To report a fraudulent website, file complaints with the FTC at ReportFraud.ftc.gov and the FBI’s Internet Crime Complaint Center at complaint.ic3.gov, flag the site with Google Safe Browsing and Microsoft SmartScreen, and send an abuse report to the domain registrar and hosting provider identified through ICANN Lookup. If you paid money or handed over personal information, dispute the charges with your bank and lock down your credit the same day. No single report guarantees removal, but hitting every channel at once puts pressure on the scam from multiple directions.
Gather Your Evidence First
Every reporting channel asks for roughly the same information, so pulling it together upfront saves time and makes each complaint more credible. You want the exact URL, including any subdomains or unusual characters designed to mimic a real business, plus screenshots of the homepage, any pages where you entered information or paid, deceptive logos, fake contact details, and specific claims the site made. If the site vanishes before anyone acts, your screenshots may be the only proof it existed.
If a phishing email led you to the site, preserve the full email headers, not just the visible “From” line. In Gmail, open the message, click the three-dot menu next to Reply, and select “Show original.” In Outlook, open the message, click File, then Properties, and the headers appear in the “Internet headers” box.1Google Help. Trace an Email With Its Full Header Headers contain routing information investigators use to trace where the email actually originated.
If you lost money, keep every financial record: transaction dates, dollar amounts, payment method, confirmation emails, and any correspondence with the operators. Wire transfer receipts, cryptocurrency wallet addresses, and gift card numbers matter most, because those payment methods are the hardest to reverse. Put everything in one folder before you start filing.
File With the FTC and the FBI’s IC3
The two primary federal intake points are the Federal Trade Commission and the FBI’s Internet Crime Complaint Center. Neither agency will investigate your individual case or call you with updates. Both feed the databases that drive larger takedowns and prosecutions.
Federal Trade Commission
Start at ReportFraud.ftc.gov, the FTC’s centralized portal for fraud, scams, and deceptive business practices. The form walks you through what happened, how you were contacted, and what you lost. Once submitted, the FTC enters your report into Consumer Sentinel, a secure database used by civil and criminal law enforcement worldwide to spot patterns and build cases.2Federal Trade Commission. ReportFraud.ftc.gov Your individual situation won’t be resolved by the FTC, but when hundreds of people report the same site, that volume triggers enforcement.
FBI Internet Crime Complaint Center
File a separate complaint at complaint.ic3.gov. The IC3 focuses specifically on internet-enabled crime and routes complaints to federal, state, local, and international law enforcement based on the type of fraud involved.3Internet Crime Complaint Center (IC3). Complaint Form – Internet Crime Complaint Center (IC3) The form covers wire fraud, computer fraud, credit card fraud, identity theft, and other federal offenses. Filing the same incident with both the FTC and IC3 is not redundant. They maintain separate databases and route information to different investigators.
Report Specialized Scams to the Right Agency
Certain fraudulent sites fall under agencies beyond the FTC and FBI. Sending your report to the specialists puts it in front of investigators who focus on that exact type of scheme.
- Phishing sites. Forward the phishing email as an attachment to reportphishing@apwg.org. The Anti-Phishing Working Group archives submissions and shares the data with member institutions that track and dismantle phishing infrastructure.4Anti-Phishing Working Group. Report Phishing Emails Here to Warn the World
- Fake investment platforms and crypto scams. The SEC accepts tips through its online Tips, Complaints, and Referrals system. You get a confirmation number after submitting. Reportable activity includes Ponzi schemes, pyramid schemes, unregistered securities offerings, and high-yield investment fraud.5U.S. Securities and Exchange Commission. Report Suspected Securities Fraud or Wrongdoing
- U.S. Mail-related scams. If the fraud involved mail delivery, a package tracking ruse, or a suspicious message claiming to be from the Postal Service, forward it to spam@uspis.gov and then delete it.6United States Postal Inspection Service. Report a Crime
- State attorney general. Your state AG’s consumer protection division handles fraud complaints and can act under state consumer protection laws. Most offices take complaints online, and the National Association of Attorneys General maintains a directory at naag.org linking to every state’s portal.
Flag the Site With Search Engines and Browsers
Reporting to search engines and browser security teams is often the fastest way to cut off the scam’s traffic. When these platforms confirm a site is malicious, they display a full-screen warning that stops most visitors before they interact with the page. Search engines may also delist the domain, removing it from results entirely.
