How to Report Cybercrime and Online Scams: A Practical Guide (2026)

Why Reporting Matters — Even When You Feel Embarrassed

Almost everyone who is scammed or hacked feels the same mix of anger, shame and self-blame. That feeling is exactly what scammers count on: most victims never report, so the same fake shop, phishing page or impersonator account goes on to target the next person. Reporting is not about getting revenge or guaranteeing that your money comes back. It is about three practical things: creating an official record that you may need for your bank, your employer or an insurance claim; helping platforms and investigators spot a pattern and shut the operation down; and protecting the next victim, who may be less able to absorb the loss than you are. A report takes far less time than most people expect, and it is worth doing even if the amount involved is small. Small reports add up — investigators often build a case only after many victims of the same scam have each filed their own report.

There is one more reason to report promptly: time works against you. Phishing pages get taken down, chat accounts get deleted, and payment trails get harder to follow with every passing day. The sooner you report, the better the chance that a platform can freeze an account, a bank can stop a transfer, or an investigator can preserve a record before it disappears. So take a breath, then work through the steps below in order. You do not need to be a technical expert, and you do not need to have all the answers before you start.

What Counts as Reportable Cybercrime?

If you are unsure whether something is "serious enough" to report, the rule is simple: if someone used the internet to deceive you, steal from you, threaten you, or break into your accounts, it is reportable. Common examples include:

• Phishing: fake emails, text messages, calls or websites pretending to be your bank, a delivery company, a government office or a well-known brand, designed to steal your password, one-time code or card details. Our phishing protection guide explains how to spot these messages.
• Online shopping and payment fraud: you paid for goods that never arrived, received a counterfeit item, or were charged for something you never ordered. Fake shops, fake marketplace listings and fake investment platforms all fall in this category.
• Identity theft: someone opened accounts, took loans, or made purchases in your name, or your personal documents and photos are being misused. See our identity theft protection guide for the full recovery process.
• Hacked accounts: someone took over your email, social media, banking or gaming account, locked you out, or used it to scam your contacts. If this is a social media account, follow our hacked social media account recovery guide alongside your report.
• Harassment, threats and blackmail: abusive messages, stalking, threats to share private photos (often called sextortion), or demands for money in exchange for silence. Save everything and report it — do not pay, and do not negotiate alone.
• Malware and ransomware: a program that infected your device, encrypted your files and demanded payment, or silently stole your data. Do not pay a ransom if you can avoid it; report first and get advice from a trusted professional.
• Fake jobs, romance and investment scams: someone built a relationship or an opportunity that turned out to be a front for stealing money or personal information. These are crimes, not personal failures, and they are among the most commonly reported online frauds.

If you are in immediate danger, or someone is threatening you right now, contact your local emergency services first and worry about the online report afterwards. Safety always comes before paperwork.

Step 1: Preserve the Evidence First — Before You Delete Anything

Your first instinct after a scam is often to delete the embarrassing message, block the account and try to forget it. Resist that instinct until you have saved the evidence, because investigators and platforms can only act on what still exists. Work through this checklist calmly:

• Take screenshots of the scam messages, the fake profile or listing, the payment confirmation, and any threats. Make sure the screenshot shows the sender's username, the date and time, and the full message — not just a cropped piece of it.
• Save the original messages. Do not just screenshot: keep the email itself, including its full headers if your email app allows it (headers show where a message really came from). Keep chat conversations in place rather than deleting the thread.
• Copy the links and addresses exactly. Write down the full website address, the profile link, the phone number, the payment wallet address, and the account name the money was sent to. Copy and paste rather than retyping, so you do not introduce errors.
• Keep transaction records. Save bank statements, card statements, receipts, order confirmations and any reference numbers. Note the date, the amount, and the payment method for every transaction.
• Do not edit, reply to, or confront the scammer. Replying can alert them to delete evidence, and arguing in a chat thread can make the record harder to use. Block them only after you have saved what you need — and remember that blocking on your side does not delete the evidence held by the platform.
• Write a short timeline while it is fresh: when you first saw the message, what you clicked, what you paid, and when you realised something was wrong. A clear timeline makes every report you file faster and more credible.

