How to Report a Scam or Phishing Website

Scam websites can look almost identical to the real thing: copied logos, stolen product photos, even fake customer reviews. Reporting one helps in two ways. Law enforcement reports help investigators connect cases, and reports to browser safety services can put a warning screen in front of the next person who clicks.

EXAMPLE — SCAM

Today 12:10 PM●●● ▮

From: Outlet Deals <offers@brand-outlet.example.com>

Subject: Final clearance: 80% off — today only

Our warehouse is closing! Every item is 80% off until midnight.

Shop now at https://brand-outlet.example.com — payment by gift card or crypto receives an extra 10% discount.

Before you report: stop and close the site

Do not enter anything more on the site — no passwords, card numbers or personal details. Close the page. Copy the web address first if you can do it without clicking anything else (for example, from your browser’s address bar), because you will need it for your reports.

Step 1: Report it to the FTC

File a report at ReportFraud.ftc.gov. Choose the category that fits — for example, an online shopping problem or an impersonator — or “Something Else.” Paste the web address and describe what happened in the Comments field. Include how much you paid and how, if you lost money.

Your report goes into the FTC’s Consumer Sentinel database, which is available to federal, state and local law enforcement across the country. You can report even if you did not lose money.

Step 2: Report it to the FBI if money or data was stolen

If you lost money, or the site was part of online fraud such as a phishing scheme, file a complaint with the FBI’s Internet Crime Complaint Center at IC3.gov. Include the site’s address, any emails or messages that led you there, and payment details.

Be careful to use the real IC3 site. The FBI warns that criminals have built fake IC3 websites. It advises typing www.ic3.gov directly into your browser’s address bar and checking that the address ends in .gov — and skipping sponsored search results, which can lead to copycat sites.

Step 3: Report it to browser safety services

These services power the red warning screens that browsers show before you visit a dangerous page:

• Google Safe Browsing: report phishing pages at safebrowsing.google.com/safebrowsing/report_phish/.
• Microsoft: report unsafe sites at microsoft.com/en-us/wdsi/support/report-unsafe-site.

On each form, paste the site’s address — there is no need to visit the scam site again.

Step 4: Tell the company or agency being copied

If the site pretends to be a real store, bank or government agency, let the real organization know. Find its contact information on its official website (type the address yourself rather than using a search ad). Many companies have a dedicated address for reporting phishing; Apple, for example, uses reportphishing@apple.com.

Optional: alert the domain registrar

Every website address is registered through a company called a registrar. ICANN, the organization that coordinates internet addresses, runs a free lookup tool at lookup.icann.org where you can enter a domain name and see registration details, including which registrar the domain uses. Registrars and web hosts often have a process for reporting abuse on their own websites.

Quick reference: where to report a scam website

What happened	Report to
Any scam or fake website	ReportFraud.ftc.gov
You lost money or data, or it was a phishing site	IC3.gov, and your bank or card company
A phishing page that copies a login screen	Google Safe Browsing and Microsoft’s unsafe-site form
A fake version of a company or agency site	That organization, through its official website
It came from a phishing email	Also see how to report a phishing email

If you already paid or entered information

• Paid by credit or debit card: contact your card company right away to dispute the charge. The FTC says paying by credit card best protects you if something goes wrong.
• Entered a password: change it on that account and anywhere else you used it.
• Entered your Social Security number: go to IdentityTheft.gov.

Our first-hour checklist covers every payment method. To avoid the next fake site, use our 10 checks to tell if a website is legit.