If a scam website took your money, contact the payment provider first. Call your bank, card issuer, PayPal, gift card company, cryptocurrency exchange, or transfer service using an official phone number or app. Then preserve your evidence and report the website.
An FTC or IC3 complaint can help authorities identify patterns and support enforcement. Filing a report does not reverse a payment or guarantee a refund. The models below are original, copy-ready examples for U.S. consumers. Replace every bracketed section with facts you can support.
What to do after a scam website payment
Act quickly, but don't wait for one agency to respond before contacting another.
- Stop communicating with the site. Don't send more money, identification, passwords, one-time codes, or cryptocurrency to "unlock" a refund or order.
- Contact the payment provider immediately. Use the number on your card, bank statement, or the provider's official website, not contact details supplied by the suspected scammer.
- Save evidence. Capture the website, order page, checkout screen, emails, messages, receipts, transaction records, and promised delivery terms.
- Secure exposed accounts. Change any reused password, turn on multifactor authentication, and ask your card issuer whether the card should be replaced.
- File the appropriate reports. Use the FTC for consumer fraud, IC3 for cyber-enabled crime, and the site's host, registrar, browser-safety service, advertising platform, or marketplace where relevant.
If you downloaded a file or entered a password on a suspicious page, avoid using that password elsewhere until you've changed it from a trusted device.
Build an evidence packet
A clear timeline is more useful than an angry or lengthy complaint. Put these details in one document before you submit anything:
- The complete website address, including the page where you paid
- The date and time you found the site and placed the order
- How you found it, such as a search result, social media post, email, or online ad
- The product or service, advertised price, shipping promise, and refund terms
- The amount paid, currency, payment method, and transaction or order number
- The seller's name, email address, phone number, and any address shown on the site
- Dates and results of your contact attempts
- Screenshots showing the site, checkout page, tracking information, fake contact details, or changing prices
- Bank, card, PayPal, transfer, gift card, or cryptocurrency records
- Any personal information you entered, described by type rather than by copying the sensitive value
Don't include a full card number, security code, password, authentication code, Social Security number, or cryptocurrency recovery phrase unless an official form specifically requires it and provides a secure way to submit it.
The FTC's online shopping guidance says that if a seller doesn't promise a shipping time, it generally has to ship within 30 days after receiving the buyer's name, address, and payment or permission to charge. Save the seller's promised delivery date as well as that 30-day point. The shipping rule can support a payment dispute. It does not itself make a scammer refund you.
Which complaint route should you use?
| Route | Best use | What to expect |
|---|---|---|
| FTC ReportFraud | Fake stores, impersonation, deceptive advertising, and other consumer scams | The report gives information to the FTC and may support enforcement. It isn't a chargeback request. |
| IC3 complaint form | Phishing, fake websites, online payment fraud, account compromise, and other cyber-enabled crimes | IC3 shares reports with law enforcement partners. It says it cannot respond directly to every submission. |
| Bank or card issuer | A possible reversal, billing dispute, fraud claim, or account protection | The provider applies its own procedures, evidence requirements, and deadlines. |
| PayPal or another payment platform | A transaction made through that platform | Eligibility and dispute deadlines are controlled by the platform's current terms. |
| Website host or domain registrar | A fraudulent site that remains online | The provider may review an abuse complaint, but a takedown is not guaranteed. |
| Google Safe Browsing or an advertising platform | Phishing, impersonation, or a malicious advertisement | A safety report may help warn users or remove an ad. It does not recover money. |
| BBB, if a genuine business profile exists | A factual public complaint or review | It may warn other consumers, but it is not a regulator and doesn't replace a payment dispute. |
Use more than one route when appropriate, and keep the facts consistent. A report to the FTC or IC3 does not extend a PayPal or bank deadline.
Scam website complaint examples and templates
Don't state that a person was arrested, an IP address was traced, or a law was violated unless you have reliable evidence. Keep the narrative chronological. If you authorized the transaction but the goods never arrived, say that accurately. Don't call it an unauthorized card transaction unless someone used the card without your permission.
FTC complaint example
Submit the complaint through ReportFraud.ftc.gov. The FTC's reporting walkthrough says the form asks about the date, amount, payment method, and how you first heard about the scam. After submitting, save the report number and any next-step information.
On [date], I found the website [full website address] through [search result, advertisement, email, social media post, or other source]. I ordered [product or service] for [amount] on [date]. The site promised [delivery date, service, refund, or other representation]. I paid using [payment method], and the transaction or order number is [number].
