">

If you can't verify a website, don't sign in or pay. What its operator claims to earn is beside the point.

Phishing uses messages and malicious websites to impersonate trusted organizations. Banks, retailers, delivery services, employers, and investment platforms can be copied. That pattern is described by CISA and NIST. A convincing design proves little.

If you've clicked, shared information, or paid, start now. Contact the relevant provider through an official channel, save the evidence, and report what happened. Your payment method determines the next move.

These instructions are for U.S. consumers. Other countries may use different deadlines and reporting systems.

Check a website before you sign in or pay

Use the address bar before trusting the page. Type the organization's known address yourself, or open its app. Unexpected login links can wait.

Study the domain name. An extra letter, strange ending, or added word may separate the real site from an imitation. For a phone number, use one from your card, statement, or existing account, never from the suspicious message.

Check Warning sign Safer move
Web address Misspellings, extra words, or an unfamiliar domain Close the page and type the known address yourself
Login request An unexpected demand for a password, Social Security number, or one-time code Contact the organization through its official app or published contact channel
Payment request Pressure to use a gift card, cryptocurrency, wire, or payment app Stop and verify the request independently
Offer Guaranteed returns, surprise prizes, or a job requiring upfront payment Look for written terms and confirm the business independently
Contact details Only a chat box, disposable email, or unverifiable address Find contact information outside the message or website

HTTPS protects the connection between your browser and the site. It doesn't establish who runs the site or whether the offer is honest. A high search result and copied reviews aren't independent verification.

Turns out, the strongest check is usually dull: leave the page, use a separate channel, and ask whether the request is real.

Red flags that deserve a hard stop

One odd detail might be a mistake. Several warnings together are enough to leave.

An unexpected password or security-code request is a hard stop. Verify it through a channel you found separately.

What to do after clicking, sharing information, or paying

After a click, credential entry, or payment, move quickly. Don't panic. The steps overlap. That's okay.

  1. End the interaction. Close the page. Don't download files, call numbers shown there, or continue the chat.
  2. Secure your accounts. If you entered a password, change it through the real website or official app. Change it anywhere else you reused it, then turn on multifactor authentication where available.
  3. Call your financial provider. Use the number on your card, statement, or banking app. Tell the provider what happened, when it happened, and which information or transaction was involved. Ask how to secure the account and open the appropriate dispute or fraud claim.
  4. Contact the payment service immediately. For a debit payment, call the bank or credit union. For a gift card, contact the issuer. For cryptocurrency, contact the exchange or service involved. If you used a wire or payment app, ask whether a recall, freeze, or reversal is possible. Recovery isn't guaranteed.
  5. Save the evidence. Keep the full web address, messages, emails, screenshots, receipts, transaction records, wallet addresses, and case numbers. Write down when you made each call.
  6. Report the incident. Start with the FTC's guidance for people who were scammed, then submit cybercrime information through the IC3 complaint form.

If you downloaded a file, avoid entering sensitive information on that device until current security software or a qualified professional has checked it.

Which payment protections may apply

Regulation E covers certain unauthorized electronic fund transfers from consumer accounts. It isn't a blanket promise that every scam payment will be refunded.

The federal rule at 12 CFR 1005.6 and the CFPB's consumer guidance set important notice rules.

Situation What generally matters What to do
A covered unauthorized transfer follows loss or theft of an access device Notice within two business days can limit liability to the lesser of $50 or the amount of unauthorized transfers before notice Notify the bank immediately and ask for its claim instructions
Notice comes after two business days The rule can allow higher potential liability, including a separate limit of up to $500 under its formula Report it anyway; delay does not make reporting pointless
An unauthorized transfer appears on a statement The bank generally must be notified within 60 days of the statement showing it Check statements and keep proof of when you gave notice
You approved a payment because a scammer deceived you The answer can depend on the payment rail and facts; it isn't automatically the same as an unauthorized transfer Ask the provider which dispute process applies and preserve the scam evidence

Thing is, a payment you approved after deception can raise a different question from a transfer made by someone who used your account without permission. Credit cards, bank transfers, payment apps, wires, gift cards, and cryptocurrency may all use different procedures.

If the bank asks for written confirmation, meet its deadline. The CFPB says a bank or credit union may not have to provide temporary credit during its investigation if it doesn't receive that confirmation within 10 business days.

Use this as general consumer information, not legal advice. Ask the institution to identify the payment rail, the deadline, and the documents it needs.

Reporting and escalation

Reporting the incident and securing the account are separate tasks. Call the bank, card issuer, or payment company before relying on an online complaint form. A report creates a record, but it doesn't replace a request to secure the account or stop a transaction.

The FTC's guidance covers debit payments, gift cards, cryptocurrency, and other scam situations. It also warns that the money may already be gone. Contact the payment provider without waiting for a perfect explanation.

IC3 accepts complaints about cyber-enabled crime, including from people affected outside the United States. Its trained analysts review complaints and share information with law enforcement and partner agencies when appropriate. IC3 doesn't conduct individual investigations or provide the status of a submitted complaint, so keep the bank or payment-provider case number separately.

People sometimes wait because they're embarrassed. Don't wait. An early, clear report gives the provider better information while more options may still exist.

Questions people ask after finding a suspicious site

Does HTTPS mean a website is safe?

No. HTTPS helps secure the connection between your browser and the site. It doesn't verify who operates the site or whether its offer is legitimate.

Will my bank refund a payment sent to a scammer?

Possibly, but no automatic refund covers every scam. The result may depend on whether the transfer was unauthorized, which payment method you used, when you reported it, and what evidence exists. Contact the provider immediately.

Should I report a site if I did not lose money?

Yes. Save the address and message, notify the impersonated organization when possible, and use the FTC or IC3 reporting channels. If you submitted credentials, secure the account even if no charge appears.

If the suspicious page is still open, close it now. Open your bank's app or type its address yourself, then call the number on your card or statement. Write down when you reported the incident.