A friend of mine nearly wired $4,000 to a “supplier” whose website looked flawless — professional logo, customer testimonials, a live chat agent who answered in seconds. The only problem: the real supplier had never heard of the site. It was a clone built in a weekend, and it had already taken money from three other buyers that month. When she asked me how to report a fake website, my first answer surprised her: there’s no single “report” button for the internet. But there are half a dozen channels that each do a different job — and if you hit the right ones, you can get the site flagged, blocked, and eventually taken down.
Most people report nowhere. They close the tab, feel foolish, and move on. That’s exactly what scammers count on: the average fake site stays live for weeks because nobody files anything. This guide walks through every reporting channel that actually works — what each one does, what it doesn’t do, and the order to use them in — plus how to spot the fakes in the first place and what to do if you already typed in your details.
How to Report a Fake Website — and Why It Actually Matters
Let’s be honest about what reporting does and doesn’t do. Filing a report will not get your money back by itself. No agency assigns a detective to your individual case because you filled out a form. So why bother?
Because reports are how the system sees the scam. The FTC’s fraud reports feed Consumer Sentinel, a database shared with more than a thousand law enforcement agencies — that’s how scattered individual complaints turn into pattern cases and takedowns. Browser-level reports to Google Safe Browsing can trigger full-screen red warnings that stop the next visitor cold. Registrar and hosting complaints can get the domain suspended entirely. Each report is a data point; enough data points and the operation behind the site becomes visible to people with subpoena power.
There’s also a simpler reason: the next victim. The fake supplier site my friend found had been reported by exactly one of its earlier victims — and that single Google Safe Browsing report is what finally put the red warning page up. One report. That’s sometimes all it takes to break the chain.
Channel 1: Report to Google Safe Browsing
This is the highest-leverage report you can file, because it protects people at the browser level. When Google confirms a site is phishing or distributing malware, Chrome, Firefox, Safari, and others display a full-screen “Deceptive site ahead” warning that stops the overwhelming majority of visitors before they interact with the page.
- Go to Google’s phishing report page: safebrowsing.google.com/safebrowsing/report_phish/
- Paste the full URL of the fake site exactly as it appears, including the https:// part.
- Describe briefly what the site is doing — impersonating a bank, harvesting logins, running a fake store.
- Submit. Google notes these reports feed its automated detection systems; confirmed threats get the warning treatment across browsers that use Safe Browsing data.
Worth knowing: Firefox has this built in — Help menu → “Report Deceptive Site” sends the page straight to Safe Browsing without leaving the browser. Safari draws on the same shared threat data, so one good report propagates widely.
Channel 2: Report to the FTC and the FBI
These are the law-enforcement reports — slower, but they’re the ones that build cases.
The FTC: ReportFraud.ftc.gov. This is the primary U.S. channel for reporting scams and fraud. You can file even if you lost no money — suspected fraud counts. The FTC doesn’t resolve individual complaints, but it uses the data to build enforcement cases, and your report number is useful if you later dispute charges with your bank. The process takes a few minutes and asks for the site’s URL, what happened, and any payment details.
The FBI’s IC3: ic3.gov. The Internet Crime Complaint Center is the FBI’s intake for internet-enabled crime. File here especially if money changed hands or if the site is part of a larger fraud operation. Include everything: the URL, dates, amounts, payment methods, wallet addresses for crypto, and any email addresses or phone numbers connected to the site. The IC3’s own guidance asks victims to file regardless of the amount, because small reports connect into big investigations.
File with both. They maintain separate databases, and a site that’s invisible in one system may already be under scrutiny in another.
Channel 3: Report to the Domain Registrar and the Hosting Company
This is the channel that can actually kill the site. Google warnings scare visitors away; registrar and hosting complaints can pull the plug.
Every domain has a registrar — the company that sold the domain name — and nearly every site has a hosting company whose servers deliver its pages. Both typically have abuse-reporting addresses (usually abuse@[company].com) and web forms, and both are obligated under their own terms of service to act on fraud.
- Find out who they are. Run a WHOIS lookup on the domain (several free tools do this) to identify the registrar. To find the host, note that many scam sites sit behind Cloudflare or similar services — in that case, report to Cloudflare’s abuse channel too, since they can identify the actual host.
