How to Report a Scam Website: Who to Tell and Why

If you already paid, start with your bank

Speed matters more than paperwork here. A card payment can usually be disputed as a chargeback: call the number on the back of the card and tell them the payment was fraud. A bank transfer is harder to reverse, but a bank can sometimes recall money that hasn't been withdrawn yet, so call the same day. For PayPal, open a dispute in the Resolution Center.

Crypto works differently. Nobody can reverse a confirmed transaction, so the useful moves are to tell the exchange you sent from, keep the transaction hash, and report the receiving wallet (more on that below). If you paid in USDT, it helps to know that the issuer can freeze an address it links to crime, usually alongside law enforcement. Our live USDT freeze tracker shows those freezes as they happen.

Save the evidence before the site disappears

Scam sites rarely last. Many are taken down, moved or rebuilt under a new address within weeks, and when the page goes, most of what an investigator needs goes with it. So collect it first:

• The full web address, copied from the address bar, including everything after the domain name.
• Screenshots of the home page, the checkout or deposit page, and anything naming a company, licence or address.
• Your payment records: the card statement line, the bank reference, the PayPal transaction ID, or the crypto transaction hash with both wallet addresses.
• Emails, chat logs and phone numbers. Export WhatsApp or Telegram chats instead of screenshotting them message by message.

Then save a public copy of the page with the Internet Archive's Save Page Now. It keeps a timestamped snapshot that anyone, the police included, can open later, and it takes about a minute.

While you do this, stop replying to the site and its support chat. Anything you send helps them, and what you need is already on your screen.

Get browsers to warn the next visitor

This is the report that protects the most people, fastest. Chrome and Firefox check every address against Google Safe Browsing, and so does Safari in most regions, so once a site is confirmed, anyone who clicks its link gets a red warning page instead. Microsoft Edge relies on its own list, SmartScreen.

• Report it to Google Safe Browsing with the address and one line on what the page does.
• Report it to Microsoft to cover Edge and Windows.
• Report it to Netcraft, which passes confirmed phishing to browser makers, hosts and registrars and often gets sites removed.
• If the scam reached you by email, forward the message to the Anti-Phishing Working Group at [email protected] as well.

Be specific in the note. "Fake investment platform that takes deposits and promises fixed daily returns" gets reviewed faster than "scam".

Reporting a phishing email or text

If the scam reached you as an email, use your mail service's "Report phishing" option as well as the forwarding address above, because that feeds the filters protecting everyone else on the same service. In the UK, the National Cyber Security Centre takes suspicious emails at [email protected]. For a scam text message, your phone network's help pages give the number to forward it to.

Tell the companies that keep the site online

Registrar abuse contact

The email address or form a domain registrar publishes for reports of fraud, phishing or malware on the domain names it sells. It appears in each domain's public registration record.

Every website depends on two businesses with rules against fraud: the registrar that sold the domain name, and the company hosting its pages. Both publish abuse contacts, and both can switch a site off.

To find the registrar, look the domain up at ICANN Lookup, which lists the registrar and its abuse address. The hosting company is harder to spot, but a TrustSniffer report shows it. Our report on smarttradefx.live, for example, lists the registrar (Dynadot), the hosting network (FranTech Solutions) and the server's country in its domain intelligence section, which is exactly what an abuse report needs.

Some sites hide their real host behind Cloudflare. For those, use Cloudflare's abuse form: Cloudflare doesn't store the site's content, but it forwards phishing and malware reports to the hosting provider behind it. Keep every abuse report short: the address, what the site does, how you know, and the link to your archived copy.

File a report with the authorities

Don't expect a personal reply, and don't read silence as nothing happening. Reports are pooled, and it's the pattern across many victims that opens an investigation and gets domains and payment accounts seized. Use the service for where you live:

• United States: the FTC at ReportFraud.ftc.gov for any scam, and the FBI's Internet Crime Complaint Center at ic3.gov when money was lost online.
• United Kingdom: Report Fraud, or 0300 123 2040, which replaced Action Fraud in England, Wales and Northern Ireland in December 2025. In Scotland, call Police Scotland on 101. You can also send a suspicious site to the NCSC through its scam website form.
• Canada: the Canadian Anti-Fraud Centre.
• Australia: Scamwatch.
• European Union: your national police, most of which take reports online. Europol keeps a list of national reporting pages.

Those reports add up to something. The FBI's 2024 Internet Crime Report counted 859,532 complaints and $16.6 billion in reported losses, with investment fraud the costliest category. Every one of those numbers started as somebody's report.

Crypto scams: report the wallet too

A scam website costs almost nothing to replace. The wallet that collected the money often stays in use across several sites, so it's often the better thing to report.

• Report the receiving address on Chainabuse, a public database that exchanges and investigators search.
• Run it through our wallet checker, which shows whether the address has received funds from sanctioned or scam-linked sources, and pass that to your exchange.
• If the payment was in USDT, read how to check if a USDT address is blacklisted. A frozen address can't move what it holds, and issuer freezes are one of the few things that stop stolen USDT moving on.

Put the site on the public record

Official reports stay private, so the next person who searches the site's name won't see any of them. A public record is what helps that person.

Run the address through our website checker. Each analysis is published as a report at trustsniffer.com/report/ followed by the domain, readable by anyone and findable in search, and it gives you the registrar and hosting details for the abuse reports above. Published reports are listed in our directory. If you think a result is wrong, our corrections page explains how to tell us.

What usually happens next

Browser blocklists tend to act first, sometimes within hours of a clear report. Registrars and hosts vary: some suspend quickly, others ask for more evidence or never answer. Police reports go into national databases, and you may hear nothing unless an investigation needs you.

Judge it by the result, not by the replies. A site that browsers block, that its registrar suspends and that the police have on file has far fewer days left to find its next victim.

The short version

1. If you paid, call your bank or card issuer, or open a PayPal dispute, today.
2. Save the address, screenshots, payment records and chats, and archive the page.
3. Report it to Google Safe Browsing, Microsoft and Netcraft.
4. Report it to the registrar and the hosting company.
5. File a report with your national fraud service.
6. For crypto, report the wallet on Chainabuse and tell your exchange.
7. Ignore anyone offering to recover the money for a fee.