As of [date], I have [not received the order, received a different item, received a counterfeit item, or experienced another problem]. I contacted the seller on [dates] through [email, phone, or chat], but [describe the response or lack of response]. I believe the site may be fraudulent because [list objective facts, such as the site disappearing, false tracking, copied branding, or unusable contact information].
I have screenshots of the website and checkout page, the order confirmation, payment record, communications, and shipping information. I also entered [type of information] on the site. I have not included passwords or full payment details in this narrative.
IC3 complaint example
Use IC3's complaint form when the incident involved a phishing email, fake login page, malicious link, online payment fraud, stolen credentials, or another internet-enabled crime.
I am reporting suspected cyber-enabled fraud involving [website address]. On [date], I received [an email, text message, social media message, or advertisement] that appeared to come from [brand or organization]. It directed me to [website address].
I [entered login information, entered payment information, placed an order, or sent money] on [date]. The amount was [amount], paid through [payment method], with transaction reference [number]. The site [did not provide the product, displayed a fake account warning, redirected me, or stopped responding].
Information exposed: [type of information only]. Relevant evidence includes the original message, full email headers if available, screenshots, website addresses, payment records, usernames used, and communications with the sender. The suspected loss is [amount]. I reported the payment to [bank, card issuer, or platform] on [date] under case number [number].
IC3 is an information-sharing and reporting channel, not a customer-service desk. The IC3 website says that the volume of complaints means it can't respond directly to every person. Keep your confirmation and provide it to your bank or local law-enforcement contact if requested.
Website host or registrar abuse complaint
A website can use one company for hosting and another for domain registration. Look up the domain's registration information and send a factual notice to the listed abuse contact. If you can identify both providers, report the site to each one.
Subject: Abuse report for suspected fraudulent website: [domain]
Hello,
Please review [full website address] under your abuse policy. The site offered [product or service] and accepted payment on [date]. After payment, [describe the non-delivery, fake tracking, impersonation, phishing, or other conduct].
Relevant details:
- Domain: [domain]
- Page or URL: [full address]
- Date discovered: [date]
- Amount paid: [amount and payment method]
- Seller contact details shown: [email, phone, or address]
- Evidence available: [screenshots, receipt, messages, and payment record]
Please investigate and take any action required under your abuse policy. Please confirm receipt if possible. I can provide additional evidence through a secure channel.
Thank you, [name] [email address]
Don't attach executable files or send unnecessary personal information. A host or registrar may decline to act, ask for more evidence, or direct you elsewhere.
Short phishing report
If the site imitates a bank, retailer, delivery company, government office, or another known brand and asks for a password or payment information, report the address through Google Safe Browsing. Also report the message or advertisement inside the email, social media, search, or advertising platform where you saw it.
Use wording such as:
This page at [full address] appears to impersonate [brand]. It was reached through [email, ad, or message] and asked visitors to enter [login or payment information]. The legitimate brand's website is [official website, if known]. Screenshots and the original message are available.
Don't visit the page repeatedly just to test it. Report the exact address you received.
How to file the reports
Go to ReportFraud.ftc.gov and describe what happened in plain language: how you first encountered the site, what it promised, when and how much you paid, what happened after payment, the seller's contact information, and any information you entered or loss you experienced. Save the confirmation or report number. The FTC report is useful even if the amount was small, because multiple reports can reveal a wider pattern. It doesn't substitute for contacting your bank or payment provider.
Use IC3 for phishing, fake login pages, online fraud, stolen credentials, and other cyber-enabled conduct. Include the website address, the message or ad that led you there, payment details, transaction identifiers, and a timeline. If your account is still being accessed, money is moving, or someone is threatening you, contact the affected provider and local law enforcement immediately. The FBI's cyber guidance directs victims of cyber-enabled crime to IC3 and provides routes for contacting the FBI.
Send the abuse template to the provider identified in the domain or hosting records. Include the exact page, not just the brand name, and explain whether the site is selling goods it doesn't deliver, impersonating a company, collecting credentials, or distributing malware. A provider's decision is separate from your financial dispute. A site can be removed while a payment claim is denied, and a site can remain online while a bank investigates your transaction.
If an advertisement led you to the site, report the ad and account through the platform where it appeared. If you purchased through a marketplace, open the marketplace's order dispute as well as contacting your payment provider. Save the listing before it disappears.
If the seller has a legitimate-looking BBB profile or business listing, a concise, factual complaint can warn other shoppers. Use dates, amounts, and documented communications. Don't publish your full transaction details, personal information, or accusations you can't support.
