Reporting a Cybercrime
Most cybercrime goes unreported, usually out of embarrassment or a belief that nothing will come of it. Both are mistakes. Reporting feeds the investigations that dismantle criminal infrastructure, it's often required to recover money or dispute fraud, and — for wire fraud especially — a fast report is sometimes the only thing that gets funds back. Here's where to go and what to have ready.
Where to report (United States)
| Situation | Where |
|---|---|
| Most cybercrime, online fraud, wire/BEC fraud | IC3.gov — the FBI's Internet Crime Complaint Center |
| Scams, deceptive business, fraud (general) | ReportFraud.ftc.gov — Federal Trade Commission |
| Identity theft (recovery plan + affidavit) | IdentityTheft.gov — FTC |
| Money already sent by wire / BEC | Your bank immediately, then IC3 (ask about the Financial Fraud Kill Chain) |
| Immediate danger, in-progress crime | Local police / 911 |
Outside the U.S., report to your national cybercrime unit (for example, Action Fraud in the UK) and your bank. When in doubt, local police can route you.
Speed matters most for stolen money
If you've wired money to a fraudster — a fake invoice, a spoofed executive, a bogus home-closing — call your bank right now, before anything else. Banks and the FBI can sometimes freeze or recall funds through the Financial Fraud Kill Chain, but only within a short window, often measured in hours. Every minute of hesitation lowers the odds. Report to IC3 in parallel and reference the transfer details.
What to gather before you file
- Dates, times, and amounts.
- The scammer's contact details — email addresses, phone numbers, usernames, websites, wallet or account numbers.
- Transaction records: confirmation numbers, receipts, bank references.
- The original messages — keep the emails and texts; don't delete them. Screenshots help.
- Any names, titles, or organizations the scammer impersonated.
Also worth doing
- Report phishing to your email provider and, at work, to your IT/security team — you're rarely the only target.
- Notify affected institutions — banks, the impersonated company — so they can warn others and lock accounts.
- Keep a log. Case numbers and dated records make disputes and reimbursements far easier.
You will not be judged for reporting, and you're not "wasting their time." Aggregated reports are how patterns get spotted and networks get taken down — your one complaint may be the data point that connects a case.
Stop staying silent out of embarrassment. Think of your report as evidence in a bigger case. Connect with your bank first when money moved — the recovery window is measured in hours.