To report a scam email to the FTC and the FBI, file a complaint at ReportFraud.ftc.gov and, if the message caused financial loss or exposed personal data, file a second complaint at the FBI’s Internet Crime Complaint Center at IC3.gov. Before you file either one, save the email’s full headers so investigators have something to trace. The whole process takes about ten minutes. In 2024 alone, IC3 logged 859,532 complaints tied to $16.6 billion in losses, and each report feeds the databases agents use to connect schemes across state and national borders.
Save the Email Evidence First
The visible “From” name on an email is easy to fake. The headers behind it aren’t. Headers are the hidden routing log that records the IP addresses and servers the message passed through, and they’re what analysts actually work from. Grab them before you delete, forward, or click anything.
In Gmail, open the message, click the three-dot menu next to the reply button, and select “Show original.” In Outlook on the web, click the three-dot icon near the top of the message, then “View,” then “View message details.” On desktop Outlook, right-click the message in your inbox without opening it and select “View Source.”
Copy the full header text into a plain text file. Then note a few more things while you have the message open:
- The actual sender address, not just the display name. Scam domains often mimic real ones (paypa1.com in place of paypal.com).
- Any links in the message. Right-click and copy the URL rather than clicking it.
- Attachment file names and types. Do not open them.
- If money changed hands: the payment method (wire, gift card, cryptocurrency), the amount, and any confirmation numbers.
Gathering this once means you can paste the same block of information into every form without digging through your inbox again.
File With the FTC at ReportFraud.ftc.gov
The Federal Trade Commission’s fraud portal is the primary federal intake point for consumer scam reports. Go to ReportFraud.ftc.gov, click “Report Now,” choose the category that best describes the scam, and paste the headers and message details into the description field.
Every report goes into the Consumer Sentinel Network, a secure database shared with more than 2,800 law enforcement agencies worldwide. The FTC does not resolve individual complaints or pursue refunds for you. The reason to file anyway is pattern recognition: when thousands of reports point to the same sender, domain, or payment channel, that volume is what gives prosecutors evidence to build cases. File even if you didn’t lose money.
File With the FBI at IC3.gov
If the scam caused financial loss or exposed sensitive personal information, file a separate complaint at IC3.gov. The Internet Crime Complaint Center is the FBI’s centralized intake for internet-related crime, authorized to investigate under federal wire fraud, computer fraud, and identity theft statutes.
The online form asks for the sender’s details, a narrative of what happened, and any transaction information tied to the loss. The IC3’s 2024 annual report documented $16.6 billion in reported losses across nearly 860,000 complaints, which is exactly why individual reports matter for connecting activity across jurisdictions. FTC and IC3 databases are separate. Filing at one does not file at the other.
Flag It Inside Your Email Account Too
Provider-level reporting doesn’t trigger law enforcement, but it does two useful things: it removes the message from your inbox and trains the filter so similar messages get caught for other users.
In Gmail, open the message, click the three-dot menu next to the reply button, and select “Report phishing” rather than “Report spam” — phishing reports get more aggressive follow-up from Google’s security team. In Outlook on the web or desktop, select the message, click “Report” in the toolbar, and choose “Report phishing.” On Outlook mobile, tap the three-dot menu, select “Report Junk,” then “Phishing.” Yahoo Mail doesn’t have a separate phishing button; use “Mark as spam,” which still routes the message to Yahoo’s security review. For scams impersonating Apple, forward to reportphishing@apple.com; for general junk in an iCloud, me.com, or mac.com inbox, mark as junk.
If the scam arrived at a work address, tell your IT or security team through your organization’s internal process, even if you spotted the scam instantly. Someone else on the same thread may not have.
Impersonation Scams Have Their Own Reporting Addresses
When a scam email pretends to be a specific federal agency or company, there’s usually a dedicated inbox that routes straight to investigators or fraud teams who specialize in that exact scheme. Use these in addition to your FTC and IC3 reports.
Emails claiming to be from the IRS or U.S. Treasury go to phishing@irs.gov. Forward the raw email with full headers rather than a screenshot; the underlying data is what gets used to trace the source. Include any fake-IRS URLs in the body.
Emails impersonating the Social Security Administration go to the SSA’s Office of the Inspector General at oig.ssa.gov/report. If you’re not sure which agency is being impersonated, USA.gov maintains a “Where To Report a Scam” tool that routes you to the right portal based on the scam type.
For phishing messages generally — anything trying to get you to enter credentials on a fake site — forward the full email to reportphishing@apwg.org, the Anti-Phishing Working Group’s archive. If your email client supports “Forward as Attachment,” use it; a standard forward strips the headers. The FTC itself directs consumers to this address for phishing.
When the scam uses a real company’s name and branding, that company usually wants a copy too. Most large organizations publish a security address in the format spoof@companyname.com or abuse@companyname.com. Forward it there with headers intact. You’ll get an automated acknowledgment, not a personal follow-up, but the report helps the company get look-alike domains pulled offline faster.
If You Already Clicked, Entered Information, or Sent Money
Reporting still matters, but damage control comes first, and some of the deadlines below are strict.
Call Your Bank or Card Issuer Right Away
If you entered payment details or sent money, call the fraud line on the back of your card. For credit cards, federal law caps your liability for unauthorized charges at $50. Debit cards and bank accounts have a much tighter timeline: report within two business days of noticing the problem and your maximum liability stays at $50. Wait longer and it jumps to $500. Miss 60 days after your bank sends a statement showing the unauthorized transfer, and you can be liable for the full amount.
Those clocks are why the bank call comes before the federal reports. Under federal rules, the bank must investigate and resolve your dispute within 10 business days, or provisionally credit your account and take up to 45 days.
Freeze Your Credit
If the scam captured your Social Security number, date of birth, or similar identity information, place a security freeze at all three credit bureaus: Equifax, Experian, and TransUnion. Freezes are free under federal law, and each bureau has to process a phone or online request within one business day. You have to contact each one separately; freezing at one does not freeze the others. A freeze blocks new accounts from being opened in your name until you lift it, and you can thaw it temporarily when you apply for credit yourself.
Start a Recovery Plan at IdentityTheft.gov
If you believe your personal information is out, IdentityTheft.gov (run by the FTC) generates a personalized recovery checklist and pre-filled letters for creditors, debt collectors, and the IRS based on what was exposed. If the scam involved tax-related identity theft, the site can help you submit IRS Form 14039, the Identity Theft Affidavit, which flags your tax account for protection.
Change Any Password You Handed Over
If you typed a username and password into a phishing site, change that password immediately, and change it on every other account where you used the same login. Turn on two-factor authentication on the compromised account and on any account that shared those credentials. Check the recent activity log, and revoke any active sessions you don’t recognize.
What to Expect After You File
Filing with the FTC, the IC3, and your email provider does not mean someone will call you back about your specific case. Federal agencies use these complaints as intelligence, connecting patterns across millions of reports to build large-scale enforcement actions. Your individual report becomes one data point in a much bigger picture. The FTC brings civil cases and coordinates with criminal prosecutors; the FBI and the IC3 pursue criminal investigations into major fraud operations.
None of this guarantees you recover money you already lost. But reporting is the mechanism that makes prosecution possible, and it directly improves the filters and databases that protect everyone else who gets the same email tomorrow.