If a fake FAQ, support, refund, or checkout page tricked you, report the scam website, but don't wait for a government response before protecting your money or accounts. For U.S. consumers, the Federal Trade Commission is the broad consumer-fraud reporting route, the Internet Crime Complaint Center handles internet-enabled crime, and your bank or payment provider is the place to request a payment stop, recall, or dispute. These channels serve different purposes. None guarantees a refund or immediate website removal.
Act in the first few minutes
- Stop interacting with the site. Don't enter more information, call a number shown on the page, download another file, or argue with the scammer. Copy the exact web address only if you can do so safely.
- Contact the payment provider. Use the number on your card, your banking app, or the provider's official website. Ask whether the payment can be stopped, recalled, or disputed, and save the case number.
- Secure affected accounts. From a trusted device, change any exposed password and change it anywhere you reused it. Turn on multifactor authentication. If you installed remote-access software or downloaded a suspicious file, disconnect the device from the internet and contact a trusted technician or your organization's IT team.
- Preserve evidence. Save screenshots, emails, receipts, messages, and transaction details before the page disappears.
- File the appropriate reports. The FTC is a broad starting point for consumer fraud. Add an IC3 report when the incident involved phishing, credential theft, remote access, online extortion, cryptocurrency, or another internet-enabled crime.
A complaint can help authorities and providers recognize patterns, but it doesn't replace a charge dispute, account-security steps, or an abuse report to a registrar or hosting company.
Identify the type of scam
The best reporting route depends on what the website did:
- Phishing or credential theft: The site copied a bank, retailer, government agency, or support page and asked for a login or verification code.
- Fake technical support: A pop-up or FAQ page claimed your device had a virus and demanded remote access, gift cards, cryptocurrency, or an urgent fee.
- Fake refund or subscription page: The site requested card, bank, or login details to process a refund or cancel a charge.
- Fraudulent online purchase: You paid a site that never delivered, sent a different item, or used a false business identity.
- Business impersonation: The site copied a real company's logo, FAQ, domain name, or customer-service details.
- Attempted scam with no loss: You spotted the site or entered no information but still want to warn others and help investigators.
A legitimate merchant dispute and a fake website can overlap. Describe the conduct accurately instead of selecting "unauthorized transaction" when you knowingly made a purchase and the problem is nondelivery or misrepresentation. Your card issuer or bank will determine which dispute process applies.
Gather evidence without exposing more information
Create a short timeline while the details are fresh. Record when you found the site, how you reached it, what the page promised, what information you entered, who contacted you, how much you paid, and what happened afterward.
Useful evidence includes:
- The full website address, including the page path and any shortened link
- Screenshots of the homepage, fake FAQ, login form, checkout page, payment instructions, and error messages
- The date, time, and time zone shown on your device
- Emails, text messages, chat records, and the original email headers
- Receipts, bank or card statements, payment confirmations, gift-card details, wire information, or cryptocurrency transaction IDs
- Phone numbers, email addresses, usernames, wallet addresses, and names used by the scammer
- The name of the company or agency the site impersonated
- A list of the information you entered, such as an email address, password, card number, account number, or government identifier
- Your bank, payment-provider, and account-security case numbers
Don't upload passwords, one-time security codes, your Social Security number, date of birth, or full bank account numbers to a complaint form. The FTC warns consumers not to include those sensitive details in a fraud report. Use a masked statement or describe the payment without exposing information that could create another risk.
File an FTC scam website complaint
Use the FTC's official ReportFraud.gov complaint form. Open the address directly instead of following a link in a suspicious email or text.
The form asks for details such as:
- The category that best describes what happened, including an imposter scam, online purchase problem, identity theft, or deceptive business practice
- The website address and the business or person involved
- How you first encountered the site
- The date of the incident
- The amount lost and how you paid
- Whether the payment was an automatic recurring charge or subscription
- What information you shared
- Any contact information the scammer used
Write in chronological order. Separate what you personally observed from what you suspect, and say when you don't know a detail. You can review the FTC's official guide to reporting fraud for an example of the form.
Save the report number and confirmation email after submitting. The FTC uses complaints to identify trends, support enforcement, and share information with law enforcement. Filing does not automatically dispute a charge, open an individual refund case, or take down the website. A personal response or specific follow-up isn't guaranteed.
When to file an IC3 complaint
File with the Internet Crime Complaint Center when a website or online communication was part of an apparent internet-enabled crime. Examples include:
- A fake login page captured your credentials
- Someone used remote-access software to control your computer
- An online impersonator demanded money or threatened you
- You lost money through an online investment, cryptocurrency, or payment scheme
- The scammer used email, social media, a messaging app, or a website to target you
- A fraudulent site copied a government, bank, retailer, or technology company
Include the URL, relevant email headers, usernames, phone numbers, payment details, transaction IDs, wallet addresses, screenshots, and a clear description of the loss or attempted loss. Don't include raw passwords or other secrets.
You can file with both the FTC and IC3 when both descriptions fit. The FTC collects broad consumer-fraud reports, while IC3 collects internet-crime information for possible law-enforcement action. Neither site promises an investigation, direct contact, recovery, or a specific response time. Neither replaces contacting the company that handled your payment.