Store your evidence in one folder — screenshots, saved messages, receipts and your timeline — so you can attach the same set to every report instead of hunting for it again each time.

Step 2: Report to the Platform Where It Happened

Platform reports are usually the fastest route to stopping an active scam. Every major platform has a reporting tool, and using it creates a record tied to the offending account:

• Social media and messaging apps: use the in-app Report option on the profile, post or message. Choose the most accurate reason (fraud, impersonation, harassment, hacked account) and attach your screenshots.
• Email providers: mark phishing messages as phishing or spam rather than just deleting them. This trains the provider's filters and can trigger an investigation into the sender.
• Marketplaces and shopping sites: report the seller or listing through the site's own fraud or dispute system, and open a buyer-protection case if one is available. Keep the order number and all messages with the seller.
• Websites and fake shops: if a fake website is still live, you can report it to your browser's safe-browsing service and to the domain registrar or hosting provider listed in the site's public records — but do not try to take the site down yourself or probe it for weaknesses. Reporting is the legal route; attacking it is not.

Platform action is not guaranteed and is rarely instant, so a platform report is a first step, not a substitute for reporting to your bank and to the authorities.

Step 3: Report to Your Bank or Payment Provider Immediately

If any money moved — by card, bank transfer, mobile wallet or any other payment method — contact your bank or payment provider as soon as possible, using the official number on the back of your card or in the provider's own app. Never use a phone number from a suspicious message. Tell them clearly that you believe the transaction was fraudulent, give them the date, amount and recipient details, and ask what options exist: freezing the card, reversing a card payment, recalling a transfer, or placing a hold on the account. Ask for a case or reference number and write it down, along with the name of the person you spoke to and the date of the call.

Speed matters here more than anywhere else. Card payments and transfers become much harder to reverse once the receiving account has withdrawn the funds, so do not wait until you have finished the other reports. For banking-specific defences — official apps only, transaction alerts, and the rule that your bank will never ask for your one-time code — see our safe online banking guide. If your card details were exposed, ask the bank to replace the card rather than simply monitoring the old one.

Step 4: Report to the Police and Cybercrime Authorities

For anything beyond a minor platform complaint — fraud, identity theft, hacked accounts, harassment or blackmail — file a report with the police or your country's official cybercrime reporting channel. The exact process differs from country to country, so use the official channel for where you live: search for your country's official cybercrime reporting service through your police force's own website or a government portal, and be suspicious of any website that claims to be the reporting service but asks you for payment. A genuine reporting service does not charge you to file a report.

When you file, be ready to give the same evidence pack you prepared in Step 1: your timeline, screenshots, links, usernames, phone numbers and transaction records. Describe what happened in plain language and in order, without exaggerating or guessing at details you are unsure about. If you do not know something, say so — a clear, honest report is far more useful than a dramatic one. Ask for a reference or case number and keep it with your evidence folder; you may need it for your bank, for follow-up, or for any later claim. If you visit a police station in person, take a printed copy of your timeline and key screenshots as well as the digital copies.

Some victims worry that the police will blame them or that the amount is too small to matter. In practice, cybercrime units expect these reports, and a small report can be the piece that links your case to a larger investigation. Filing also creates the official record that banks and platforms often ask for before they will act. If the first person you speak to is unhelpful, you are entitled to ask how to escalate the report or to file through the official online channel instead.

Beware of Fake "Recovery" Services

One of the cruellest patterns in cybercrime is the second scam: after you have been victimised, someone contacts you claiming they can recover your lost money — for a fee, a tax payment, or access to your accounts. These "recovery" services are almost always scams themselves, sometimes run by the very same criminals. The warning signs are consistent: they contact you first, they promise guaranteed recovery, they demand upfront payment, they ask for your passwords or remote access to your device, or they pressure you to act immediately. A legitimate bank, platform or law-enforcement agency will never ask you to pay a fee to recover stolen funds, and will never ask for your password or one-time code. If someone offers recovery, stop, do not pay, and report that contact through the same channels described above.

