Leave the site, copy its full web address, and report it to the agency or company that can act on that kind of problem. If you already paid or typed in personal information, contact your bank, card issuer, or payment service before you fill out a government form. A report can help investigators spot a wider scam. It does not, by itself, reverse a payment or take a website offline.
These steps are for U.S. consumers. An FTC report, an FBI IC3 complaint, a browser warning, a registrar abuse ticket, and a payment dispute do different jobs, so you may need more than one.
Protect your money and accounts first
Handle money and account security before you sit down with a complaint form.
- Contact the payment provider. Call the number on your card or statement, or use the provider's official app. Ask about fraud, a transaction dispute, a transfer recall, or an account freeze, depending on how you paid.
- Secure compromised passwords. If you typed a password on the site, change it from a device you trust. Change it anywhere you reused it, starting with email, and turn on multifactor authentication.
- Protect exposed identity information. If you gave a Social Security number, bank login, or other sensitive identity details, ask your financial institution what to do next and consider a fraud alert or credit freeze.
- Treat downloads as suspicious. Don't open files from the site. If the device is behaving unusually, disconnect it from the internet and get help from a trusted security professional.
- Don't call the site's support number. Fake support staff often ask for another payment, remote access, or more identification documents.
If you face an immediate threat, contact local law enforcement or call 911. Online reporting forms aren't emergency services.
Preserve evidence without returning to the site
You don't have to prove the website is fraudulent before you report it. A clear record of what you saw and what happened is more useful than another visit.
- Copy the complete URL, including the domain, page path, and any redirect address you already have. Don't click the link again just to confirm it.
- Take screenshots that show the address bar, the payment or login request, contact details, product claims, and any warning. Note the date and time.
- Save related emails, text messages, social posts, advertisements, and phone numbers. For email, keep the original message and headers if you have them, not only a forward.
- Record transaction details: amount, date, merchant name, confirmation number, wallet address, transaction hash, or gift-card number, as applicable.
- Write a short timeline covering how you found the site, what you were promised, what you entered or paid, and what happened afterward.
- Keep the original evidence in a secure place. Redact passwords, full card numbers, bank logins, and your full Social Security number before you upload anything.
Don't create a new account or make a small test payment to gather more proof. Don't upload an unredacted identity document unless an official reporting channel specifically asks for it.
Choose the right reporting channel
Match the report to the job you need done.
| Report route | Best for | What to include | Likely purpose |
|---|---|---|---|
| FTC | Consumer fraud, deceptive sales, and attempted scams | Website, seller details, loss, payment method, and timeline | Adds intelligence for fraud analysis and enforcement |
| FBI Internet Crime Complaint Center | Internet-enabled crime, phishing, extortion, and online financial loss | URL, suspect information, communications, and transaction details | Shares reports with law enforcement partners |
| Google Safe Browsing | Phishing and malware pages | Exact URL and a concise explanation | May support browser and security warnings |
| Microsoft | Websites flagged as unsafe in Microsoft products | URL and the reason it appears unsafe | Helps Microsoft review unsafe-site signals |
| Registrar or hosting provider | Abuse involving a domain, host, or infrastructure | URL, evidence, dates, and the harmful conduct | May lead to provider review or referral |
| Bank, card issuer, or payment service | Money already sent or unauthorized activity | Transaction records and account details | Handles the applicable dispute or recovery process |
Open each official form by typing the organization's address yourself. A link in a follow-up email or text that claims to be from the FBI, FTC, PayPal, or a bank is a common second scam.
Report the website to the FTC
For a scam website or deceptive online seller, use the FTC's fraud reporting form.
Open that address directly and follow the prompts for the type of fraud. Enter the site's exact address, the name the seller used, contact information, and any advertisement or social account connected to it. Describe what the site promised, what you paid or shared, and the dates. Include the payment method, transaction information, and other evidence the form requests, then save the confirmation.
The FTC says those reports go into the Consumer Sentinel Network, where they can help law enforcement identify patterns and build cases. An FTC report is not a substitute for contacting your bank or payment provider about a disputed transaction. FTC guidance also encourages you to tell someone you trust what happened so they can recognize the same pitch.
File a report with the FBI's IC3
Use the IC3 complaint form when the conduct ran over the internet: a phishing page, fake investment site, online extortion attempt, cryptocurrency fraud, or a fraudulent online marketplace. The FBI's fraud guidance tells victims of online or internet-enabled crime to report to IC3 as soon as possible.
Identify whether you were the victim or are reporting for someone else, then give the website address and how the site was presented to you. Add operator details you have, such as email addresses, usernames, phone numbers, wallet addresses, payment accounts, and related communications. State the amount lost, the payment method, and the date of each transaction. Follow the form's instructions for supporting material and keep any confirmation number.
IC3 collects complaints and shares them with law enforcement partners. It says it cannot respond directly to every submission, so don't wait on a reply before asking your bank or payment provider whether it can stop or reverse a transaction.
Report phishing or malware to Google and Microsoft
A browser or security-vendor report is not a police report or a consumer-fraud complaint. It can help protect other users. It usually does not determine ownership, recover money, or resolve a contract dispute.
- Google Safe Browsing: Submit the address through Google's Safe Browsing report form. Identify whether the page appears to be phishing, malware, or another unsafe page. Include the exact URL and a brief description. A report may support a warning in Google products; it isn't a guaranteed removal request.
- Microsoft: Use Microsoft's Report unsafe site form if the page is unsafe or appears to be impersonating a legitimate service. Include the address and explain what information the page is trying to collect.
