If a site took your money, captured your login, or posed as a real business, report it through the channel that matches the harm. For a U.S. consumer, that usually means the bank, card issuer, or payment app first, followed by the FTC, IC3, Google Safe Browsing, or the domain's registrar and host as appropriate.
No single website-rules complaint form handles every problem. Each route has a different job. A report may help investigators or prompt a platform review, but it doesn't guarantee a takedown or get your money back.
Start with safety
Don't keep negotiating with the site. Stop replying, send no more money, and contact the bank, card issuer, or payment app through its official app or the number printed on your statement.
If you reused a password, change it from a clean device and turn on multi-factor authentication. Did you download something suspicious? Stop opening or using that file.
What a website "rules violation" actually means
A website can run afoul of several different rulebooks. Consumer-protection law, a payment service's terms, a domain registrar's abuse policy, and Google's security standards are separate systems.
A platform may review conduct under its own policy without deciding that a crime occurred. An FTC or IC3 filing is a report, not a court ruling or a refund request. Describe what you saw, paid, received, or shared.
| Problem | Start here | What to expect |
|---|---|---|
| Money sent or card charged | Bank, card issuer, or payment service | A transaction review under that provider's process |
| Deceptive sales, impersonation, or fraud | ReportFraud.ftc.gov | An official consumer fraud report |
| Phishing, malware, or another internet-enabled crime | IC3 | Analyst review and possible sharing with law enforcement partners |
| A dangerous or malicious web page | Google Safe Browsing | A security review or warning decision |
| Abuse hosted on a domain or server | Registrar and hosting provider | Review under their abuse or service policies |
Save evidence before the site changes
Pages disappear. Capture the home page, checkout screen, promises, contact details, and the page that requested payment or login information. Record the complete web address, including the path after the domain, along with the date and time.
Keep the original emails and messages. Save receipts, order numbers, payment confirmations, phone numbers, social handles, and tracking information. If the site copied a real company, record both the impersonated company and the suspected scam domain.
Your payment record should identify the rail: credit card, debit card, ACH or EFT, wire, remittance, P2P app, PayPal, or cryptocurrency. That detail affects who can help and which deadline may apply. Never put a password, one-time code, full Social Security number, or full card number in a public complaint.
One dated timeline is enough. It needn't be polished. Put the events in order: what you saw first, what the site promised, what you sent, and what happened after payment.
Match the payment method to the next step
Turns out, the payment rail matters as much as the website. Use this table for routing, not as a promise that the money can be recovered.
| Payment method | Start with | Information to gather |
|---|---|---|
| Credit or debit card | Card issuer | Merchant name on the statement, date, amount, and messages |
| ACH, EFT, or bank transfer | Bank or credit union | Recipient, amount, date, and trace or reference number |
| Wire or remittance | Sending institution | Beneficiary details, reference number, and time sent |
| P2P payment app | The app and linked bank | Username, transaction ID, and screenshots |
| PayPal | PayPal and possibly the funding source | Payment ID, claim reason, delivery evidence, and messages |
| Cryptocurrency | The exchange or wallet service involved, if any | Wallet address, transaction hash, site URL, and timeline |
File the reports in the right order
-
Contact the payment provider first. Use the official app or the number on your statement. Say whether the transaction was unauthorized, deceptive, not delivered, or different from what was promised. Ask which fraud or dispute process fits the payment rail, what deadline applies, and which documents it needs. Do this even if other reports are already pending.
-
Report the conduct to the FTC. At ReportFraud.ftc.gov, answer the guided questions about what happened, who was involved, how you paid, and how much you lost. Include the exact site URL, dates, seller names, and the claim that persuaded you to act. Save the confirmation or report number.
-
File with IC3 when the internet enabled the crime. Use IC3 for phishing, investment or cryptocurrency fraud, account takeovers, business email compromise, and similar online crimes. The IC3 FAQ says anyone affected may file, including someone outside the United States or someone reporting a subject in another country.
