If a website took your money or personal information, contact your bank or payment provider first. A government or platform report can help authorities spot patterns and warn other people, but it usually does not reverse a charge. That dispute sits with your card issuer, bank, payment app, or other provider, and it does not start automatically when you file a complaint.

For U.S. consumers, the practical order is: save evidence, lock down any exposed accounts, notify the payment provider, then report the site through the channels that match what happened.

What to do in the first 30 minutes

1. Stop communicating with the site. Don't pay a second fee, download software, or give a caller remote access. Save the URL first if the page is still up.
2. Contact the payment provider immediately. Use the number on your card, the bank's official app, or a website address you type yourself. Ask about a fraud alert, transaction dispute, card replacement, or transfer recall.
3. Secure any exposed accounts. From a trusted device, change a reused password, turn on multifactor authentication, and contact your email provider if you entered email credentials.
4. Record what happened. Write down the date, amount, payment method, website address, information you shared, and any follow-up contact.
5. Report the site. Use the FTC, IC3, Google Safe Browsing, IRS, or another route below based on the conduct.

Don't use phone numbers or email addresses supplied by the suspicious website. Scammers often plant fake bank and agency contacts on the same page that took your money.

Evidence to save before the site changes

Checkout pages and fake stores can vanish quickly. Keep copies in their original form, somewhere the scammer can't reach.

Collect:

• The complete website address, including the page where you paid or entered information
• Screenshots of the homepage, product page, checkout, payment confirmation, and contact page
• The seller's name, phone number, email address, social media account, and shipping or return address
• Order numbers, receipts, invoices, transaction IDs, wallet addresses, and bank or card statement entries
• Emails, text messages, chat logs, advertisements, and the original link that led you to the site
• A short timeline of when you visited, paid, contacted the seller, and noticed the problem
• The type of personal information you entered, such as a password, card number, Social Security number, tax document, or government ID

Leave passwords, one-time codes, complete card numbers, and full bank-account numbers out of a general complaint narrative. Redact unrelated transactions, and use only the fields or attachments the official form asks for.

Where to report a scam website in the U.S.

You can file more than one report. Each service does a different job, so sending the same accurate timeline to several relevant channels is often more useful than picking only one.

FTC: consumer fraud and deceptive online stores

File through FTC ReportFraud.gov if a website:

• Took payment for goods or services it didn't provide
• Advertised counterfeit, misleading, or materially different products
• Impersonated a business, government agency, or well-known brand
• Used deceptive claims to collect money or personal information
• Directed you to a fraudulent online purchase or subscription

Include the website address, seller information, dates, amount lost, payment method, and a plain description of what happened. The FTC uses these reports to identify fraud patterns and support enforcement or referrals.

An FTC report is not a chargeback request, refund application, or a promise that an investigator will contact you. Contact your payment provider separately.

IC3: cyber-enabled crime and online payment fraud

The Internet Crime Complaint Center complaint form fits many fake-store, phishing, account-takeover, wire-fraud, cryptocurrency, and other cyber-enabled scams. The IC3 website says it shares reports with FBI field offices and law-enforcement partners.

Provide as much detail as you can share safely:

• The scam website and any related domains
• Names, usernames, phone numbers, email addresses, and wallet addresses
• The payment rail, such as card, bank transfer, wire, or payment app
• The amount, transaction ID, and recipient information
• The messages or online interactions that led to the payment
• Any identifying information the scammer used or requested

Because of complaint volume, IC3 says it can't respond directly to every submission. Save your confirmation, and don't wait for a reply before disputing the payment with your bank or provider.

Google Safe Browsing: suspected phishing pages

Report a suspected phishing or malware page through Google Safe Browsing's site report form. Submit the exact URL and explain why it looks fraudulent.

Google may use that report to evaluate browser warnings. It does not investigate your individual loss and will not replace a bank dispute, FTC report, or police report.

If you reached the site through a search result, social media ad, marketplace, or another platform, report the listing and the account there as well. Screenshot the advertisement before you report it.