How to try to recover the money
The payment rail controls the practical recovery process. Contact the provider even if you have already filed with the FTC or IC3.
| Payment method | What to do now | Key limitation |
|---|---|---|
| Credit card | Call the issuer and ask how to dispute a non-delivery, misrepresentation, or unauthorized transaction. Use the reason that accurately describes what happened. | Dispute procedures and deadlines vary. Ask what documents and written statement are required. |
| Debit card | Report the transaction to your bank or credit union immediately. The FTC specifically advises doing this if someone used the debit card without authorization or if you were tricked into paying with it. | A transaction you authorized after being deceived may be handled differently from an unauthorized transaction. Explain the facts precisely. |
| PayPal | Open a dispute through the transaction as soon as possible and follow the current PayPal Purchase Protection terms. | PayPal says a dispute must be opened within 180 days of payment and, where applicable, within 30 days of delivery or fulfillment, whichever is sooner. Eligibility and claim requirements still apply. |
| Bank transfer or wire | Contact the sending bank or service immediately, request a fraud review, and ask whether a stop or recall is possible. Provide the recipient details and transaction reference. | A recall isn't guaranteed, especially after funds have moved through several accounts. |
| Peer-to-peer payment app | Report the transaction in the app and contact the linked bank or card issuer. Save the recipient username, confirmation number, and messages. | The provider's rules and the timing of the report affect what options may be available. |
| Gift card | Contact the gift card issuer immediately and provide the receipt, card number, purchase date, and transaction details through the issuer's official channel. | Don't send another gift card or pay a fee to someone promising recovery. |
| Cryptocurrency | Contact the exchange or service you used immediately. Provide the transaction hash, wallet address, amount, and date. | The FTC's scam guidance warns that cryptocurrency sent to a scammer may already be gone. |
When you call a bank or issuer, ask for the case number, the submission deadline, the documents it needs, and how to respond if the claim is denied. Don't close the dispute just because the seller sends a new promise to ship. Keep the provider updated with new evidence.
Protect yourself after entering information
A fake store may be trying to collect more than a payment. Take the following steps if they apply:
- Change the password used on the site anywhere else, beginning with email and financial accounts.
- Turn on multifactor authentication, preferably using an authenticator app or security key where available.
- Ask the card issuer whether replacing the card is appropriate if you entered card details.
- Review bank and card statements for small test charges and recurring charges.
- Contact the relevant account provider if you entered bank credentials, an authentication code, or identity information.
- Keep monitoring accounts after the initial dispute; scammers may use information later.
The padlock or HTTPS connection doesn't prove that a seller is genuine. Encryption helps protect information while it travels between your browser and the site, but it doesn't verify the site's owner or business practices. Use the FTC's online shopping guidance to check seller information, total cost, delivery terms, and return policies before paying.
How to make a complaint more effective
Reviewers need a short, consistent timeline: the site, product, and promise; dates for the ad, order, payment, delivery deadline, and contact attempts; the amount and payment method; observable facts that make the site look fraudulent or deceptive; and the screenshots, records, and messages you retained.
Avoid long arguments, threats, speculation about the scammer's location, or copied complaints from other people. Don't exaggerate the loss.
Common questions
Does an FTC complaint get my money back?
Not by itself. The FTC accepts fraud reports for consumer-protection purposes, while the bank, card issuer, PayPal, or other payment provider handles the transaction dispute. Contact the provider immediately and keep the FTC confirmation for your records.
Should I report a fake store to both the FTC and IC3?
Usually, yes, if the website involved online fraud, phishing, impersonation, or stolen information. The FTC is the broad consumer-fraud route. IC3 is intended for cyber-enabled crime. Submit the same accurate timeline to both and retain each confirmation.
Can I still dispute a payment if the scam website has disappeared?
Yes. Contact the payment provider anyway. A closed website doesn't prove that recovery is possible, but your order record, payment confirmation, screenshots, and communications can still support the provider's review. Ask about the applicable deadline rather than waiting for the site to return.
What if someone offers to recover my money?
Treat unsolicited recovery offers with caution, especially if the person claims to represent the FTC, IC3, FBI, a bank, or a cryptocurrency investigator and demands an upfront fee, remote access, passwords, or cryptocurrency. Use only contact information from the institution's official website or your payment statement.
Is a complaint enough to shut down a scam website?
No. A host, registrar, browser-safety service, advertising platform, or law-enforcement agency decides what action it can take. Report the site with precise evidence, but continue your payment dispute and account-protection steps even if the website is removed.
Keep your report numbers, payment case numbers, and evidence in one folder. The next useful action is the one with the shortest deadline: contact the payment provider today, then submit the FTC or IC3 report with the same documented facts.