How to report cybercrime in Australia

ReportCyber is the national online portal at cyber.gov.au/report, operated by the Australian Signals Directorate's Australian Cyber Security Centre (ACSC). According to the ACSC, reports from individuals are referred directly to the relevant state or territory police. You can report anonymously, though an anonymous report cannot be followed up with you.

What it is for: crimes where you are the victim — online shopping fraud, romance and investment fraud, email compromise, hacked accounts, ransomware, identity theft, cyber abuse.

What it is not for: immediate danger (call 000), general spam (report to ACMA), or reporting a scam you merely noticed. It is also not a service that removes websites.

Scamwatch is run by the National Anti-Scam Centre within the ACCC. It collects reports about scams — including ones that failed — and uses them to warn the public and disrupt scam operations with banks, telcos and digital platforms.

It does not investigate individual cases or pass every report to police. If you lost money, file on ReportCyber as well; the two do different jobs.

• ACSC hotline: 1300 CYBER1 (1300 292 371), 24/7, for help stopping an attack in progress.
• IDCARE: Australia and New Zealand's identity and cyber support service, free for individuals, useful if your identity documents or accounts were exposed.
• Your bank: first call if money moved, before any report.

• The website address, and how you reached it (ad, marketplace listing, text message, social media).
• Each transaction: date, amount in AUD, method (PayID, bank transfer, card, crypto) and the receipt or reference number.
• The BSB and account number, or the PayID, you paid to.
• Screenshots of the site, listing and conversations, with visible dates.
• Email headers from the "show original" view for any email involved.
• Phone numbers, profile links and usernames the other party used.

After submitting to ReportCyber you get a reference number. The report is assessed and referred to police in your state or territory, who decide whether to investigate. Many reports are used to link cases and build intelligence rather than being investigated individually. Status checks tell you where the report sits; they do not give a day-by-day account of an investigation.

A police report is a record and an investigation route. It very rarely results in a website being taken offline, and it is not a way to recover money.

Police referral does not notify the hosting company. To stop the site reaching more people:

• Find the host and registrar with the abuse contact lookup — see how to read the results.
• Send a complaint using our hosting provider template.
• For .au domains, auDA's registrar rules also allow complaints to the registrar of record.
• Or report the site to Fraudpol and we handle the website side for you.