IRS: tax-related website scams

Use IRS reporting guidance when a fake website:

• Impersonates the IRS or promises a tax refund
• Requests a W-2, Form 1099, Social Security number, or tax payment
• Sells fraudulent tax-preparation services
• Involves suspected tax evasion or an abusive tax preparer
• Steals or misuses tax identity information

The IRS routes different problems to different forms. Current instructions may point to Form 3949-A for suspected tax-law violations, Form 14039 for tax-related identity theft, or Form 14242 for suspected abusive tax promotions or preparers. Follow IRS.gov before you submit anything, especially if tax documents were involved.

A fake retail store with no tax information usually belongs with the FTC, IC3, your payment provider, and possibly local police, not the IRS.

Local police, state agencies, and BBB

Call local police if you lost money, your identity was used, you received threats, or you need an incident report for a bank or insurer. Your state attorney general's consumer-protection office may accept a complaint as well.

You can also look up the business or report the incident through BBB.org. The Better Business Bureau is not a government enforcement agency. A BBB report may alert other consumers, but it does not compel a refund and should not replace an FTC, IC3, police, or payment-provider report.

How to try to recover money by payment method

The payment rail controls the recovery route that can actually move money. A website's refund policy does not decide whether your issuer accepts a dispute, and an agency complaint does not open that case for you.

Credit card

Call the issuer or use its official dispute process as soon as you can. Explain whether the problem is a charge you didn't authorize, merchandise that never arrived, a service that wasn't provided, a product that was materially different from the description, or a merchant that promised a refund and never issued it.

Ask what documents the issuer wants and what deadline applies. Card-network and issuer time limits can vary by dispute type, so don't assume a generic chargeback window covers your transaction.

Stay precise about authorization. If you typed the payment details on a fake website, don't label it unauthorized just because the seller was fraudulent. Say you authorized a purchase from a deceptive merchant, then state exactly what was not delivered or was misrepresented.

Debit card or prepaid card

Notify the bank or card issuer immediately and ask whether the card should be blocked or replaced. Say whether you authorized the payment, gave someone access to your account, or saw a wholly unknown transaction. Protections and deadlines can differ depending on those facts.

For a prepaid card, use the number printed on the card or the issuer's official website. Keep the receipt, card number, activation information, and transaction details. Don't send the card's security code to an unsolicited caller.

Bank transfer or wire

Call the bank's fraud department, and the receiving institution if you know it, as soon as possible. Ask whether the transfer can be recalled, frozen, or reviewed as fraud. A recall isn't guaranteed, especially after the recipient has moved the money, and delay makes recovery less likely.

Give the recipient name, account or routing details, confirmation number, amount, and exact time of the transfer. Report the transaction to IC3 as well if a fraudulent website or online conversation was involved.

Payment apps and P2P transfers

Report the transaction inside the payment app and contact the bank or card linked to the app. Tell both providers whether the transfer was unauthorized or whether you were tricked into paying a fake seller.

P2P payments may not follow the same dispute rules as credit-card purchases. Ask which rules apply to the funding source and whether the recipient account can be reviewed or restricted. Don't send another payment to someone claiming they can recover the first one.

PayPal

Open the transaction in your PayPal account and use the Resolution Center for the issue that actually occurred. If you truly didn't authorize the payment, follow PayPal's instructions for reporting unauthorized activity.

If you authorized a payment to a fake shop, report the missing, counterfeit, or misrepresented purchase under the applicable PayPal dispute category rather than calling the payment unauthorized. Deadlines can depend on transaction type, so review the terms in your account and act promptly.

Gift cards and cryptocurrency

Contact the gift-card issuer or cryptocurrency exchange immediately. Ask whether remaining funds or the account can be frozen, and provide the receipt, code, wallet address, transaction hash, and communications.