Google maintains separate report forms for different threat types through its Search Central portal. You can report phishing pages to the Google Safe Browsing team or flag sites distributing malware. Google notes that these reports don’t trigger direct manual action against every submission, but they feed into automated spam and abuse detection.7Google for Developers. Report Spam, Phishing, or Malware
Microsoft
Microsoft Security Intelligence accepts reports at microsoft.com/wdsi/support/report-unsafe-site-guest. You pick whether the site is phishing (impersonating another site to steal credentials) or malware, then submit up to 100 URLs at once.8Microsoft. Report an Unsafe Site – Microsoft Security Intelligence Confirmed threats produce warnings in Microsoft Edge and other products that use SmartScreen filtering.
Apple Safari
Safari uses its own fraudulent website warning system that alerts users when a site has been reported as deceptive or harmful.9Apple Support. Avoid Fraud by Using Encrypted Websites in Safari on Mac Safari’s warning database draws on multiple sources, so a report you file with Google Safe Browsing often reaches Safari users too.
Request Takedown From the Registrar and Host
Federal reports and browser warnings shrink a scam’s reach, but pulling the site offline usually requires action from the companies providing its infrastructure. This is where most fraudulent sites finally die.
First, identify who registered the domain and who hosts it. ICANN’s lookup tool at lookup.icann.org lets you enter any domain name and see its registration data, including the registrar’s name and abuse contact. ICANN requires every accredited registrar to publish a dedicated abuse email address and phone number, monitor that contact around the clock, and maintain documented procedures for handling abuse reports.10ICANN. Registrar Abuse Reports
Send a clear, evidence-packed report to that abuse contact. Include the fraudulent URL, your screenshots, transaction records if any, and a short description of the deceptive activity. Registrars and hosting providers have terms of service that prohibit fraud, and a documented complaint gives them grounds to act. If the registrar and host are different companies, report to both. The registrar can suspend the domain name itself, while the host can sever the site’s connection to its servers.
If the site is impersonating your brand or copying your copyrighted content, you have another tool: a DMCA takedown notice sent to the hosting provider. The notice must identify the copyrighted work, the infringing material and its location, and include a statement of good faith belief and accuracy under penalty of perjury. Hosting providers must act on valid DMCA notices to keep their safe harbor protection, which often makes this a faster route than a general abuse complaint when intellectual property theft is involved.
Protect Your Money and Identity
Reporting the site is half the job. If you entered financial or personal information on a fraudulent page, limit the damage now, not after the site comes down.
Dispute Unauthorized Charges
If you paid with a credit card, federal law caps your liability for unauthorized charges at $50. You have 60 days from the date the first statement showing the charge was sent to dispute the billing error in writing with your card issuer.11Consumer Advice – FTC. Using Credit Cards and Disputing Charges Most issuers have online dispute portals that beat mailing a letter, but the 60-day clock runs regardless of how you file. Debit card transactions have tighter deadlines and higher potential liability, so contact your bank immediately if a debit card was compromised. Reporting within two business days of discovering the fraud limits your exposure significantly.
Lock Down Your Credit
If you entered your Social Security number, date of birth, or other identity information, place a fraud alert or credit freeze with the three major credit bureaus. An initial fraud alert lasts one year and requires businesses to verify your identity before opening new accounts in your name. A credit freeze is stronger: it blocks all new credit applications until you lift it, lasts indefinitely, and costs nothing to place or remove.12Consumer Advice – FTC. Credit Freezes and Fraud Alerts Contacting one bureau for a fraud alert notifies the other two, but you must contact each bureau separately to place a freeze.
Build a Recovery Plan
For heavier identity exposure, IdentityTheft.gov is the federal government’s recovery tool. After you describe what happened, the site generates a personalized Identity Theft Report and a step-by-step recovery plan with pre-filled letters you can send to creditors and bureaus.13Federal Trade Commission. Identity Theft Recovery Steps Creating an account lets the site track your progress and update your plan as new issues surface. Without an account, print everything before leaving the page.
What to Expect After You Report
No single report produces an instant takedown. Each channel runs on its own timeline with its own threshold for action. Browser and search engine warnings can appear within days once automated systems verify the threat. Domain registrars and hosting providers often respond within a few days of a well-documented abuse report, though some drag their feet. Federal investigations work on a scale of months or years, aggregating thousands of complaints before producing enforcement actions, indictments, or civil injunctions.
The most effective approach is hitting every channel at once. A site flagged by Google Safe Browsing, reported to its registrar, and logged with both the FTC and IC3 faces pressure from every side. The browser warning chokes off new victims while the registrar review works toward full removal, and your federal reports join the evidence pile that eventually justifies warrants and asset seizures. None of these steps require a lawyer, all of them are free, and doing all of them takes about an hour once your evidence is organized.