To report spoofing, file with three federal agencies: the FCC at consumercomplaints.fcc.gov, the FTC at reportfraud.ftc.gov, and the FBI’s Internet Crime Complaint Center at ic3.gov. Each agency uses the reports differently, so filing with all three gives your information the widest reach. Federal law makes it illegal to spoof caller ID with intent to defraud, and penalties can reach $10,000 per violation.1Office of the Law Revision Counsel. 47 U.S. Code 227 – Restrictions on Use of Telephone Equipment
None of these agencies will call the spoofer on your behalf or recover money for you. What they do is build cases, run enforcement actions, and refer serious matters to law enforcement. If money or personal information was compromised, the reports come after a set of faster steps covered further down.
What to Gather Before You File
Every complaint form asks for the same core facts, so pull them together first. Write down the exact date and time the call, text, or email arrived, and the phone number or email address that appeared on your screen. If a caller gave you a different callback number during the conversation or in a voicemail, note that too. Federal complaint forms use these details to cross-reference your report with others from the same source.
For a spoofed email, you also need the full message header, which is the hidden routing data showing where the email really originated. Most email clients expose it through a “View Original” or “Show Headers” option. Copy the whole header and save it to a text file. Header data is what analysts use to trace a message to its real origin.
Take screenshots that preserve the sender’s displayed number or address, the message content, and any links, without clicking them. For a call, write a short summary of what the caller said, as close to verbatim as you can, and flag any request for money or personal information. Don’t delete voicemails. Some carriers let you save the audio, and it can be useful evidence later.
Filing with the FCC
The Federal Communications Commission takes spoofing complaints at consumercomplaints.fcc.gov. Choose “Phone” as the issue category, then “Unwanted Calls,” then the spoofing sub-issue that fits, whether your own number was used to spoof others or you received a spoofed call.2FCC Complaints. Phone Form – Descriptions of Complaint Issues The form asks for the number involved, the date, and a description of what happened.
The FCC does not resolve individual spoofing complaints. It will serve your complaint on your phone provider, which then has 30 days to respond, and it will feed the data into enforcement and policy work.3FCC Complaints. How the FCC Handles Your Complaint Aggregate complaint data is how the FCC identifies large illegal robocall campaigns and directs enforcement resources.
The legal weight behind FCC action comes from the Truth in Caller ID Act, which makes it a federal violation to transmit misleading caller ID information with intent to defraud or cause harm. Each violation can carry a fine of up to $10,000, or triple that in certain circumstances.1Office of the Law Revision Counsel. 47 U.S. Code 227 – Restrictions on Use of Telephone Equipment Carriers are also required to implement STIR/SHAKEN, a caller ID authentication system that verifies whether a call actually originated from the number displayed; when it works, legitimate calls may show a “Verified” label.4Federal Communications Commission. Combating Spoofed Robocalls with Caller ID Authentication
Filing with the FTC
The Federal Trade Commission takes reports at reportfraud.ftc.gov, and its focus is the scam itself rather than the phone technology behind it.5Federal Trade Commission. ReportFraud.ftc.gov – FAQ The site walks you through a guided questionnaire covering what happened, how you were contacted, what the scammer wanted, and whether you paid anything. File even if no money changed hands. A pattern of attempted scams is still evidence the FTC uses to build cases.
After you submit, the platform offers next-step guidance tailored to the type of scam you reported, which is helpful when you’re not sure what to do next.5Federal Trade Commission. ReportFraud.ftc.gov – FAQ
The FTC’s Impersonation Rule gives the agency real enforcement power. It makes it illegal to falsely pose as a government entity or a business, and violations can carry civil penalties of up to $53,088 per violation plus consumer refunds. That penalty is adjusted annually for inflation.6Federal Trade Commission. FTC Highlights Actions to Protect Consumers from Impersonation Scams
Filing with the FBI’s Internet Crime Complaint Center
When spoofing leads to actual financial loss or compromised personal data, the FBI’s Internet Crime Complaint Center at ic3.gov is the intake point for potential criminal investigation. IC3 analysts review complaints and refer them to federal, state, local, or international law enforcement as appropriate.7Internet Crime Complaint Center (IC3). About This is the channel most likely to feed an actual criminal case rather than a regulatory action.
The complaint form asks whether you lost money, the total amount, and a written description of what happened, capped at 3,500 characters.8Internet Crime Complaint Center (IC3). Complaint Form IC3 covers business email compromise, government impersonation, cryptocurrency fraud, elder fraud, and other cyber-enabled crimes. If any of those elements are present, name them explicitly in your description so analysts can route the complaint to the right team.
