To report a cyber crime, file a complaint with the FBI’s Internet Crime Complaint Center at ic3.gov and file a separate report with your local police precinct. If personal information was stolen, add a report at IdentityTheft.gov. In 2024, IC3 received 859,532 complaints totaling $16.6 billion in reported losses, so you are far from alone.1Federal Bureau of Investigation. 2024 IC3 Annual Report Speed matters more than most people realize. If you sent money by wire transfer, the FBI has a team that can sometimes freeze the funds before the recipient withdraws them, but only if you report within hours.
Gather Your Evidence First
Both the FBI and your local police will need the same core information: your full legal name, mailing address, phone number, and email address, along with a written narrative of every interaction with the person or entity that targeted you.2Internet Crime Complaint Center (IC3). Frequently Asked Questions
Technical evidence is what separates a useful report from a vague one. The IC3 complaint form asks for IP addresses, full email headers, website URLs, and social media accounts tied to the scam.2Internet Crime Complaint Center (IC3). Frequently Asked Questions Email headers contain routing data that can trace a message back to its actual origin. Most email clients let you view them through a “show original” or “view source” option. Copy the full header text and save it in a document.
Financial details need to be precise. Record the exact dates, amounts, and account numbers for every transaction, both your accounts and the recipient’s. Include routing numbers for bank transfers and the name of each financial institution involved.3Internet Crime Complaint Center (IC3). Complaint Form If the crime involved cryptocurrency, capture the wallet addresses, the cryptocurrency type, the exact amounts, and the transaction hashes (the long alphanumeric strings identifying each transfer on the blockchain).4Federal Bureau of Investigation. Cryptocurrency Investment Fraud
Preserve Digital Evidence Before It Disappears
Take screenshots of everything before anything can be deleted: scam emails, text messages, social media profiles, transaction confirmations, and error messages. Save complete copies of emails rather than just forwarding them. Forwarding strips the header data investigators need. If malware was involved, don’t wipe or reinstall the computer yet, because that destroys forensic evidence. Disconnect the device from the internet to prevent further damage, but leave the system intact.
Store your preserved evidence on a separate device or external drive to prevent accidental overwriting. If you have server log files from a compromised business system, export and save them immediately, because many systems overwrite logs on a rolling basis.
File a Report With Local Police
Call your local precinct’s non-emergency line or visit the station in person. Ask the officer for a formal incident report and a case number. That case number is more valuable than it seems. Banks, credit card companies, and insurance providers routinely require a police report number before they’ll process fraud claims or reverse unauthorized charges.5U.S. Department of Justice. Reporting Computer, Internet-Related, or Intellectual Property Crime
Be realistic about what local police can do. A patrol officer likely won’t trace a phishing operation run from another country. But the report creates an official legal record that a crime occurred, and it anchors every financial dispute and insurance claim you file afterward. Get a printed copy before you leave the station.
Submit a Complaint to the FBI at IC3
Go to ic3.gov and click the option to file a complaint. The form walks you through structured fields for your personal information, the suspect’s details (if known), a narrative description, and the financial and technical evidence you’ve gathered.3Internet Crime Complaint Center (IC3). Complaint Form Fill every field as completely as you can. The FBI’s ability to act on your complaint depends on the specificity of what you provide.2Internet Crime Complaint Center (IC3). Frequently Asked Questions
After you submit, a confirmation message appears on screen. Here is the part people miss: IC3 will not email you a copy of your complaint. The confirmation screen is the only time you can save or print it.2Internet Crime Complaint Center (IC3). Frequently Asked Questions If you navigate away or close the browser without saving, that copy is gone. Print the page or save it as a PDF before doing anything else.
You can also report directly to your nearest FBI field office, particularly for high-value or ongoing attacks. The Department of Justice advises calling the local office and asking for the “Duty Complaint Agent.”5U.S. Department of Justice. Reporting Computer, Internet-Related, or Intellectual Property Crime This approach can be faster for time-sensitive situations where you need to talk to an agent rather than fill out a web form.
Act Fast if You Wired Money
If you wired money to a scammer and realize it quickly, report to IC3 immediately, within hours rather than days. The FBI operates a Recovery Asset Team that contacts the receiving bank and requests an emergency freeze before the money moves further. In 2024, the team handled over 3,000 incidents and successfully froze $469.1 million in domestic transfers, a 66 percent success rate.1Federal Bureau of Investigation. 2024 IC3 Annual Report
Every hour matters. Once the recipient withdraws the funds or transfers them overseas, recovery drops sharply. When filing, include every detail about the wire transfer: sending and receiving bank names, account numbers, routing numbers, transaction amounts, and dates. The Recovery Asset Team uses those details to reach the right bank contact quickly.6Federal Bureau of Investigation. Recovery Asset Team
What Happens After You File
Adjust your expectations here. IC3 will not contact you after you file. Given the volume of complaints, the center cannot respond to every submission. Your complaint is analyzed and may be referred to FBI field offices, state and local law enforcement, or international partners, but any follow-up investigation is at the receiving agency’s discretion.7Internet Crime Complaint Center (IC3). Home Page
That does not mean filing was pointless. IC3 complaints feed pattern analysis that helps the FBI identify larger criminal networks. Your report might connect to dozens of others and trigger an investigation that no single complaint would have. It also creates a federal record of your loss, which supports insurance claims and civil lawsuits down the road. If a law enforcement agency picks up your case, they will contact you directly.
