How to report an online scam - and what happens after you report it

Most guides tell you where to report a scam and stop there. The more useful question is what a report actually does — because the honest answer changes what you do first.

The short version

Reporting a scam to a government agency is not how you get your money back. The agencies say so themselves. Reporting matters for a different reason, and it is worth doing. But there is a separate call that affects your own money, and it needs to happen first.

Step 1 — call whoever moved the money

The protections you have depend almost entirely on how you paid. The FTC publishes guidance per payment method, and the differences are large:

Two things are worth saying plainly. First, gift cards are not a lost cause — the FTC's advice is to call the issuer, explain that a scammer tricked you into giving them the number and PIN, and keep the card and the receipt. Second, cryptocurrency payments, in the FTC's words, "don't have the same legal protections as credit and debit cards". That is a reason to move faster, not a reason to skip the call.

If you handed over a password or a verification code rather than money, that is a different emergency with a different sequence — what to do after giving a scammer your password covers it.

Step 2 — where to report, and which one to use

In the United States there are three destinations, and they are not interchangeable.

ReportFraud.ftc.gov — for scams and fraud

The general-purpose front door. Any scam, any amount, whether or not you lost money. The form walks you through what happened and, at the end, gives you tailored next steps based on how you paid.

IC3.gov — for internet crime

The FBI's Internet Crime Complaint Center. Use it for things that are crimes against a computer or account as well as against your wallet: hacking, account takeover, extortion, ransomware, business email compromise, and any online fraud involving a significant sum.

IdentityTheft.gov — if your details were used

Not just exposed — used. Someone opened an account, filed a tax return, or claimed benefits in your name. This site is different from the other two because it does something for you: it generates a personal recovery plan, pre-filled letters and an FTC Identity Theft Report you can hand to creditors.

What actually happens to your report

This is the part almost nobody explains, and it is why people conclude that reporting is pointless.

Your report joins a database, not a queue. The FTC enters reports into Consumer Sentinel, a secure database it makes available to more than 2,000 law enforcement partners. Investigators search it the way you would search anything — by phone number, by domain, by payment account — looking for the same details appearing across many reports.

No individual case is opened for you. The FTC states that it cannot resolve reports on behalf of individuals. IC3 is blunter still: it "does not conduct investigations and, therefore, is not able to provide the investigative status of a previously filed complaint", and "you will not hear from the IC3".

Analysts do read them. IC3 says trained analysts review and research complaints and pass information to law enforcement and partner agencies. Whether anything is investigated is at the discretion of whoever receives it.

Sometimes money comes back later, to a group. FTC enforcement actions occasionally produce redress. Under its Impersonation Rule, in force since April 2024, the FTC reported over $70 million recovered for consumers across a dozen actions. That money reaches people months or years afterwards, and not because of any one report.

The one place speed genuinely changes the outcome

If a large sum left by wire transfer, the timing of your IC3 report matters enormously.

The FBI runs a Recovery Asset Team, set up in 2018, which works with banks to freeze fraudulent transfers before the money is moved on. Its process is called the Financial Fraud Kill Chain. In 2025 the FBI initiated roughly 3,900 of these interventions and froze more than $679 million, a success rate of about 58%.

It only works on fresh reports. The window is measured in hours and days, not weeks, and it generally applies to larger domestic wires. If you have wired a significant amount and realised within a day or two, file at IC3.gov immediately and tell your bank you want the wire recalled — those two actions together are what feed the process.

What to put in the report

Have this ready before you start. Both forms ask for most of it:

• Dates — when contact began, when you paid
• Amounts and how you paid, including the transaction or reference number
• The scammer's contact details — phone number, email address, website domain, social media handle, wallet address
• The account the money went to, if you can see it
• What was said, in your own words, including the pretext they used
• Screenshots and full email headers where relevant

Write the sequence of events plainly. Analysts are pattern-matching across thousands of reports; the exact domain and the exact payment account are worth more than adjectives.

Report it to the platform as well

Government reports are slow by design. Platform reports are fast and often the only thing that removes the scam from circulation:

• A fake website — report it to the hosting provider and to Google Safe Browsing; also tell the brand being impersonated, which usually has a phishing@ or abuse@ address
• A scam text — forward it to 7726 (spells SPAM), free in the US and UK, then use your phone's Report Junk option
• A phishing email — use your mail client's Report Phishing button, which trains the filter for everyone
• A fake profile or advert — report inside the platform, using the impersonation category rather than the generic spam one

Reporting outside the United States

US agencies accept reports from anywhere, but your own country's body is the one that can refer a case to your police and apply your consumer law. Use the official one:

If your country is not listed, search for your national consumer protection agency or cybercrime reporting centre — and reach it by typing the address yourself, not through a link in a search advert.

Expect the second approach

The tell is simple and it never changes: nobody legitimate charges you a fee to return your own money.

Should you report if you are embarrassed?

Yes, and the embarrassment is worth naming because it is the single biggest reason scams go unreported. The FBI logged over a million complaints in 2025 and $20.9 billion in losses — and those are only the people who filed. The real figures are higher.

These operations are professional, well resourced and run at industrial scale. Being targeted by one is not a character flaw, and the person taking your report has seen the same script hundreds of times. If you want the broader signals that identify a scam before money moves, how to tell if an online scam is real is the companion to this page, and the online scams overview covers the main categories.