Where to report cybercrime online, by country

Each page below is written for that country's process, with the portal, what it covers, what to prepare and what happens after you submit.

• United States — FBI IC3 and the FTC's ReportFraud
• United Kingdom — Report Fraud (formerly Action Fraud) and Police Scotland
• Australia — ReportCyber and Scamwatch
• Canada — The Canadian Anti-Fraud Centre and local police

If your country is not listed, the general rule holds: report to your national police or fraud centre, contact your bank if money moved, and report the website itself to its host and registrar.

Most people assume one report does everything. In practice there are two independent tracks, and they are handled by completely different organisations.

The crime track is the police or national fraud centre. It records that an offence happened to you, feeds national intelligence so linked cases can be connected, and — for a small share of reports — leads to an investigation. It is the track that matters for insurance claims, bank disputes that ask for a crime reference, and any later prosecution.

The website track is the hosting provider, the domain registrar and the browser blocklists run by Google, Microsoft and others. They are private companies with their own abuse policies, and they are the ones that can actually switch a site off or put a warning in front of it. A police report does not trigger this track automatically.

You should do both, and you can do them the same day. Neither one waits for the other.

Every portal asks for roughly the same facts. Gathering them first turns a frustrating hour into fifteen minutes:

• The exact URL of the website, copied from the address bar, and any other addresses it redirected through.
• Dates and times of each contact, with the time zone.
• Amounts paid, the payment method, and transaction or reference IDs from your bank, card or wallet.
• Screenshots of the site, the checkout or login page, and any messages — taken before the site disappears.
• For email: the full message headers, not just the visible text. Your mail program has a "show original" or "view source" option.
• Usernames, phone numbers and email addresses the other side used.

Keep the originals. Do not edit screenshots, and do not reply to the sender to "test" them.

Across all four countries the honest picture is similar. Reports are read, categorised and stored so that patterns can be detected across thousands of victims. Some reports are passed to a local force or a specialist unit. Most individual reports do not lead to an investigation of their own.

Status tracking is limited. Some portals give you a reference number, and a few let you look up whether a report was lodged or send updates when your information supports an investigation, but none of them offers a case status you can follow day by day. That is not a failure of your report; it is how intelligence-led systems work.

What a police report does well: it creates an official record, it helps connect your case to others run by the same group, and it is the only route to prosecution. What it almost never does: take a website offline or return money.

While the official report is being handled, the site keeps catching new victims. To stop that, the report has to reach the companies that run the site's infrastructure:

• The hosting provider, which can remove the content — see how to report abuse to a hosting provider.
• The domain registrar, which can suspend the name — see how to find the abuse contact for a domain.
• The browser blocklists, which put a warning page in front of the site for most users.

You can do this yourself, or report the website to Fraudpol and we contact each of those parties for you. Our free abuse contact lookup shows who to write to for any domain.

Call your bank or card issuer before anything else, using the number printed on your card. Banks can sometimes stop or recall a payment in the first hours, and that window closes fast. For cryptocurrency, contact the exchange you sent from.

Be very careful with anyone who contacts you afterwards promising to recover the money for a fee. Recovery offers are one of the most common follow-up frauds — read how recovery scams work before you answer any of them.