Where to Report Online Fraud from Darknet Scams by Country

File with your country's official cybercrime intake first, then notify the exchange or service where the money moved. This is a sequence, not a choice. It preserves evidence and puts the report inside a jurisdiction that can act. A victim in Canada whose funds moved through a European exchange must file with the Canadian Anti-Fraud Centre, then notify the exchange. Law enforcement cannot cross borders on a single public complaint. But a report filed in the right country creates the only record that can later be combined with others to reach an investigative threshold.

Continue with the section overview or a closely related question:

• Report and recover
• How do I recover emotionally after online fraud?
• How do I verify a cybercrime reporting site?

Each country runs one primary intake for cybercrime from individuals. These intakes do not investigate every report. They aggregate, triage, and refer. The United States uses IC3. The United Kingdom uses Action Fraud. Australia uses ReportCyber. Canada uses the Canadian Anti-Fraud Centre. Europol coordinates cross-border intelligence but does not accept public reports directly. A victim in a Europol member state must use the national reporting body for their country of residence. Filing with the wrong agency delays the report and can create a false sense that the matter is handled when it has only been parked outside any actionable jurisdiction.

IC3, Action Fraud, and ReportCyber operate on the same model: a web form collects incident details, which enter a database analysts query for patterns and links. None of them opens a case file for every submission. The IC3 received a record number of complaints in 2023, and the public report granularity is aggregated into annual summaries, not per-incident outcomes. Action Fraud refers cases with viable investigative leads to the National Fraud Intelligence Bureau. ReportCyber sits inside the Australian Cyber Security Centre and feeds into state and federal police. A report to any of these three agencies is the prerequisite for a case number. Give that case number to your bank or exchange when disputing a transaction.

After the national intake, report the fraud to the payment rail that moved the money. This means the exchange, the wallet service, or the peer-to-peer marketplace. Provide the transaction hash and the destination wallet address. An exchange can freeze an account or flag an address internally even when law enforcement has not yet acted. Most exchanges have a dedicated abuse or fraud-reporting form. Some respond within 72 hours. Others take over a week. The response often confirms the wallet address has been added to an internal blocklist. That does not recover funds. It can prevent the same address from receiving further transfers from other victims on that exchange.

Jurisdiction limits are real. An agency can act only when the victim, the actor, or the payment rail touches its authority. The IC3 cannot compel a server host in a non-cooperative country to take down a phishing mirror. Action Fraud cannot freeze a wallet held by an exchange registered in a jurisdiction without a mutual legal assistance treaty. Attribution difficulty compounds this: an impersonator account may be operated from one country, hosted in a second, and funded from a third. The victim reporting rate for darknet-adjacent fraud is low, partly because victims assume the cross-border nature makes a report pointless. It does not. A report filed in the right jurisdiction is the only way to create a record that can be pooled with other reports when an actor, wallet address, or phishing kit infrastructure is eventually linked across incidents.

Evidence decays fast. Chat logs, phishing pages, and impersonator profiles can disappear within hours. Preserve in this order: transaction hashes and wallet addresses, full email headers, chat logs with timestamps, screenshots of impersonator accounts and phishing mirrors, and any downloaded files. Do not delete anything. Move suspicious files to a quarantined folder on a device that is not used for banking or exchange logins. Screenshots alone are weak. Platforms strip metadata and timestamps. The admissibility of a screenshot without a corresponding log file or header is low. For a clipboard hijacker incident, note the exact time of the paste and the address that appeared versus the one copied. This detail helps an exchange trace the destination wallet.

When the Normal Route Is Closed

If the national intake is offline, the exchange does not respond, or it is 1am and you are panicked, do not wait. Write a dated email to yourself with every detail: the wallet address, the transaction hash, the URL of the phishing mirror, the name of the impersonator account, and the sequence of what happened. This timestamped record becomes the foundation for the official report the next morning. It also prevents the memory distortion that sets in after a stressful event. Do not engage with anyone offering recovery services in the hours after a loss. Recovery scams target victims in this exact window of distress.

A report to IC3, Action Fraud, or ReportCyber enters a database that analysts mine for connections. Wallet address reuse is one of the strongest signals. A single address appearing in reports from three countries can trigger an intelligence package that gets referred to a task force. Takedown responsiveness varies by host. A phishing mirror hosted on a cooperative provider can be removed in under 24 hours. One on a bulletproof host may persist for weeks. Takedown recurrence is common. The same phishing kit can be redeployed on a new domain in minutes. The report you file is not wasted if the mirror reappears. Each takedown raises the actor's cost and narrows the window for credential harvest. Do not expect a personal detective to be assigned to a single low-dollar loss. Expect that your data point, combined with others, builds the aggregate picture that eventually justifies action.

Europol and Cross-Border Cases

Europol does not take public reports. It supports member-state investigations and publishes threat assessments that cite aggregate trends. If you are in a European Union country, report to your national cybercrime unit, which may share data with Europol. The public report from Europol provides useful taxonomy of fraud types but no case-level detail. Do not file a report directly with Europol and assume it has been routed. It will not be.

After you file a report, you become a target for recovery scams. These are secondary frauds in which someone contacts you offering to trace your funds or hack the scammer for an upfront fee. They often reference your case number or claim affiliation with the agency you reported to. Real agencies do not charge fees to investigate. Real blockchain analytics firms like Chainalysis and CipherTrace work with law enforcement, not individual victims. Any cold outreach promising recovery is a recovery scam. Do not pay. The advance-fee logic that trapped you the first time is the same logic being used again.

Phishing domains vanish. Impersonator accounts are deleted. But a wallet address and a transaction hash remain on the blockchain permanently. This is the evidence that outlives everything else. Copy both into the body of your report, not just as an attachment. Include the exact time of the transaction in UTC. If the scam involved a clipboard hijacker, note the legitimate address you intended to use and the address that appeared after the paste. This mismatch is the trace that an exchange investigator can use to correlate across incidents. Even if no action is taken on your single report, that wallet address now exists in an official database. The next report that references it strengthens the case.

Victims report to the wrong jurisdiction and stop. A person in Australia files with the IC3 because the scammer claimed to be in the United States, receives an automated acknowledgment, and assumes the matter is moving. It is not. The IC3 does not have authority over a victim in Australia. The correct path is ReportCyber first, then the exchange, then any additional jurisdiction where the actor's infrastructure sits. Reporting to the wrong agency and walking away is the most common failure that leaves a recoverable evidence trail unused. File in your country of residence. That is the only report that creates an actionable record under the jurisdiction that protects you.