identifier with caution while we review.
• Verified scam cluster. A moderator has reviewed the evidence and the cluster has been published in full. Do not transact with any identifier in the cluster.

A clean search is not exoneration

The most dangerous misread of this product is “I searched the wallet and got nothing, so it is safe to send.” That is not what an empty result means.

We see only the reports that have been filed with us. Many scams operate without ever generating a public complaint — victims may be embarrassed, may not know the platform exists, or may not realise they were defrauded until weeks later. A new operator is, by definition, unknown to us until the first report comes in.

Use the absence of a result as a prompt to verify in other ways — ask for a video call, check the wallet's on-chain transaction history, look up the counterparty in the community channels you trust, and never feel pressured to send money on a deadline.

What we publish, and what we hide

Public pages show full identifier values only for clusters a moderator has verified. For unverified reports, identifiers are shown in a redacted form (“+254 7•• ••• 042”, “0x71C…A3F”) so a single unsubstantiated report cannot be used as a tool for harassment.

Reporter identity is never published. We retain a hash of the reporter's IP and user-agent strictly to detect coordinated abuse — moderators see it only when investigating a specific report, and only with audit logging.

From a single report to a verified cluster

Reports are not published instantly. Each one passes through a triage queue where a moderator reads the narrative, checks the identifiers against existing records, and decides:

• Accept as redacted. The default for a first-time submission with plausible detail.
• Reject. When the report is clearly malicious, harassment, or implausible.
• Verify. When at least one other report cites the same identifier with internally consistent details, or when hard external evidence (a partner CERT advisory, a documented exchange ban, a press writeup with primary sources) is attached.

Verification is always a human decision. We do not auto-verify based on report counts alone, and we do not run a model that scores identifiers behind the scenes. False positives in this product harm the wrongly accused; false negatives harm victims. Neither is acceptable.

If you have been listed

Anyone whose identifier appears in a report — verified or unverified — can submit a response. Appeals are handled by a reviewer, not by automation. An upheld appeal removes or further redacts the report and is logged in the audit trail.

We do not require you to identify yourself publicly to file an appeal. You will need a way for us to contact you to follow up — that contact is never published.

Limits

KCFR is not a court, a regulator, or an enforcement agency. We do not freeze funds, recover stolen crypto, or compel anyone to do anything. We publish what reporters tell us, after moderation, with the redaction rules above. We cooperate with formal requests from authorities under documented process — see our takedown and disclosure policy.

If you believe you are looking at an active emergency — funds being moved, a wallet still being drained — file a report with the DCI Cybercrime Unit and the Capital Markets Authority alongside reporting here. Our cluster page links to those channels.