The appropriate reporting channel depends on the country, the type of incident and whether money was lost or an account was compromised. Preserve evidence first, then use the official channels of the national CERT/CSIRT, bank, payment provider, consumer protection authority or law enforcement agency.
Do not delete the message, payment history or suspicious shop account before saving evidence that may help your bank, national CSIRT, payment provider or law enforcement agency.
This list is informational and does not replace official guidance. When submitting a report, use official government, bank, payment provider and national CERT/CSIRT websites.
Suspicious domains, e-mails, SMS messages and fake shops can be reported through CERT Polska. Financial loss, unauthorized transactions or account takeover should also be reported to the bank and to the Police or prosecutor’s office.
In the European Union, incidents are usually reported to the national CERT/CSIRT, police or national cyber security centre. ENISA supports the CSIRTs Network, but end users should normally report through the official channel in their own country.
In the United States, online fraud and cyber-enabled crime can be reported to FBI IC3. Consumer scams can also be reported to the FTC, and significant cyber incidents to CISA.
Suspicious e-mails and websites can be reported to the NCSC. If money was lost, an account was compromised or a crime is suspected, use the official fraud or cybercrime reporting channel for your part of the United Kingdom.
In Germany, use BSI guidance, report suspicious messages to the relevant consumer protection channels and report financial loss to the police.
If your country is not listed, start with your bank or payment provider. Then look for the official national CERT/CSIRT and the official cybercrime or consumer protection reporting channel in your country.
Save the message, headers, link, domain, screenshots and payment confirmations.
Report the domain, e-mail, SMS or fake shop to the relevant CERT/CSIRT or national cyber security centre.
If money was lost, an account was taken over or data was stolen, contact your bank and law enforcement.