Reporting to Your Carrier or Email Provider
Your carrier and email provider can’t pursue enforcement, but they can block the source. For a spoofed or spam text, forward the message to 7726, which spells “SPAM” on a keypad. The service is free, is supported by major wireless carriers, and triggers an automated reply asking for the sender’s number so the carrier can update its filters.9Federal Trade Commission. How to Recognize and Report Spam Text Messages
For a spoofed email, use the “Report Phishing” or “Report Junk” button built into your email client. That button doesn’t just move the message to a spam folder. It sends the email to the provider’s security team, which uses the data to train filtering systems and block offending IP addresses and domain names across the network.
Notifying the Impersonated Company or Agency
When a spoofed message pretends to come from a specific organization, telling that organization helps them warn other customers and take down the fraudulent infrastructure. The IRS accepts forwarded phishing emails at phishing@irs.gov, using “IRS” or “Treasury” as the subject line depending on which agency was impersonated; don’t click any links or open attachments before forwarding.10Internal Revenue Service. Report Fake IRS, Treasury or Tax-Related Emails and Messages PayPal takes similar reports at phishing@paypal.com.11PayPal. How to Report Suspicious Emails and Messages
If a spoofing attempt targeted your bank or credit card company, call the fraud department using the number on the back of your card. Don’t use any number given in the suspicious message. If you accidentally shared account numbers, login credentials, or other personal information during the encounter, calling the institution immediately gives them the best chance of freezing or monitoring the account before damage is done.
If someone created a fake profile using your name or photos on a social platform, use the platform’s impersonation reporting tool. Most platforms have a dedicated option for “this account is pretending to be me” that’s separate from general abuse reporting, and some may ask for government-issued photo ID to verify you’re the real person.
AI Voice Clones and Deepfakes
AI voice cloning has made phone spoofing harder to detect. A call that sounds like your boss, your bank, or a family member can be a synthetic voice generated from a few seconds of publicly available audio. In February 2024 the FCC ruled that AI-generated voices, including voice clones, fall under the Telephone Consumer Protection Act’s restrictions on artificial or prerecorded voice messages, so callers using them need prior consent from the person called.12Federal Communications Commission. Declaratory Ruling – Implications of Artificial Intelligence Technologies on Protecting Consumers from Unwanted Robocalls and Robotexts
Report AI voice spoofing through the same three channels: FCC, FTC, and IC3. Note in your description that the voice appeared to be synthetically generated or cloned. If the caller impersonated a specific person or organization, the FTC’s Impersonation Rule may also apply, with civil penalties of up to $53,088 per violation.6Federal Trade Commission. FTC Highlights Actions to Protect Consumers from Impersonation Scams
If You Lost Money or Shared Personal Information
Federal reports matter, but they won’t recover your money or protect your accounts. That takes separate, time-sensitive action.
If you gave out credit card information, federal law caps your liability for unauthorized charges at $50, and most issuers waive even that. You have 60 days from when the fraudulent charge appears on your statement to dispute it. Call the number on your card immediately; don’t wait for the statement.
Debit cards are riskier. Under the Electronic Fund Transfer Act, your liability depends on how fast you report the problem:13Consumer Financial Protection Bureau. Regulation E 1005.6 – Liability of Consumer for Unauthorized Transfers
- Report within 2 business days, and your maximum liability is $50.
- Report between 2 and 60 days, and your liability can rise to as much as $500.
- Report after 60 days, and you can be on the hook for the full amount of unauthorized transfers that occurred after the 60-day window.
The 2-day window is brutally short. If a spoofed call or message tricked you into sharing your debit card number or bank login, call your bank the same day.
If you shared sensitive personal information such as your Social Security number, date of birth, or tax records, place a credit freeze with all three major bureaus: Equifax, Experian, and TransUnion. Federal law requires the freezes to be free, and the bureaus must place them within one business day of a phone or online request.14Consumer Financial Protection Bureau. What Is a Credit Freeze or Security Freeze on My Credit Report A freeze prevents anyone from opening new credit accounts in your name until you lift it. You can also place a fraud alert, which lasts one year and requires creditors to verify your identity before opening new accounts.
For a structured recovery process, use IdentityTheft.gov, which is run by the FTC. The site asks about your situation, generates a personalized recovery plan, and creates an FTC Identity Theft Report you can use when disputing fraudulent accounts or working with creditors.15IdentityTheft.gov. Report Identity Theft and Get a Recovery Plan If you create an account, it tracks your progress and pre-fills letters and forms, which helps when you’re dealing with multiple institutions at once.