MalwareZero

Where to report a scam, and which agency actually handles what

Updated August 6, 2026

You're not really asking where to file. You're asking which office will read it and do something, and those are two different lists. Sort by what happened: money that moved online goes to the FBI's IC3 at ic3.gov, mail or packages go to the Postal Inspection Service, calls and texts go to the FCC, a bank or payment app mishandling your claim goes to the CFPB, and everything else goes to reportfraud.ftc.gov. Of that set, the CFPB is the one that routes your complaint straight to the company, and your state attorney general is the office most likely to write back.

Before any of that, one thing comes first. If money left your account in the last few days, your bank or the payment app is the only party that can realistically claw it back, and the window is measured in hours. Call them, then file the reports.

IC3, which is the FBI

The Internet Crime Complaint Center at ic3.gov is the FBI's central intake for cyber-enabled crime. That covers most of what people mean by online scam: romance fraud, crypto and investment schemes, business email compromise, tech support fraud, account takeovers, and phishing that caused a real loss.

Set your expectations honestly. IC3 states outright that it can't respond to every submission given the volume it receives each year. Analysts read and research complaints and pass information to law enforcement and partner agencies where it fits, but IC3 doesn't investigate anything itself and won't give you a status update. What gets opened is decided by whichever agency receives the referral.

Detail is what makes a report worth anything there. Include exact amounts and dates, the account number or crypto wallet the money went to, the sender's email address plus full email headers if you can get them, phone numbers, website addresses, and usernames. A filing with a wallet address and a timestamp is a lead. A filing that says you got scammed online is a statistic.

Two things don't belong at IC3. Anything involving a child goes to the National Center for Missing and Exploited Children, and terrorism threats go to tips.fbi.gov.

FTC ReportFraud, the catch-all

reportfraud.ftc.gov is the general-purpose intake. When you can't work out where something belongs, it belongs here. Fake stores, imposter calls, prize pitches, subscription traps, bogus job offers, fake charities, all of it.

The FTC doesn't resolve individual complaints and won't advocate for you against a company. What it does is feed your report into a database that federal, state, and local investigators can search, which is how patterns surface and how cases get built against operations rather than one-off transactions. Knowing that going in saves the disappointment later.

Two related FTC sites are easy to miss. If someone opened accounts, filed taxes, or took a loan in your name, use identitytheft.gov instead, which builds you a step by step recovery plan and produces the formal report that creditors and credit bureaus ask for. If your problem is sales calls rather than fraud, that's donotcall.gov.

US Postal Inspection Service

If the US Mail touched it at any point, USPIS has jurisdiction, and their definition is broader than people assume: any fraud using the mail counts as mail fraud, even when the pitch started by phone or online. These are federal agents with arrest powers, not a complaints desk.

Reporting starts at uspis.gov/report, where the categories are kept separate:

This is where the fake "your package is held, pay the redelivery fee" texts belong. If something arrived that you never ordered, the explanation is usually a brushing operation using your address as a prop, which is annoying rather than dangerous. If there was a card with a QR code in the box, though, that card is the part doing the damage.

FCC, for calls and texts

Robocalls, spoofed caller ID, and scam texts go to consumercomplaints.fcc.gov. The FCC won't chase an individual caller for you. It uses complaint volume to build enforcement actions against carriers and originating networks, and it publishes the underlying data.

For some categories the FCC shares your informal complaint with the company involved and expects a written reply. I couldn't confirm today whether that holds across every category, so don't file expecting a response. Treat it as contributing evidence. The exception is when your own phone or internet provider is the problem, in which case this is the lever that moves them.

CFPB, the one that usually produces an answer

The Consumer Financial Protection Bureau works differently from the rest, and people underuse it badly. It takes complaints about checking and savings accounts, credit cards, credit reports, debt collection, mortgages, student loans, vehicle loans, payday and personal loans, prepaid cards, and money transfers including virtual currency.

Here's the difference. Your complaint gets routed to the company, and companies generally respond within 15 days. Where something needs longer, the company gives a progress update and then a final response within 60 days. You get 60 days to say whether the answer was any good, and an anonymized version goes into a public database.

So when your bank shrugged at a disputed transaction, or a money transfer app closed your fraud claim with a form letter, this is the filing that produces a named human writing back. Put everything into the first submission, documents included (they accept up to 50 pages), because you generally can't file twice about the same issue. It's at consumerfinance.gov/complaint.

Your state attorney general

All 50 states, DC, Puerto Rico, Guam, the US Virgin Islands, American Samoa, and the Northern Mariana Islands have an attorney general, and most have a consumer protection division underneath. The directory at naag.org/find-my-ag lists every one with a link to the office.

Many of these offices do informal mediation, meaning a staff member contacts the business on your behalf and asks what happened. That's the realistic route to money back from a business that took it, as distinct from an anonymous criminal who's already gone. Quality and staffing vary enormously by state, so I can't tell you whether yours is fast without knowing which one it is.

What comes back after you file

Why file when the odds are what they are

I'll be straight about this. One report rarely produces one outcome for the person who filed it. What it does is make an operation visible, and visibility is the prerequisite for everything else. Prosecutors need a pattern, a victim count, and a documented loss total before a case is worth bringing, and those numbers get assembled from exactly these filings.

There's a selfish reason too. A dated report is a document. Banks, insurers, and credit bureaus take a dispute more seriously when you can hand them a report number, and it fixes the date you noticed, which matters for the liability windows that decide whether you're on the hook.

Quick sorting list

A call from what sounded like a relative in trouble asking for money fast sorts to IC3 and the FTC, same as anything else. Filing it won't stop the next one. These calls run on a few seconds of scraped audio, and what stops them is a word your family agrees on before it happens, tested on a call nobody is panicking during. A report is a record. It isn't an intervention.