Learn Dark Web

Cybersecurity

How to Report Phishing: US and UK

Reporting phishing takes about a minute, costs nothing, and is the most useful thing you can do after protecting yourself. Every report helps investigators track campaigns and helps providers take malicious sites down faster. This guide covers the official reporting routes in the United States and the United Kingdom, what details to include, and how to report scams to the company being impersonated.

By Abdul Hannan · Published 14 November 2026 · Updated 14 November 2026

Note. Report through official channels only: the FBI Internet Crime Complaint Center (ic3.gov) in the US, and report@phishing.gov.uk in the UK. Never use a reporting form or link you found inside a suspicious message, and never pay anyone to report phishing for you.

Why reporting matters

A phishing message you delete is a phishing message that keeps working. The same campaign is usually sent to thousands of people, and the malicious site behind it stays live until someone reports it. Reports from the public are one of the main ways law enforcement, security providers and the impersonated companies learn that a campaign exists — and how large it is.

Reporting also protects people you will never meet. When a malicious site is taken down quickly, the next person who clicks the link gets a dead page instead of a fake login screen. When investigators receive hundreds of reports about the same campaign, they can link it to other crimes, freeze accounts, and sometimes identify the people behind it. Your one report is a small piece of a much larger picture.

There is also a practical reason: if you lost money, a report creates a record. Your bank, your insurer, or the police may ask for a reference number, and in the United States an IC3 complaint gives you one. Keep the reference safe, along with your notes of what happened.

Report phishing in the United States

The main reporting route is the FBI Internet Crime Complaint Center, known as IC3, at ic3.gov. You can file a complaint online describing what happened: the message, the link, what you entered or paid, and any loss. IC3 states that it reviews complaints and shares them with law enforcement and regulatory partners. You will receive a complaint number — keep it.

If the phishing impersonated a specific company, report it to that company too. Most large companies publish a phishing reporting address — often something like phishing at the company domain — or a reporting form on their security page. Check the company's official website, not the message, for the address. Forward the original message with its headers if you can; headers show where a message really came from, and they are far more useful than a screenshot alone.

If money was stolen, report it to your bank immediately and to the police as fraud, as well as to IC3. If the fraud involved a purchase or a service, report it to the Federal Trade Commission at ReportFraud.ftc.gov. If identity theft is involved — someone used your details to open accounts or take over existing ones — go to IdentityTheft.gov, which walks you through a recovery plan and produces a personalised set of steps.

Report phishing in the United Kingdom

In the UK, forward phishing emails to report@phishing.gov.uk — the National Cyber Security Centre's Suspicious Email Reporting Service. Forward the email as an attachment if your email service allows it, because that preserves the headers. The NCSC uses reports to find and take down malicious sites, and it publishes figures on how many it has removed.

For suspicious text messages, forward the text to 7726, free of charge. The number works across UK mobile networks and the report goes to your provider, which uses it to block the sender and warn other users. You can also report smishing texts to the NCSC in the same way. If a phone call tried to scam you, report it to Action Fraud, the UK's national fraud reporting service, and tell your bank if money or details were involved.

If the phishing impersonated a UK company, bank or government department, report it to that organisation as well — banks and government departments publish phishing reporting addresses on their official websites. If you lost money, report it to Action Fraud and to your bank immediately, and keep the crime reference number.

Reporting in other countries

Most countries have a national reporting route, and the pattern is the same everywhere: a cyber-crime or fraud reporting service, plus the impersonated company. In Canada, report phishing to the Canadian Anti-Fraud Centre. In Australia, report to Scamwatch. In the European Union, your national computer security incident response team or consumer protection authority is the starting point — your government's official website will name it.

Wherever you are, the same rule applies: use the official channel named on a government or law-enforcement website, never a link inside a suspicious message. If you are unsure which body covers your country, search your government's official domain for phishing reporting, or ask your bank — banks receive these reports constantly and know the local route.

What to include in a report

A good report is short and factual. Include the sender's full email address or phone number, the date and time you received the message, what the message claimed, the link or QR code it contained, and what you did — whether you clicked, entered details, downloaded a file, or paid money. If you lost money, say how much and how you paid.

Do not delete the original message before you report it, and do not edit it. Forwarding the message as an attachment preserves the technical headers, which show the real sending server and the path the message took — information that a screenshot cannot carry. If you must use screenshots, include the full sender address and the full link, not just the pretty part of the message.

If you have already changed passwords, contacted your bank, or run a scan, say so briefly. Investigators need to know what has already been done, and what still needs doing, to prioritise your report correctly.

  • The sender's full address or number, and the date and time.
  • What the message claimed and what it asked you to do.
  • The link, QR code, or attachment involved.
  • What you did — clicked, entered, downloaded, or paid.
  • Any loss, and what you have already done about it.

Report it to the company being impersonated

Companies being impersonated want to know — a phishing campaign using their brand damages their customers and their reputation. Most large companies publish a dedicated phishing address on their website, usually under security, help, or fraud. Search the company's official website for phishing or report a scam, and use the address or form you find there.

When you report to the company, forward the original message with headers where possible, and say what the message asked you to do. The company's security team can use the report to get the fake site taken down, warn customers, and sometimes trace how the campaign was built. Do not expect a personal reply — high-volume reporting addresses are largely automated — but the report is still used.

Be careful of fake reporting pages. Criminals sometimes create pages that claim to be a reporting tool and ask for your details. Only use reporting addresses and forms published on the organisation's own official website, reached by typing the address yourself or through the official app.

After you report: what happens next

Do not expect a personal update on your report. Reporting services handle enormous volumes, and most send only an automated acknowledgement. That does not mean your report was ignored — it joins others about the same campaign, and the combined picture is what drives takedowns and investigations.

What you should expect is action on your own side: the password changes, bank calls and scans from the triage guide are your responsibility, and reporting does not replace them. If you lost money, follow up with your bank and with the police, using the reference numbers you were given, and keep notes of every step and every call.

Finally, tell the people around you. A quick warning to colleagues or family — this message is going around, do not click it — is often more immediately useful than any official channel, because the people you know are the most likely next targets of the same campaign.

Sources

Last checked: 14 November 2026.

Frequently asked questions

Where do I report phishing in the US?

Report it to the FBI Internet Crime Complaint Center at ic3.gov. If money was stolen, also tell your bank and report the fraud at ReportFraud.ftc.gov. If identity theft is involved, go to IdentityTheft.gov for a recovery plan.

Where do I report phishing in the UK?

Forward phishing emails to report@phishing.gov.uk, and forward suspicious texts to 7726. If you lost money, report it to Action Fraud and to your bank straight away.

What details should I include when I report phishing?

The sender's full address or number, the date and time, what the message claimed, the link or attachment, what you did, and any loss. Forward the original message with headers if you can, and do not delete it before reporting.

Should I report phishing to the company being impersonated?

Yes. Most large companies publish a phishing reporting address on their official website. Forward the original message with headers — it helps them take the fake site down and warn customers.

Will I get a reply to my phishing report?

Usually only an automated acknowledgement. Reporting services handle very high volumes, and your report joins others about the same campaign. The value is in the combined picture, which drives takedowns and investigations.

Is there a charge for reporting phishing?

No. Official reporting channels are free. Never pay anyone to report phishing for you, and never use a reporting link found inside a suspicious message.