- A platform or brand: If the scam arrived through a social network, search ad, app, marketplace, or an impersonated company's name, use that service's report control as well. Go to the company's real website independently rather than using contact details supplied by the scammer.
Report the specific page, not only the home page. A login page, payment page, or malicious download may have a different path.
Contact the domain registrar, host, or CDN
A domain registrar sells or manages the domain name. A hosting company stores the website. A content delivery network may only proxy traffic. Reporting to one provider doesn't mean the others will act.
Find the registrar and its abuse contact through a reliable domain lookup or the provider's official support site. Send one factual report that includes:
- The domain and full malicious URL
- The apparent conduct, such as credential theft, malware, or impersonation
- Screenshots and relevant messages
- The date you observed the activity
- The legitimate organization being impersonated, if applicable
- Any payment or victim information that is necessary, with sensitive details redacted
If a CDN is involved, it may forward the complaint to the underlying host or ask for more information. Don't assume a registrar complaint will remove the content from every server or stop the operator from registering another domain.
ICANN's complaint guidance sets a hard limit: ICANN's contractual compliance process doesn't cover country-code domains such as many national extensions. ICANN isn't a general website takedown service, and a complaint to it isn't a replacement for reporting to the registrar, host, FTC, or law enforcement.
Report the payment separately
Reporting the website does not open a payment dispute.
- Credit or debit card: Contact the issuer using the number on the card or statement. Explain whether the transaction was unauthorized, the merchant failed to deliver, or the goods or service were misrepresented. Ask what evidence and deadline apply to your account.
- Bank transfer, ACH, wire, or P2P payment: Contact the bank and the payment service immediately and ask whether a recall, freeze, or fraud investigation is possible.
- Gift card: Contact the gift-card issuer, keep the card and receipt, and provide the redemption details as requested.
- Cryptocurrency: Contact the exchange or service used to send the funds and provide the wallet address and transaction hash. Recovery may be difficult, but early notice can preserve useful information.
- PayPal: Sign in through the official PayPal website or app and use its Resolution Center. Open the appropriate dispute or claim rather than only reporting the website. PayPal's U.S. Buyer Protection terms set eligibility rules and deadlines, including a requirement to open a dispute within 180 days of sending payment or within 30 days of delivery or fulfillment, whichever is sooner. Check the terms that apply to your transaction.
Tell each provider which reports or disputes you have already opened. Don't seek duplicate reimbursement for the same loss.
Special situations
A fake cryptocurrency exchange
Send the site, wallet addresses, transaction hashes, exchange names, chat records, and advertised returns to IC3. Contact the exchange or wallet provider through its official website. Avoid anyone who promises to recover your crypto for an upfront fee. Recovery scams often target people who have already reported a loss.
A fake job or employment website
Save the job listing, recruiter messages, requested documents, payment instructions, and any application URL. Report the listing to the job platform and the impersonated employer. Add the FTC, and add IC3 if money or personal information was involved.
An AI-generated scam
Use the same reporting channels as any other fraud. In your description, identify synthetic or altered elements such as a fake executive video, cloned voice, generated testimonials, fabricated reviews, or an AI-written support conversation. Preserve the original advertisement, profile, message, and any ad or post identifier. An AI-detection result can be supporting context, but it shouldn't replace the screenshots and transaction record.
A website copying your business or content
Contact the impersonated business through its official website. If you own the copied material, ask the host or platform about its copyright or trademark complaint process. A copyright notice is generally for a rights holder or authorized agent. It isn't a universal way for a consumer to remove a scam site.
What happens after you report it?
Keep confirmation numbers, submitted narratives, provider replies, and dates in one folder. If the scammer sends new messages or changes domains, add the new information through the relevant channel.
You might see a browser warning, an advertisement or account review, or a registrar or host investigation. Your report might also be folded into a larger law-enforcement case. None of those outcomes is guaranteed, and a website can disappear without explanation. IC3 says it cannot respond directly to every submission.
Continue monitoring your bank and card accounts, email, and credit reports. Be skeptical of anyone who contacts you claiming to be an investigator and then asks for a fee, gift card, remote access, or cryptocurrency to recover your money.
Common questions
Should I report a scam website if I didn't lose money?
Yes. A suspected phishing or malware page can be reported even when you didn't enter information or send money. Explain that you encountered an attempted scam and describe what the page requested.
Should I report to the FTC or IC3?
You can use both when the conduct involved an internet-enabled crime. The FTC gathers consumer-fraud reports for analysis and enforcement, while IC3 collects cybercrime complaints for the FBI and its law-enforcement partners. Use your bank or payment provider separately if you need financial recovery.
Will reporting remove the scam website?
Not necessarily. Google or Microsoft may use a report to review an unsafe-site warning, and a registrar or host may review an abuse complaint. Only the relevant provider or legal process can determine whether content or a domain is removed.
Can ICANN take down the domain?
Usually not. ICANN's role is limited by its contracts and policies, and its complaint process generally doesn't cover country-code domains. Start with the registrar and hosting provider, then use the appropriate government reporting route.
What if I live outside the United States?
These agency routes are U.S.-focused. If you live elsewhere, report the incident to your national fraud or cybercrime authority and your local police when appropriate. You can still contact the relevant bank, card issuer, payment service, registrar, host, and browser company.
If money already left your account, call the number on your card or statement now with the transaction details, then file the FTC report and, if the scam ran over the internet, the IC3 complaint using the URL and evidence you already saved.