Report the site, but move on the payment problem first
Found a scam website? Preserve the evidence first. Contact the payment provider next. Then report the conduct to the agencies that fit.
Reports can help connect complaints, warn other consumers, and support enforcement. They don't guarantee a refund, a takedown, or a personal response.
For a U.S. consumer, the usual routes are the FTC, the FBI's IC3, the payment provider, and sometimes a state attorney general, BBB, domain registrar, or hosting provider. The payment rail matters. A card purchase, bank debit, wire, P2P transfer, and PayPal payment can follow different rules.
Keep your description factual. The goal is a usable record, not the loudest accusation.
What a scam complaint can and cannot do
IC3 accepts reports about cyber-enabled crime, including reports from people outside the United States or about activity in another country. Its analysts review complaints and may forward information to law enforcement or partner agencies. IC3 says it does not conduct investigations or provide the investigative status of a filed complaint. See the IC3 complaint form and IC3 FAQ.
The FTC's ReportFraud portal is another important reporting route for consumer fraud. Your bank, card issuer, or payment service handles the separate question of whether money can be recovered.
Thing is, filing a report and disputing a payment are different jobs. Do both when appropriate.
Start with these six actions
Use this order. Websites and messages can disappear quickly.
- Stop sending money or information. Don't provide another verification code, identity document, password, or remote-access permission. If the page is still open, leave it available while you capture it.
- Save the website. Record the full domain and page addresses. Capture the home page, product or investment claims, checkout screen, payment confirmation, refund terms, and any error page.
- Secure your accounts. Change reused passwords, enable multifactor authentication, and contact your bank if you shared login details or card information.
- Contact the payment channel. Call the number on your card or statement, or use the provider's official app. Ask about a dispute, recall, freeze, or fraud review.
- File the reports. Use the FTC for consumer fraud. Use IC3 when the conduct involved phishing, account takeover, hacking, or another cyber-enabled crime. Add your state attorney general or BBB when useful.
- Keep a follow-up log. Save confirmation numbers, call dates, employee names, promised response dates, and copies of every submission.
Build an evidence packet
Make one folder for the incident. Use clear file names such as 2026-03-04-checkout.png or bank-statement-redacted.pdf.
The site may vanish. The emails may disappear too.
- [ ] Exact domain and full page addresses, with the date and time you saw them
- [ ] Screenshots of the site, checkout, order confirmation, and refund or delivery promises
- [ ] Order number, receipt, transaction ID, merchant descriptor, amount, and payment date
- [ ] Emails, text messages, chat logs, phone numbers, and sender addresses
- [ ] Bank, card, or PayPal records showing the payment
- [ ] Tracking details, failed delivery notices, and your refund requests
- [ ] Notes from calls with the merchant, bank, payment service, or agency
- [ ] A short timeline showing what happened in order
Keep original files unchanged. Add notes in a separate document instead.
Redact full account numbers, passwords, Social Security numbers, and unrelated personal information before sending evidence to a public forum. Give agencies and financial institutions the details they request through their official channels.
Choose the right reporting route
| Route | Use it for | Useful evidence |
|---|---|---|
| FTC | Fake stores, deceptive offers, impersonation, and other consumer fraud | Site address, claims, payment details, messages, and loss amount |
| IC3 | Phishing, account takeover, hacking, online payment fraud, and other cyber-enabled conduct | Full domain, timestamps, email headers when available, transaction details, and screenshots |
| Bank or card issuer | Unauthorized transactions, non-delivery, counterfeit goods, or other payment disputes | Statement, transaction reference, merchant communications, and proof of what was promised |
| State attorney general | A business or scheme affecting consumers in your state | Business identity, advertising, payment record, and complaint timeline |
| BBB | An additional merchant-response channel | Order details, correspondence, and a clear requested resolution |
| Domain registrar or hosting provider | A live phishing page or fraudulent storefront | Exact page address, screenshots, and a short explanation of the abuse |
Use the FTC and IC3 together when both fit. They collect different kinds of information.
If the page is still active, a registrar or hosting report may help bring attention to it. It won't replace a bank dispute or an official crime report.
Write a complaint that someone can understand
Use dates, amounts, and actions. Avoid guesses about who operates the site unless you can support them.
