A complaint letter about a scam website is a dated record you send to a U.S. agency, a host, or a registrar with the URL and the proof. Keep the letter short and specific.
Will a letter get your money back? No.
The FTC and the FBI's Internet Crime Complaint Center (IC3) collect these reports to map patterns. They don't run a refund window.
If you already paid, start with your bank, card issuer, gift card company, or crypto exchange, using the FTC steps for people who were scammed. Do that before you polish the letter.
The letter still has a job. It stops your story from turning into a vague note that nobody can act on.
Write the letter in this order
Work through this list once, in order, and resist the urge to turn a simple fraud report into a long manifesto. Save the extras for your own notes.
- Put your name, mailing address, email, and phone at the top.
- Add today's date.
- Name the recipient: FTC, IC3, a BBB office, an abuse desk, or a registrar.
- Write a subject line that includes the full URL.
- Describe the site in chronological order: how you found it, what it claimed, what you typed or paid.
- State the dollar amount, payment method, and dates.
- Number every attachment.
- Ask them to review the report. Don't demand a refund the agency cannot issue.
- Save a copy and note how you sent it.
One incident per letter is easier to follow than a stack of unrelated problems.
Sample complaint letter
Copy the block below into a document or an email, then fill every bracket with your own dates, URLs, and amounts. Attach every file you list.
[Your name]
[Street address]
[City, State ZIP]
[Email]
[Phone]
[Date]
[Recipient name]
[Agency or company]
[Address or abuse inbox]
Subject: Report of scam website [full URL]
I am reporting the website [full URL]. On [date], the site [impersonated a company / asked for a login / displayed a fake invoice / other], and I [paid, entered information, or left without paying].
I reached the page through [search result, email, text, ad, or QR code]. The page used [brand name, letter, invoice, or login form]. My loss is [amount or none]. I paid by [debit, credit, gift card, wire, crypto, or not applicable]. Reference numbers: [order, account, wallet, or none].
Please review this report and share it with the appropriate enforcement or abuse team. I can be reached at [email] or [phone].
Evidence enclosed:
1. Screenshot of the page showing the URL and time
2. Copy of the email, text, or invoice
3. Payment record
4. Domain lookup, if I have one
[Your name]What to attach
An agency or abuse desk can do very little with a URL you copied from memory and a screenshot that hides the address bar. Use the packing list below before you send.
- Full URL, not a shortened link
- Screenshots that show the address bar and a time
- The email, text, or invoice that sent you there
- Payment confirmation, last four of a card, gift card numbers, wallet address, or wire reference
- Dates and times in your time zone
- Names, phones, or chat handles the scammer used
- A saved copy of the page if you captured one before it vanished
If the page already vanished, say so and send what remains. You'll get further with screenshots than with adjectives.
Where U.S. consumers should send it
Pick the outlet that matches the problem.
| Place | Best use | Can do | Cannot do |
|---|---|---|---|
| FTC | Fake shops, impersonation, consumer scams | Add your report to enforcement data | Promise a takedown or a refund |
| IC3 | Phishing and other internet crime | Route a file to law enforcement | Investigate every case or recover funds |
| BBB | An identifiable U.S. business | Forward the complaint to that business | Compel a reply or seize a domain |
| Host or registrar | The server or domain behind the URL | Apply its own abuse rules | Act on a name it does not control |
| Bank, card issuer, gift card company, or exchange | Money you already sent | Sometimes limit further loss | Guarantee that you get paid back |
Reuse the same letter body and change only the recipient line.
Reporting to the FTC
U.S. consumers should file through the FTC's scam pages, which ask for the website, the story, and how money moved. Paper mail is not the main door.
Thing is, a signed copy is still worth keeping as a backup if a bank later asks what you reported.
Match it to the online form.
The Commission uses complaints to build larger cases, not to assign you a personal investigator for one URL.
Reporting phishing and internet crime to IC3
Anyone who believes a website ran a cyber-enabled crime can file a complaint with IC3, even if they live outside the United States or the scammer does. Trained analysts then review each file.
They forward useful reports to law enforcement. That is the whole pipeline.
The IC3 FAQ states the center does not investigate, will not give you a case status, and will not recover funds through law firms or crypto services. Don't wait for a case update.
If a site pretends to be IC3, report that impersonation in a new complaint.
When a BBB letter is worth the time
The Better Business Bureau is not a government agency. It forwards what you file to a business, often within two business days, and it may note whether that business answered.
It can't force anyone to pay you.
To be honest, a BBB letter is a weak tool against a throwaway phishing page that was never a real company. Use it for a real U.S. business.
That means a firm that billed you or ignored you. Don't park an impersonation report on the victim brand unless that brand took the payment.
Hosts, registrars, and ICANN
Look up who sold the domain and who hosts the site. Send the same evidence to that abuse inbox.
Turns out an abuse desk sometimes moves faster than a government form because it can disable a server it actually controls, though plenty of hosts ignore mail that lacks screenshots, a clear URL, and a plain description of the fraud, and some names are country-code domains that sit outside ICANN's contract so that path just stops.
Keep the abuse note short and factual.
For generic top-level domains, ICANN Contractual Compliance takes complaints about registrars and the contracts they signed. ICANN has no contractual authority over country-code domains such as .us, .eu, or .ac, so those names go to the ccTLD manager instead.
If money already left the account
Debit and card payments, gift cards, wires, and crypto follow different recovery paths, which the FTC splits out on its what to do if you were scammed page. Call the source the same day.
I mean the same day, not after you reformat it.
For a debit card, tell your bank or credit union right away if the charge was unauthorized or you were tricked into paying. Take the letter and the screenshots with you.
Gift card issuers want the card numbers fast. Crypto usually means contacting the exchange you used, not a random recovery site.
Wires are hard to reverse. The money might already be gone.
Send one report today with the URL and screenshots attached, then call the bank if a payment already went out. Keep the letter in the same folder as the evidence.