- Write a concise abuse report. Include the domain, the specific fraudulent pages (full URLs), what the fraud is, screenshots, and any correspondence. Stick to facts: what the site claims, what’s false, what you lost.
- Send it to both the registrar’s and the host’s abuse contacts. These are separate companies and separate reports. The registrar can suspend the domain; the host can suspend the server. Either one ends the site.
- Follow up once. Give it a week, then send one follow-up referencing your original report. Abuse desks are backlogged; polite persistence helps.
A practical note: scammers re-register quickly under new domains, which is why this channel works best combined with the browser-level reports above. Take down the domain AND flag it in Safe Browsing, and the clone has to start from zero visibility.
Channel 4: Report to Microsoft and the Anti-Phishing Working Group
Two more high-value reports that take minutes:
Microsoft SmartScreen: Microsoft accepts phishing and malware site reports at its Report an Unsafe Site page — you can submit up to 100 URLs at once. Confirmed threats trigger warnings in Microsoft Edge and across products using SmartScreen filtering, which covers a huge share of Windows users Google’s list might miss.
APWG: The Anti-Phishing Working Group is an international coalition of tech companies, law enforcement, and financial institutions. Forward phishing details to reportphishing@apwg.org. Their data feeds directly into industry blocklists used by email providers and security vendors worldwide.
Channel 5: Tell the Company Being Impersonated
If the fake site impersonates a real business — a bank, a retailer, a government agency — tell that business. Most major companies have a dedicated fraud or phishing-report address (often something like phishing@[company].com). Your report may be the detail that lets their security team issue a customer warning or pursue the domain legally. Banks in particular move fast on impersonation, because it’s their customers’ money at stake.
Red Flags the Site Was Fake
For next time — and there will be a next time, because these sites are everywhere — the signs that a website isn’t what it claims:
- The domain is slightly off. Extra words, misspellings, odd endings: yourbank-secure.com instead of yourbank.com. Scammers live in the gap between a glance and a careful read.
- No HTTPS, or a brand-new domain. “Not Secure” in the address bar is an instant walk-away. And a WHOIS record showing the domain was registered last Tuesday is a bad sign for a “ten-year-old company.”
- Prices or promises that don’t make sense. Eighty percent off designer goods, guaranteed investment returns, “act now” countdown timers on everything — pressure plus fantasy pricing equals fraud.
- No verifiable contact details. A contact form and a Gmail address instead of a real street address, a real phone number, and a registered business name.
- Copied content. Paste a distinctive sentence from the site into a search engine. Fake sites often steal text wholesale from the real company — or from other fake sites.
- Payment only by wire, crypto, or gift cards. Legitimate businesses take cards, which can be charged back. Scammers demand payment methods that can’t be reversed.
What to Do If You Already Entered Your Details
Damage control, in order:
- If you entered card or bank details: call your bank immediately, report the fraud, and ask about reversing charges and reissuing the card. Speed matters more than anything else here.
- If you entered login credentials: change that password everywhere you reused it (and stop reusing passwords), and turn on two-factor authentication on every important account.
- If you entered your Social Security number: go to IdentityTheft.gov — the FTC’s identity-theft portal — and follow its recovery plan. Consider placing a free fraud alert with one of the three credit bureaus (Equifax, Experian, TransUnion); one alert notifies all three.
- Scan your device for malware if you downloaded anything from the site.
- Then file the reports above — all of them. Your report is evidence, and it protects the next person.
Knowing how to report a fake website is one of those skills you hope to never use and should absolutely have ready. Bookmark the Google Safe Browsing report page and ReportFraud.ftc.gov now, while you’re calm — because the day you need them, you’ll be rattled, and rattled people skip steps. Five reports, twenty minutes, and a scam site that took a weekend to build can be warning-flagged, delisted, and suspended within days. That’s a good trade.
Sources
- Google Safe Browsing — Report a phishing page
- Microsoft Security Intelligence — Report an Unsafe Site
- FTC — ReportFraud.ftc.gov
- FBI — Internet Crime Complaint Center (IC3)
- LegalClarity — How to Report a Fraudulent Website: FTC, FBI, and More
- Keepnet Labs — Comprehensive Guide to Reporting Phishing
Last reviewed: October 2026
This article is for education only and is not financial or legal advice.