How to report cybercrime in the United States

The Internet Crime Complaint Center is run by the FBI. It accepts complaints about crimes that were committed through the internet: investment and romance fraud where money was sent, business email compromise, ransomware, extortion, account takeovers, non-delivery of goods paid for online, and similar offences. Complaints can come from victims or from third parties who have knowledge of the crime.

What IC3 is for: getting your case into the federal system, where analysts look for patterns across complaints and refer cases to law enforcement. Your complaint may be combined with others involving the same wallet, bank account, email address or website.

What IC3 is not for: emergencies (call 911), general consumer complaints about a company that is merely disappointing, or getting a website blocked. IC3 does not act as a takedown service and does not give you a case manager.

The Federal Trade Commission collects reports about scams, fraudulent business practices, fake shops, impostors and unwanted calls or texts. Reports go into the Consumer Sentinel database, which more than a thousand law enforcement agencies can search.

What it is for: documenting consumer fraud so that patterns lead to enforcement actions against companies and operators. After you submit, the site gives you next-step advice specific to what happened, which is genuinely useful.

What it is not for: resolving your individual case. The FTC says plainly that it does not resolve individual complaints. If your identity was stolen, use IdentityTheft.gov instead, which produces a recovery plan and an identity theft report.

IC3's form is long and does not save drafts well. Collect these first:

• The full URL of every website involved, and the date you first saw it.
• Each payment: date, amount, method (wire, Zelle, card, gift card, crypto), and the transaction ID or wire reference.
• For crypto: the wallet addresses you sent to and the transaction hashes.
• The recipient's bank name and account details if you wired money.
• Screenshots of the site, chats and payment confirmations.
• Full email headers for any email involved — the "show original" view, not a forwarded copy.
• Names, usernames, phone numbers and emails the other party used, even if they are clearly fake.

Save a copy of your submitted complaint. IC3 does not let you edit it after submission.

You get a confirmation and a complaint ID. After that, for most individual complaints, you will hear nothing further. That is normal. Your data is analysed alongside other complaints, and cases that share identifiers or reach thresholds are referred to FBI field offices or other agencies.

The honest part: an IC3 or FTC report is a record and an investigation route. It very rarely takes a website offline, and neither portal offers a status page you can check day by day. Where the FBI's Recovery Asset Team does act on business email compromise wires, speed matters — which is why your bank should hear about a wire the same day, before you even start the form.

If you also want a local police report — some banks and insurers ask for one — file it with your city or county police and give them your IC3 complaint ID.

A federal complaint does not reach the company hosting the scam site. To stop it from catching the next person, report it on the website track:

• Find the host and registrar with our free abuse contact lookup, or read how to find an abuse contact.
• Use the template in reporting abuse to a hosting provider.
• Or report the site to Fraudpol and we contact the host, registrar and blocklists for you.

Phishing emails can also be forwarded to the Anti-Phishing Working Group at reportphishing@apwg.org, and phishing texts to 7726 (SPAM) on most US carriers.

Scammers know victims file reports. Calls or emails claiming to be from "the FBI's IC3 recovery department" or offering to recover your funds for a fee are themselves frauds; the FBI does not charge victims or contact them to ask for payment. See recovery scams and our guide on reporting to the FBI.