Report Identity Theft to the FTC
When a cyber crime results in someone using your personal information (opening accounts in your name, filing tax returns with your Social Security number, or making purchases with your stolen card), report it separately at IdentityTheft.gov, the federal government’s central resource for identity theft victims.8Federal Trade Commission. IdentityTheft.gov This step is in addition to your IC3 complaint and police report, not a replacement.
The site asks a series of questions about what happened, then generates two things: an FTC Identity Theft Report and a personalized recovery plan. The recovery plan tells you which companies to contact, pre-fills dispute letters, and tracks your progress.9Federal Trade Commission. IdentityTheft.gov – Steps The Identity Theft Report itself carries legal weight, because credit bureaus and businesses are required to accept it when you dispute fraudulent accounts. For scams that did not involve identity theft, such as a fake online store that took your money, use ReportFraud.ftc.gov instead.10Federal Trade Commission. Report Identity Theft
Freeze Your Credit
After reporting identity theft, place a credit freeze or fraud alert with each of the three major credit bureaus (Equifax, Experian, and TransUnion). A credit freeze blocks anyone, including you, from opening new credit accounts until you lift it. It stays in place indefinitely, which makes it the stronger protection.11Federal Trade Commission. Credit Freezes and Fraud Alerts You can temporarily lift it when you need to apply for credit yourself.
A fraud alert is lighter. It tells lenders to verify your identity before approving new credit but doesn’t block access to your credit report. An initial fraud alert lasts one year and can be renewed. Identity theft victims can request an extended fraud alert lasting seven years.11Federal Trade Commission. Credit Freezes and Fraud Alerts With either option, you only need to contact one bureau. It’s required to notify the other two. For most cyber crime victims dealing with compromised personal data, a credit freeze is the safer choice because it doesn’t rely on the lender following through on a verification step.
Fraudulent Tax Returns
If someone filed a fraudulent tax return using your Social Security number, file IRS Form 14039 (Identity Theft Affidavit). The preferred method is submitting it online through the IRS website. If you can’t e-file your own return because someone already filed under your SSN, attach Form 14039 to the back of your paper return and mail it to your normal IRS filing address.12Internal Revenue Service. Identity Theft Affidavit Form 14039 This flags your account for the IRS to investigate the fraudulent filing and process your legitimate return.
Social Security Number Misuse
When the crime involves someone working, collecting benefits, or opening accounts under your Social Security number, report it to the Social Security Administration’s Office of the Inspector General at oig.ssa.gov/report or by calling the fraud hotline at 1-800-269-0271 (available 10 a.m. to 2 p.m. ET, Monday through Friday).13Social Security Administration. Fraud Prevention and Reporting The OIG investigates fraud related to Social Security programs, including identity theft involving SSNs.14Office of the Inspector General. Report Fraud
Watch the Deadlines for Unauthorized Transfers
Federal law caps your liability for unauthorized electronic fund transfers, but only if you report them quickly. The deadlines are strict:
- Within 2 business days of discovering the theft, your maximum liability is $50.
- After 2 business days but within 60 days of receiving your bank statement, your liability rises to $500.
- After 60 days from your bank statement, you could be liable for the full amount of any unauthorized transfers that occurred after that 60-day window.
These tiers apply to debit cards and electronic fund transfers. Credit cards have separate, generally more protective rules. The 60-day deadline is the one that catches people off guard. If a thief drains your checking account through a compromised debit card and you don’t notice for three months, the bank can refuse to reimburse transfers that happened after day 60.15Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability Check your bank statements regularly, and report anything suspicious the day you spot it.
Suing the Person Who Attacked You
Beyond criminal reporting, federal law gives you the right to sue. Under the Computer Fraud and Abuse Act, anyone who suffers damage or loss from a violation can file a civil lawsuit seeking compensatory damages and injunctive relief. The statute of limitations is two years from the date of the act or the date you discovered the damage, whichever is later.16Office of the Law Revision Counsel. 18 USC 1030 – Fraud and Related Activity in Connection With Computers
The civil route is separate from anything the FBI or local police do with your criminal complaint. It’s most practical when you’ve identified the perpetrator and they have assets worth pursuing. For smaller losses, small claims court may be an option, with jurisdictional limits ranging from $2,500 to $25,000 depending on the state. For larger losses, consult an attorney about whether the potential recovery justifies the litigation costs.
If You’re a Business, Additional Rules May Apply
The reporting path above is written for individual victims. If you’re a business, extra obligations may attach. Publicly traded companies that experience a material cybersecurity incident must disclose it to the SEC on Form 8-K within four business days of determining the incident is material.17U.S. Securities and Exchange Commission. Exchange Act Form 8-K Compliance and Disclosure Interpretations The clock starts when the company makes its materiality determination, not when the breach occurred. A ransomware payment or the incident ending does not change the deadline. Critical infrastructure operators in sectors like energy, healthcare, and financial services should also track the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA), which proposes separate reporting deadlines to CISA and remains in its proposed stage as of early 2026.