A useful complaint answers four points: what you saw, what you paid, what happened afterward, and what evidence you have.
On [date], I visited [full domain] after seeing [an advertisement, email, message, or search result]. The site offered [item or service].
I paid [amount] through [payment method] on [date]. Transaction or order reference: [ID].
The site promised [delivery, service, return, or refund term]. Instead, [describe what happened]. I contacted the merchant on [dates] using [method]. The response was [no response or exact response].
Available evidence includes [screenshots, receipt, messages, statement, tracking information, or archived copy]. I am requesting review of suspected fraud and recording the payment loss.
Short and chronological beats dramatic. Include one line for each payment.
Don't claim a transaction was unauthorized if you approved it after being deceived. Describe the deception accurately. That helps the payment provider choose the right review process.
Try to recover the payment separately
A complaint cannot reverse a transfer by itself. Start the payment process now, even if your evidence folder is still messy.
If money left your bank account without permission
Tell the bank or credit union immediately. The Consumer Financial Protection Bureau's guidance says you generally must notify the institution no later than 60 days after the statement showing the unauthorized transaction was sent.
If the bank asks you to follow up in writing, do so within 10 business days. Otherwise, it may not have to provide temporary credit while investigating.
This timing applies to unauthorized transactions. It is not a universal deadline for every scam purchase.
If you were tricked into authorizing the transfer, explain that plainly and ask which dispute or fraud options apply. Don't relabel it as unauthorized.
If you paid by credit or debit card
Call the issuer using the number on the card or statement. Describe the issue precisely: goods not received, a wrong amount, counterfeit goods, or an unauthorized charge are not the same allegation.
Ask which documents it needs and when the dispute must be submitted. Follow the issuer's written instructions, and keep the confirmation number.
To be honest, the word "chargeback" doesn't promise a refund. It describes a review process.
If you used PayPal, P2P, ACH, or a wire
For PayPal, open a dispute through the account's Resolution Center as soon as possible. Check the applicable claim deadline and eligibility rules in PayPal's Buyer Protection terms. PayPal makes decisions based on eligibility and the information submitted, so not every transaction qualifies.
For P2P payments, ACH transfers, and wires, call the sending bank or service immediately. Ask whether the payment can be stopped, recalled, or flagged for fraud. Save the case number.
Turns out, speed matters more than a polished story with these payment methods. Recovery is uncertain, especially after an authorized transfer has settled.
Watch for a second scam
Scammers sometimes return as fake refund agents, investigators, or recovery specialists.
Treat requests for an upfront fee, gift cards, cryptocurrency, or remote access as a new warning sign. Use a phone number or website you found independently, not contact information supplied by the suspicious site.
If you reused a password, change it now. Monitor statements and account alerts for unfamiliar activity.
Mistakes that weaken a complaint
| Common mistake | Better move |
|---|---|
| Waiting for the merchant to answer before contacting the bank | Start the payment review promptly and keep any merchant correspondence |
| Calling an authorized scam payment unauthorized | Explain that you approved the payment because of deception |
| Posting an unredacted statement online | Hide account numbers and unrelated transactions |
| Assuming no IC3 response means no one saw the report | Save the submission details; IC3 says it may not provide case updates |
| Paying someone who promises guaranteed recovery | Stop contact and report the new request as suspected fraud |
Questions readers often have
Can I report a website after it disappears?
Yes. Give the full domain, screenshots, receipts, messages, transaction details, and dates. A missing website does not erase the evidence you saved.
Will IC3 take the site down?
There is no guaranteed takedown. IC3 reviews complaints and may share information with law enforcement or partner agencies, but it does not conduct investigations or provide investigative status.
Do I need to report to every agency?
No. Match the report to the problem. Use the payment provider for recovery, the FTC for consumer fraud, and IC3 for cyber-enabled conduct. Add state or merchant channels when they offer a useful separate record.
How long do I have to dispute the payment?
There is no single deadline for every payment type. Unauthorized bank transactions have the CFPB timing described above, while card issuers and PayPal apply their own procedures and deadlines. Act immediately.
Should I post the scam on social media?
You don't need to. If you warn others, remove personal and financial information first. Official reports and payment disputes should come before public exposure.
Open the evidence folder now. Save the transaction record, call the payment provider, and submit a factual report before the website or messages disappear.