Trained IC3 analysts review complaints and may pass information to law enforcement or partner agencies. IC3 doesn't conduct investigations and can't provide the investigative status of a filed complaint. Don't wait for an IC3 response before contacting your bank.
-
Send phishing or malware reports to Google. Use the Google Safe Browsing report page if a page imitates a login screen, delivers malware, pushes unwanted software, or uses social engineering. Include the URL and a clear description of the harmful behavior. Google Safe Browsing is a security reporting route, not a merchant refund service.
-
Report the domain and site to the parties that control them. Use the domain's registration information to identify the registrar and find its abuse contact. When possible, report the site to its hosting provider too. Include the domain, exact page, screenshots, dates, and a brief explanation of the suspected phishing, malware, or fraud. ICANN's DNS Abuse information provides broader context about domain-name abuse.
The registrar or host may review the report and restrict service under its own policies. Neither one decides your payment dispute.
-
Report the account or listing where you found it. If an ad, marketplace listing, social account, or message led you to the site, use that service's report tool. Reuse the same timeline and keep its ticket number with the other confirmations.
PayPal disputes have their own rules
Thing is, a PayPal dispute and an FTC or IC3 report are separate tracks. Filing one doesn't extend the deadline for another.
Sign in to PayPal directly, open the Resolution Center, choose the reason that matches the transaction, and provide the order details, messages, URL, and payment information. PayPal's published U.S. Purchase Protection terms say that covered disputes must be opened within the applicable time limit.
For covered claims, the terms say to open a dispute within 30 days of delivery or fulfillment, or within 180 days of the payment, whichever is sooner. Check the current terms and the transaction's eligibility before relying on either period.
If PayPal used a card or bank account as the funding source, ask that provider about its separate process and deadline. Don't call a transaction unauthorized if you approved it but were deceived. Give the provider the facts that actually fit.
Write a factual abuse report
A reviewer can work faster with dates, URLs, amounts, and specific conduct than with a long accusation. Keep the description short and attach or offer the evidence you saved.
On [date], I visited [full URL] after [ad, email, or referral]. The page claimed [specific promise]. I sent [amount] through [payment method] or entered [type of information]. I have screenshots and transaction records. Please review the domain under your abuse or security policy.
Ask for a review under the recipient's policy. Don't demand a guaranteed takedown, guess at the operator's identity, or send unnecessary personal information. If the form doesn't accept attachments, summarize the evidence and keep the originals available.
What happens after you report
Put every confirmation number, submission date, and reply in one folder. Send extra material only through the official portal or a verified abuse address.
To be honest, silence from a platform doesn't show whether it acted internally. IC3 says it can't respond directly to every submission and doesn't provide investigative status. Google, registrars, hosts, and other platforms may also limit what they disclose.
If a payment provider denies your request, ask why and what review or appeal process is available. A substantial loss or misuse of identity information may justify contacting local law enforcement and your state's consumer-protection office. Those options vary by location.
An agency complaint isn't a lawsuit. If you may seek damages, keep the receipts, messages, screenshots, and case numbers, then check the filing rules where you live.
Common questions
Can I report a scam website if I didn't lose money?
Yes. Report attempted phishing or malware to Google and internet-enabled criminal conduct to IC3. You can also report deceptive conduct to the FTC even if you stopped before sending money or credentials.
Does an IC3 complaint shut down a website?
Not by itself. IC3 reviews complaints and may share information with law enforcement or partner agencies, but it doesn't conduct investigations or provide investigative status.
Is a terms-of-service violation enough to get a refund?
No. A platform complaint and a payment dispute follow different rules. Recovery depends on the payment provider's process, the transaction facts, and any deadline that applies.
Should I post the scam publicly?
A warning may help other consumers, but redact addresses, phone numbers, order details, and payment information. Public posts don't replace reports to the payment provider, FTC, IC3, or the relevant platform.
Open the payment provider's official app now, then file the FTC and, if relevant, IC3 reports from the same dated timeline. Save every confirmation in one folder.