Recovery is often difficult after a gift-card code is redeemed or cryptocurrency is moved. No legitimate investigator needs another fee in gift cards, cryptocurrency, or cash to release your money.

Protect your accounts and identity

Reporting the website does not undo information you already entered. Match the next step to what was exposed:

• Card details: Ask the issuer whether to replace the card, and watch for small test charges or new recurring payments.
• Online password: Change it at the real service, not through a link in the scam message. Change it anywhere else you reused it.
• Email account: Reset the password, sign out unknown sessions, check forwarding rules, and turn on multifactor authentication.
• Social Security number or government ID: Follow identity-theft guidance, consider a credit freeze, and watch for unfamiliar accounts or tax activity.
• Bank login or one-time code: Call the bank's fraud department immediately. Ask about account access, transfers, and extra security controls.
• Tax documents: Tell the IRS that tax information was exposed and follow its current identity-theft instructions.

Keep checking statements and account alerts after the first report. Scammers sometimes test a small charge, then try larger or recurring charges later.

What happens after you report

Your FTC report becomes consumer-fraud intelligence that may be combined with reports from other victims. It does not promise an individual investigation or repayment.

An IC3 report may be shared with law-enforcement partners for pattern analysis or possible investigation. IC3 says it can't answer every complaint directly.

Google may evaluate a Safe Browsing URL for warnings or other action. A report does not guarantee that the page will be removed.

The payment provider is the channel that decides whether a payment can be reversed under its own process. The bank, issuer, or app opens a separate case and may ask for statements, receipts, messages, or a written explanation.

A local police incident report can document the loss. Filing it does not guarantee an arrest or a refund.

Save every confirmation number, dispute case number, email, and document you send. If a bank asks for more information, meet its stated deadline and keep copies.

Watch for recovery scams

People who already lost money are often targeted again by callers who claim they can get the funds back. IC3 has warned about scammers impersonating the complaint center. Treat the pitch as suspicious when someone:

• Guarantees a refund or says your money has already been located
• Demands an upfront fee, tax, gift card, wire, or cryptocurrency payment
• Requests your bank login, password, one-time code, or remote access
• Contacts you from a personal email account while claiming to represent a government agency
• Says you must keep the recovery effort secret

Government agencies and payment providers don't need your password or one-time code to verify a complaint. Type official addresses yourself, and reach the bank or agency through its published channel.

If you're outside the United States

This guidance is for U.S. consumers. Complaint agencies, payment protections, and deadlines vary by country, so don't apply U.S. rules to an overseas payment.

UK consumers can use GOV.UK guidance on reporting suspicious emails, websites, and phishing, which covers websites, adverts, phone calls, texts, and emails. People in Scotland who lost money to an online scam have a separate reporting route through Police Scotland. Contact your bank promptly, and use the UK process that applies to your payment method.

Frequently asked questions

Can I report a scam website if I didn't lose money?

Yes. A suspected phishing page, fake store, or impersonation site can still go to the FTC, IC3, Google Safe Browsing, the platform that displayed it, or the relevant government agency. Include what made the site suspicious, and preserve the URL.

Will an FTC or IC3 complaint get my money back?

Usually not directly. Those reports support intelligence sharing and possible enforcement. Your bank, card issuer, PayPal, payment app, or transfer provider handles the separate dispute or recovery request.

Should I contact my bank before filing a complaint?

If money or account access is involved, yes. Notify the payment provider immediately because its dispute or recall process may have a deadline. You can file the FTC or IC3 report afterward, or do both once you have enough information.

What if the scam website has disappeared?

Report it anyway. Submit the saved URL, screenshots, receipts, messages, and payment details. A missing website does not erase the transaction record, and agencies and providers can still use what you saved.

Can I file reports with several agencies?

Yes, when each report fits the agency's role. Keep the facts, dates, amounts, and payment details consistent, and mention related report or case numbers when a form asks for them.

If money already left your account, start with the number on the card or the official app, then file the FTC or IC3 report once you have the URL, amount, and a short timeline written down.