How to Report a Scam or Phishing Website

Scam websites can look almost identical to the real thing: copied logos, stolen product photos, even fake customer reviews. A website scam report helps in two ways. Law enforcement reports help investigators connect cases, and reports to browser safety services can put a warning screen in front of the next person who clicks.

EXAMPLE — SCAM

Today 12:10 PM●●● ▮

From: Outlet Deals <offers@brand-outlet.example.com>

Subject: Final clearance: 80% off — today only

Our warehouse is closing! Every item is 80% off until midnight.

Shop now at https://brand-outlet.example.com — payment by gift card or crypto receives an extra 10% discount.

What should you do before you report a scam website?

Do not enter anything more on the site — no passwords, card numbers or personal details. Close the page. Copy the web address first if you can do it without clicking anything else (for example, from your browser’s address bar), because you will need it for your reports.

How do you report a scam website to the FTC?

File a report at ReportFraud.ftc.gov. Choose the category that fits — for example, an online shopping problem or an impersonator — or “Something Else.” Paste the web address and describe what happened in the Comments field. Include how much you paid and how, if you lost money.

Your report goes into the FTC’s Consumer Sentinel database, which is available to federal, state and local law enforcement across the country. You can report even if you did not lose money.

When should you report a website to the FBI?

If you lost money, or the site was part of online fraud such as a phishing scheme, file a complaint with the FBI’s Internet Crime Complaint Center at IC3.gov. Include the site’s address, any emails or messages that led you there, and payment details.

Be careful to use the real IC3 site. The FBI warns that criminals have built fake IC3 websites. It advises typing www.ic3.gov directly into your browser’s address bar and checking that the address ends in .gov — and skipping sponsored search results, which can lead to copycat sites.

How do you get browsers to warn others about a phishing site?

These services power the red warning screens that browsers show before you visit a dangerous page:

• Google Safe Browsing: report phishing pages at safebrowsing.google.com/safebrowsing/report_phish/.
• Microsoft: report unsafe sites at microsoft.com/en-us/wdsi/support/report-unsafe-site.

On each form, paste the site’s address — there is no need to visit the scam site again.

Should you tell the company being copied?

Yes. If the site pretends to be a real store, bank or government agency, let the real organization know. Find its contact information on its official website (type the address yourself rather than using a search ad). Many companies have a dedicated address for reporting phishing; Apple, for example, uses reportphishing@apple.com.

Can a domain registrar take a scam site down?

Every website address is registered through a company called a registrar. ICANN, the organization that coordinates internet addresses, runs a free lookup tool at lookup.icann.org where you can enter a domain name and see registration details, including which registrar the domain uses. Registrars and web hosts often have a process for reporting abuse on their own websites.

Where should you report each kind of scam website?

What happened	Report to
Any scam or fake website	ReportFraud.ftc.gov
You lost money or data, or it was a phishing site	IC3.gov, and your bank or card company
A phishing page that copies a login screen	Google Safe Browsing and Microsoft’s unsafe-site form
A fake version of a company or agency site	That organization, through its official website
It came from a phishing email	Also see how to report a phishing email

What if you already paid or entered information?

• Paid by credit or debit card: contact your card company right away to dispute the charge. The FTC says paying by credit card best protects you if something goes wrong.
• Entered a password: change it on that account and anywhere else you used it.
• Entered your Social Security number: go to IdentityTheft.gov.

Our first-hour checklist covers every payment method. To avoid the next fake site, use our 10 checks to tell if a website is legit.

For more on how fake websites trick people, see our overview of phishing emails and fake websites, or find other agencies on our where to report a scam page.