You can report a website in the United States if you reasonably believe it may be fraudulent, and you do not have to prove a crime first. Ask an agency or host to review it.
Can you flag a shady checkout page before anyone has charged a crime? Yes, if you describe what you saw and send that account to a place that actually reviews this kind of conduct.
Keep the report factual. Knowingly false accusations, published private information, harassment of an owner, or an effort to damage a business instead of describing events all raise your legal risk.
A complaint is not a finding of guilt. It also does not guarantee an investigation, a refund, or removal of the site. This is general U.S. consumer information, not legal advice. State laws and each reporting channel's rules can differ.
Protect yourself before reporting the site
Protect money and accounts first.
Turns out the payment trail matters more than a polished write-up. If you paid by debit card, contact your bank or credit union immediately, and if you paid with a gift card, contact the gift card issuer, and if you sent cryptocurrency, contact the exchange or service you used, taking phone numbers and URLs from an official app, statement, or website instead of any link the suspected scammer sent.
The Federal Trade Commission's scam recovery guidance covers those payment-specific steps. Recovery is not always possible.
Change any password you typed on that page, especially if you reuse it on email or banking, then do that work from a device you already trust. Turn on multifactor authentication if you can.
Do not keep testing the website. Another visit could expose more information or trigger a harmful download.
What kind of report are you making?
Different reports solve different parts of the problem. Your payment provider still needs its own fraud or dispute filing after an agency complaint.
| Channel | Main purpose | What to provide or do |
|---|---|---|
| FTC | Consumer fraud, deceptive sales, fake storefronts, and imposter businesses | Describe the offer, payment demand, contact methods, and what you received |
| FBI's IC3 | Cyber-enabled crime, including phishing, account takeover, online impersonation, and cryptocurrency fraud | Include the URL, messages, payment details, and a timeline |
| Bank or payment provider | Account protection and possible payment recovery | Contact the provider directly and promptly |
| Host, registrar, or platform | Review of reported website abuse under its own policy | Send the precise URL and the evidence you have |
| Public review or social post | Warning other consumers | Limit the statement to firsthand facts you can support |
| Hacking, denial-of-service attacks, or doxxing | Not a reporting option | Do not try to take the site down yourself |
An agency complaint asks someone to review conduct. File the payment report too if money moved.
Can you get sued for reporting a scam site?
Yes. A business or individual can threaten or file a lawsuit, including one that alleges defamation, and whether that claim has merit depends on the facts and the law of the state involved.
A message sent to a host, company, or platform is still a statement to a third party. A public post reaches a much larger audience.
Good faith is not automatic immunity. Some states may recognize protections for certain reports to appropriate authorities, but the coverage and limits vary.
Do not present a rumor as a fact. Do not accuse a named person of a crime when your records only show that a site took payment and did not deliver. Claims become harder to defend when the reporter knows they are false, ignores contrary evidence, or repeats allegations they cannot verify.
Write what you saw, sent, and received. For example:
On [date], I visited [full URL]. The page offered [product or service] and requested [payment or information]. I sent [amount and payment method], and then [what happened]. I am reporting these observations for review and attached [evidence].
That wording gives the recipient something concrete to assess. Do not write, "That website stole from everyone," unless you can support a claim that broad.
Evidence that makes a report useful
To be honest, you don't need a forensic lab file. You need a clear sequence of events and records that match it.
- [ ] The full website address, including the suspicious page or subdomain
- [ ] Screenshots showing the page, address bar, price, offer, or fake login prompt
- [ ] Emails, texts, social messages, receipts, order confirmations, and support replies
- [ ] Payment records, transaction IDs, wallet addresses, or gift card details
- [ ] Dates, times, amounts, and the name used by the site or seller
- [ ] A short explanation of what the site promised and what actually happened
- [ ] Report or ticket numbers from earlier contacts
Redact passwords, full card numbers, security codes, Social Security numbers, and recovery codes before sending copies. Keep the original messages and files privately rather than editing them.
Check the address with care. CISA's online shopping guidance advises shoppers to look for https in the browser address bar, but https alone does not show that a business is legitimate. Do not log in again just to improve your screenshots. Preserve what you already have and explain the rest.
Where to report a scam website in the U.S.
