Knowing how to report a scam is only part of an effective response. This guide shows where to report online fraud, what evidence to preserve, how to handle suspected malware safely, and how to assemble a reusable evidence packet for banks, platforms, employers, consumer-protection agencies, and law enforcement.
Overview
Report a scam as soon as practical, but do not rush in a way that destroys evidence or exposes you to further risk. Your first priorities are to stop communicating with the suspected fraudster, protect affected accounts, contact the organization connected to the payment or account, and preserve a clear record of what happened.
The correct reporting destination depends on the incident. A fraudulent card transaction should go to the card issuer or bank. A phishing message should be reported to the impersonated organization, the email or messaging platform, and an appropriate consumer-protection or cybercrime reporting channel. A workplace payment diversion may require immediate escalation to your security, finance, legal, and executive teams as well as the bank involved.
Reporting does not guarantee that money will be recovered or that a platform will remove content. It does create a documented record, may help an institution investigate, and can contribute to broader fraud intelligence. Use official contact details that you find independently rather than phone numbers, links, or reply addresses supplied by the suspected scammer.
Where to report a scam
| Reporting destination | Use it for | What to provide |
|---|---|---|
| Bank, card issuer, or payment provider | Unauthorized transactions, payment diversions, account takeover, and suspected fraud | Transaction details, dates, amounts, recipient information, and whether you authorized or disputed the payment |
| Website, marketplace, social network, email, or messaging platform | Fake listings, impersonation profiles, phishing messages, abusive accounts, and malicious links | Profile or listing URL, username, message IDs if available, screenshots, and a concise explanation |
| Employer or internal security team | Business email compromise, fake invoices, payroll changes, stolen credentials, and malware incidents | Timeline, affected accounts, original messages, payment instructions, and actions already taken |
| Consumer-protection agency | Consumer fraud, deceptive businesses, recurring scam patterns, and identity-related complaints | Business or sender identity, contact details, loss information, supporting documents, and a narrative of events |
| Cybercrime reporting channel | Significant online fraud, coordinated phishing, account compromise, or suspected criminal activity | Technical indicators, payment records, domains, usernames, email headers, wallet addresses, and chronology |
| Local law enforcement | Immediate threats, theft, extortion, stalking, substantial loss, or a case requiring a local report | Identification, incident timeline, loss details, threats, and copies of relevant evidence |
Agency names, intake forms, eligibility rules, and contact methods vary by country and can change. For a United States incident, people commonly check the Federal Trade Commission for consumer fraud reporting, the FBI's Internet Crime Complaint Center for online crime reporting, their state consumer-protection office, and local police when a local report is appropriate. Verify current instructions on each organization's official website before submitting sensitive information.
What to track
Good evidence answers five questions: who contacted you, what they asked you to do, how you responded, what was lost or exposed, and when each event occurred. Preserve original files where possible, not only copied text or cropped screenshots.
Scam reporting checklist
- Timeline: Record the date, time zone, communication channel, and a short description of every important event.
- Sender and account identifiers: Save phone numbers, email addresses, display names, usernames, profile URLs, seller IDs, payment handles, and cryptocurrency wallet addresses.
- URLs and domains: Copy the complete link without opening it. Include redirects or shortened links if they are visible. A URL can be useful even when a site later disappears.
- Messages and headers: Export or preserve the original email, attachments, text messages, and relevant email headers. Do not rely only on a screenshot when the platform provides an export option.
- Screenshots: Capture the full conversation or page, including the account name, date, URL, payment instructions, and surrounding context. Keep the original image files and note when each screenshot was taken.
- Payment records: Gather statements, confirmation numbers, invoices, receipts, wire details, gift-card information, payment-app records, and the recipient's details. Redact unrelated account numbers before sharing broadly.
- Identity and account impact: Note credentials entered, personal information disclosed, devices used, account changes, suspicious login alerts, and any identity documents sent.
- Actions taken: Log password resets, account freezes, bank calls, payment disputes, platform reports, malware scans, and case or confirmation numbers.
Handling suspected malware
If you opened an attachment, installed software, entered credentials into a suspicious page, or believe a device is compromised, avoid repeatedly opening the file or revisiting the site. Disconnect the affected device from networks when appropriate, use a separate trusted device to change important passwords, and contact your organization's security team if it is a work device. Preserve the suspicious email, file name, URL, and visible error messages, but do not forward a potentially malicious attachment to colleagues or reporting forms unless the recipient specifically instructs you to do so.
For link verification, see the URL and website verification checklist. If you already clicked a phishing link, follow the account recovery and fraud response plan.
Printable evidence packet template
Copy this outline into a document and complete it before submitting reports:
Incident title: Date discovered: Affected person or organization: Suspected scam type: One-paragraph summary: Timeline: - Date/time — event — channel — action taken Sender and account details: - Name, username, phone, email, URL, payment handle Payment or loss details: - Date, amount, method, recipient, confirmation number Information or access exposed: - Credentials, identity data, device, account, attachment Evidence preserved: - Screenshots, original messages, headers, URLs, statements, files Reports submitted: - Organization, date, case number, next step Security actions completed: - Password reset, session revocation, payment dispute, device review
Cadence and checkpoints
Use a two-stage reporting workflow. During the first response, contact the payment provider and secure affected accounts. Then submit platform, employer, consumer-protection, cybercrime, and law-enforcement reports that fit the incident. Keep every confirmation number in the evidence packet.
Check the case status according to the instructions provided by each organization, but avoid sending repeated submissions that fragment the record. If a bank, platform, or employer asks for additional documentation, provide only what is needed through its verified channel. For a business incident, preserve logs and coordinate communications through the designated incident-response process.
Review this reporting checklist quarterly if you manage a team, security program, marketplace, or fraud-response process. Confirm that internal escalation contacts, platform report paths, official agency links, and evidence-retention procedures still work. Consumer reporting forms and submission requirements can change, so verify them when an incident occurs rather than relying on an old bookmark.
How to interpret changes
A scammer deleting a profile, changing a domain, or switching phone numbers does not make the original evidence useless. Record the change and retain the earlier identifiers. Multiple related reports may become more useful when they show a repeated pattern, such as the same payment account, domain structure, script, invoice format, or impersonated brand.
Separate confirmed facts from assumptions. Write “the message claimed to be from the bank” rather than “the bank sent the message,” and distinguish an unauthorized payment from a payment you made after being deceived. This precision helps the receiving organization route the report and reduces confusion during a dispute or investigation.
Do not publish private evidence publicly to warn others. Remove account numbers, identity documents, addresses, private phone numbers, authentication codes, and access tokens before sharing a redacted warning. For suspicious phone numbers, email addresses, or senders, use this verification guide. For business payment changes, consult the fake invoice and BEC verification playbook.
When to revisit
Revisit your report whenever new information appears: a second message arrives, a payment posts, an account is accessed again, a platform requests clarification, or another victim identifies the same sender. Add the new event to the timeline instead of creating a disconnected narrative.
For an individual incident, set a reminder to check open bank disputes, account-security alerts, and submitted case numbers. For an organization, review the evidence packet and reporting contacts at least quarterly, and after any change to payment systems, identity providers, email platforms, or incident-response ownership.
Before closing the incident, confirm that passwords and recovery details were updated, active sessions were reviewed, payment channels were notified, suspicious devices or software were assessed, and relevant reports received a confirmation number. Keep a secure copy of the final packet and a short lessons-learned note. The next scam report will be faster and more complete if the evidence process is ready before the next message arrives.