What Happens After You Report? Realistic Expectations

Honesty matters here, because false hope leads to bad decisions. In many cases, especially where money was sent abroad or through hard-to-trace methods, full recovery is not possible, and investigations can take months. That does not mean your report was wasted. Here is what realistically happens:

• You receive a reference number. Keep it. It is your proof that the report exists and the key to any follow-up.
• The platform or bank reviews the case. Accounts may be suspended, listings removed, or transactions reversed — sometimes quickly, sometimes after a review period. You may be asked for more evidence; respond promptly.
• Authorities may not update you often. Investigations are slow and often confidential, so silence does not mean nothing is happening. You can follow up politely using your reference number after a reasonable interval.
• Your report feeds a bigger picture. Repeated reports about the same phone number, wallet address or fake shop are how investigators identify organised operations and how platforms decide to ban a network rather than one account.

If a bank or platform rejects your claim, ask for the decision in writing and for the appeal process. Keep copies of every response alongside your original evidence. If you believe you were treated unfairly, your country's consumer-protection or financial-complaints service is the next official route — again, use the official channel, not a paid intermediary.

Recovering Your Accounts and Your Money

Reporting and recovery run in parallel. While your reports are being processed, lock down what the attacker touched:

• Change passwords on every account that shared the compromised password, starting with your email — the master key to password resets everywhere else. Use a unique, strong password for each account and turn on two-factor authentication.
• Recover hacked accounts through each provider's official recovery page, and check for changes the attacker may have made: added recovery emails, forwarding rules, or new payment methods. Our hacked social media account recovery guide walks through this in order.
• Check for a wider data breach. If your details were exposed, assume other accounts may be at risk too. Our data breach recovery guide covers the first-hour, first-day and first-week checklist.
• Watch for identity misuse. Monitor bank and card statements, check for accounts opened in your name, and consider the protective steps in our identity theft protection guide if personal documents were involved.
• Warn your contacts. If your account sent scam messages to friends or family, tell them plainly that those messages were not from you and that they should not click any links in them.

Protecting Yourself Afterwards

The best time to rebuild your defences is right after an incident, while the lesson is vivid. A few habits make the next attempt far less likely to succeed: use a password manager and unique passwords everywhere; turn on two-factor authentication with an authenticator app rather than SMS where possible; pause before clicking links in unexpected messages and verify urgent requests through a separate, trusted channel; keep your devices and apps updated; and treat any message that creates urgency — "act now or lose your account" — as a warning sign in itself. Share what you learned with family members, especially older relatives and teenagers, because scammers target the people around you too. Reporting was the responsible step; teaching others is the step that multiplies its effect.

Finally, look after yourself. Being scammed is a crime committed against you, not a personal failing, and the stress that follows is real. Talk to someone you trust, keep your evidence folder organised so the process does not keep reopening the wound, and remember that the steps in this guide — preserve, report to the platform, report to your bank, report to the authorities, recover, and rebuild — are the same steps professionals recommend, in the same order, for a reason. They give you the best possible chance of recovery, and they make the internet a little safer for everyone else.

Quick Checklist: Reporting Cybercrime

• Stay calm and do not delete messages, chats or receipts.
• Screenshot everything, save message headers, and copy links and account details exactly.
• Write a short timeline of what happened and when.
• Report to the platform where the scam happened.
• Call your bank or payment provider immediately if money moved — get a reference number.
• File a report with the police or your country's official cybercrime reporting channel.
• Never pay a "recovery" service and never share passwords or one-time codes with anyone claiming to help.
• Change passwords, enable two-factor authentication, and recover any hacked accounts.
• Keep your reference numbers and follow up politely if you hear nothing.
• Tell family and friends so the same scam cannot catch them next.

Key Takeaways

• Report every scam and hack, however small — reports build the cases that shut operations down.
• Evidence first: screenshots, original messages, links, and transaction records, saved before anything is deleted.
• Report in three places: the platform, your bank or payment provider, and the police or official cybercrime channel.
• Use only official channels — and beware of fake recovery services that demand upfront fees.
• Recovery takes time and is not guaranteed; a reference number and a written record are your protection.
• Recover accounts, change passwords, enable two-factor authentication, and warn your contacts.
• Never retaliate or "hack back" — reporting through legal channels is the only safe response.