Use ReportFraud.gov for a fake store, deceptive website, imposter business, or other consumer fraud report to the FTC. Put the URL in the form. Add the claims it made, contact details, payment demands, and your loss if there was one.
Use the IC3 complaint form for phishing, online impersonation, account takeover, cryptocurrency fraud, or other cyber-enabled crime. The IC3 website says it shares reports with FBI field offices and law enforcement partners. It cannot respond directly to every submission.
Report the payment separately to your bank, card issuer, gift card company, cryptocurrency exchange, or other payment service. An agency report does not replace that step.
For an ongoing crime, threat to life, or national-security concern, follow the FBI's cyber reporting guidance. It directs people to an FBI field office or the FBI's tips service when appropriate.
A host, registrar, or platform may have an abuse or security reporting process on its own domain. That review follows the company's policy. It still does not replace a complaint to the FTC, IC3, or your payment provider.
Send one complete report to each relevant recipient. Repeated duplicates and coordinated mass-reporting can make review harder.
Is anonymous reporting legal?
Sometimes, but do not assume it.
The current form and its privacy notice control. Some agency, platform, and abuse forms let you leave out contact details. Others ask for them so staff can verify information or ask follow-up questions.
Anonymous and confidential are different things. An anonymous report does not identify you to the recipient. A confidential report identifies you but may limit how your information is shared.
Anonymous reports can make follow-up difficult. If retaliation worries you, use an official channel rather than posting publicly, and provide only information the form actually requires.
Never use another person's name or pretend to be a victim. That creates a separate problem.
A safe reporting workflow
Save what you already have, then file.
- Stop contact with the site. Do not send more money, documents, passwords, or verification codes.
- Protect affected accounts. Contact the payment provider and change exposed passwords before working on a complaint.
- Save what you already have. Keep URLs, messages, receipts, screenshots, and transaction records.
- Make a short timeline. Note when you found the site, what it promised, what you paid or shared, and what happened afterward.
- Separate facts from suspicions. Say that a page requested a wire transfer rather than claiming you know who operates it.
- Choose the right recipient. Use the FTC for consumer fraud, IC3 for cyber-enabled crime, and the payment provider for possible recovery.
- Save the confirmation. Put report numbers, submitted materials, and replies in one folder.
- Stop there. Do not hack the site, probe its systems, threaten its operator, or publish private information.
A first scam can lead to another one. Be wary of unexpected messages offering to recover money for a fee. The IC3 has warned about scammers who impersonate IC3 and related reporting services.
Public warnings require extra care
Thing is, a social media post is optional. A private report to the right organization usually keeps the audience much narrower.
If you decide to warn other consumers, write in the first person. Give the date, describe what the site advertised, say what you paid or received, and explain how the site responded.
Leave out an owner's home address, phone number, personal documents, and unsupported claims about criminal conduct. "I paid for an item on May 3 and never received it" states an experience. "The owner is a criminal" makes a much broader accusation.
Correct a public statement promptly if you learn it was wrong. A threatened lawsuit does not prove your report was unlawful. A serious demand deserves advice from a lawyer licensed in your state.
Are ordinary scam reports whistleblower disclosures?
Usually, no: a consumer complaint about a fake storefront is not automatically covered by every whistleblower law, and statutes such as the False Claims Act and Dodd-Frank have specific requirements that you should not assume apply to a private online purchase dispute. Anti-retaliation protections can depend on your job, the law involved, the recipient of the report, and the type of misconduct.
Common questions
Can I report a website if I am only suspicious?
Yes. Describe what you observed. Identify what you cannot verify. Ask the recipient to investigate. You do not need to declare that a crime has been proven.
Does an FTC or IC3 report get my money back?
Not by itself. Contact the payment provider immediately and follow its fraud or dispute process. Keep the agency report as a separate record.
Will reporting guarantee that the website is removed?
No. A host, registrar, browser, or platform uses its own review process. An agency may use the information without giving you a case update.
Can I report without giving my name?
Sometimes. Check the form's requirements and privacy notice before filing. Anonymity can limit follow-up.
Your next move
If money or login details were involved, contact the payment or account provider first. Then submit a factual FTC or IC3 report that fits what happened, attach your timeline and records, and save the confirmation number.