How to report cybercrime in Canada

The online Report Cybercrime and Fraud system was developed by the RCMP's National Cybercrime Coordination Centre (NC3) together with the Canadian Anti-Fraud Centre. You can report as a victim, as someone who was targeted without losing anything, or as a witness. The CAFC also takes reports by toll-free phone during weekday business hours.

What it is for: connecting similar reports across Canada and internationally, prioritising threats for law enforcement, and coordinating investigations between jurisdictions.

What it is not for: emergencies (call 911), reports on behalf of large organisations or critical infrastructure (the Canadian Centre for Cyber Security handles those), child exploitation (Cybertip.ca), or non-criminal spam (the Spam Reporting Centre).

In Canada, investigation sits with your local police service — municipal, provincial or the RCMP in contract areas. The RCMP states this directly: if you are a victim, contact local police as soon as possible, and also file with the national system. Local police can issue an occurrence number, which banks and insurers frequently ask for.

• Website addresses involved, and where you first encountered them.
• Each payment: date, amount in CAD, method (Interac e-Transfer, wire, card, gift card, Bitcoin ATM) and the confirmation number.
• For e-Transfers: the recipient email or phone and the reference number.
• For crypto: wallet addresses and transaction IDs, and the ATM location if you used a Bitcoin ATM.
• Screenshots, and full email headers for any email involved.
• Your local police occurrence number, if you already have one.

Your report is added to a national repository that police across Canada can search. It helps investigators link your case with others run by the same group, which is how larger investigations start. Most individual reports do not become individual investigations, and there is no public case status you can follow day by day — though you can update your own report with new information.

A report is a record and an investigation route. It very rarely takes a website offline and it does not return money.

The national system does not contact the company hosting the site. Do that separately:

• Find who hosts and registered the domain with the abuse contact lookup, explained in finding an abuse contact.
• Use the hosting provider complaint template.
• For .ca domains, CIRA-certified registrars must handle abuse complaints about names they manage.
• Or report the site to Fraudpol and we contact the host, registrar and blocklists.

The CAFC regularly warns about callers impersonating police, the CRA or the CAFC itself. No agency will ask you to pay a fee to recover money or to buy gift cards. Read recovery scams before responding to anyone offering help.