Other complaint and warning channels
| Where to report | Best use | What it does not replace |
|---|---|---|
| Your bank, card issuer, or payment provider | Stop, recall, or dispute a payment and secure the account | An FTC or IC3 complaint |
| Consumer Financial Protection Bureau | A complaint about how a bank, lender, money-transfer company, credit-reporting company, or other covered financial provider handled your issue | A website takedown request or criminal investigation |
| BBB Scam Tracker | A public warning about a business impersonation or suspected scam | A government investigation or guaranteed refund |
| Your state consumer-protection office | A seller or business operating in a state, when its location is known | A substitute for contacting the payment provider |
| Google Safe Browsing | A phishing or malware warning for a suspicious page | A financial dispute or law-enforcement report |
If the site impersonated a real company, report it through the company's official website or app. Find the contact information independently. Don't use the phone number, email address, or chat link displayed on the suspicious page.
Report the website to its provider
A domain registrar or hosting provider may have an abuse-reporting channel. If you can identify the provider through a legitimate domain-registration lookup, send a concise notice with:
- The exact domain and harmful page URL
- Screenshots and the date you observed the conduct
- The company or agency being impersonated
- A description of the phishing, payment, malware, or impersonation behavior
- Your contact information if you want the provider to ask follow-up questions
Don't include passwords, payment credentials, or a victim's full identity documents. Registration information may be private, incomplete, or inaccurate, and the provider may not disclose what action it takes. A report to a registrar or host is an abuse notice, not a guaranteed legal takedown order.
Also report the link to the search engine, social network, marketplace, email provider, or messaging service where you found it. Each service has its own rules and reporting forms.
Protect your money after filing
Reporting and recovery are separate tracks. Contact the provider that handled the payment as soon as possible:
- Credit card: Ask the issuer how to dispute the charge. Explain whether the site was an impersonator, failed to deliver, misrepresented the purchase, or used your card without permission. Card-dispute deadlines can apply, and an FTC report doesn't pause them.
- Debit card or ACH payment: Call the bank's fraud department immediately. Explain whether the transaction was a debit-card purchase, an electronic bank transfer, or an unauthorized account withdrawal. Those payment types can follow different procedures.
- Wire transfer: Ask the sending institution whether it can recall the wire and contact the receiving institution through its fraud process. A recall isn't guaranteed, but delay can reduce the available options.
- Peer-to-peer payment app: Report the transaction in the app and contact the linked bank or card issuer. Save the transaction ID and the recipient's account details.
- Gift card: Contact the card issuer using its official number, keep the receipt and card information, and ask whether any remaining balance can be protected. Never send the scammer another gift card to "unlock" a refund.
- Cryptocurrency: Notify the exchange or wallet provider immediately and preserve the wallet address and transaction hash. Cryptocurrency transfers may be difficult or impossible to reverse, so treat anyone promising guaranteed recovery with suspicion.
If you gave away a password, change it and any reused passwords. If you exposed your Social Security number or other identity information, consider placing a credit freeze with Equifax, Experian, and TransUnion and monitor your accounts for unfamiliar activity.
Mistakes that can weaken a complaint
- Waiting for the website to come down before calling the bank: Payment options may be time-sensitive.
- Reporting only to a public warning service: A BBB report can warn other consumers, but it doesn't replace the FTC, IC3, or your payment provider.
- Including sensitive information: Authorities need useful facts, not your full passwords, security codes, or account numbers.
- Revisiting the site repeatedly: Preserve what you already have and avoid clicking through the page again.
- Contacting or threatening the scammer: This can expose you to more fraud and complicate evidence preservation.
- Paying a recovery service upfront: A second scam often follows the first one, using the original complaint as proof that it can "recover" your money.
- Guessing at facts: Consistent dates, amounts, URLs, and payment details are more useful than speculation about who operated the site.
- Assuming a closed site ends the risk: Scammers can move to a new domain, so keep monitoring your accounts and devices.
Frequently asked questions
Can I report a scam website if I didn't lose money?
Yes. Report an attempted phishing, impersonation, malware, or payment scam to the FTC. If it involved online crime, file with IC3 as well. Include the URL and explain that you didn't complete the payment or provide information.
Will an FTC complaint remove the website?
Not automatically. The FTC collects reports and may use them in investigations or enforcement. Website removal or browser warnings usually depend on the domain registrar, host, platform, browser, or another provider taking action under its policies.
Should I file with both the FTC and IC3?
File with both when the incident is both consumer fraud and internet-enabled crime. Keep the facts consistent, but tailor each report to the questions asked by that agency.
Can a scam website complaint get my money back?
A complaint alone doesn't guarantee recovery. Your best immediate chance usually comes from contacting the bank, card issuer, wire service, payment app, gift-card issuer, or cryptocurrency exchange that handled the payment. Ask what dispute or fraud process applies and what deadline you must meet.
What if the site copied a real company's FAQ?
Report the copy to the real company through contact information found on its independently verified website. Also report the conduct to the FTC, and use IC3 if the page collected credentials, installed software, or caused an online financial loss.
These routes are for U.S. consumers. If you live elsewhere, use your country's consumer-protection and cybercrime authorities in addition to notifying the payment provider. Secure the exposed account or payment first, then submit the FTC report with the URL, timeline, and evidence you saved.