Verifying a Cybercrime Reporting Site Before Submitting

Before you file a cybercrime report, check the domain. A real IC3 page ends in .gov. Action Fraud ends in .gov.uk. ReportCyber sits on .cyber.gov.au. A mirror copies the logo, the fields, the font, and then steals your name, email, and loss details. The only difference is the domain, and it is the only thing that matters. Type the address yourself. Do not click a link from a search result, a forum post, or a direct message.

Continue with the section overview or a closely related question:

• Report and recover
• Where should online fraud be reported?
• What should I tell my bank or exchange?

Fraudsters clone reporting portals because a panicked victim rushing to file is less likely to inspect the URL. A fake IC3 site or a cloned Action Fraud page collects the same data the real form asks for. Full name, contact information, incident description, and often the wallet address or account numbers involved. That data fuels follow-up fraud.

The most common second-stage attack is a recovery scam. Within hours of submitting to a mirror, the victim receives a call or email from someone claiming to be an investigator. They quote the report's case number, demand an advance fee to "expedite recovery," and escalate each time the victim pays. This is the advance-fee spiral in its purest form, and it starts with a single mistyped domain.

Phishing kits make this easy. A packaged kit clones the front-end of any reporting form in under an hour. The kit includes the credential-exfiltration backend that forwards submissions to the real site after stealing them, so the victim sees a confirmation page and never suspects the breach. These kits are reused across jurisdictions, swapping logos and language packs but keeping the same session token theft and data-harvesting logic.

Government domain verification is the single checkpoint that catches nearly every mirror. Follow these steps in order, before typing a single character into a form.

Inspect the Exact URL Character by Character

Look at the domain, not the page design. A legitimate US federal agency domain ends in .gov or .mil, with nothing after that suffix. Action Fraud's domain ends in .gov.uk. The Australian ReportCyber service sits on .cyber.gov.au. The Canadian Anti-Fraud Centre uses .antifraudcentre-centreantifraude.ca. Any extra words, hyphens, or alternative top-level domains like .org, .com, or .net are a hard stop. A domain like "ic3.gov.reporting-portal.com" is owned by whoever registered "reporting-portal.com," not by the FBI.

Navigate Independently, Never Through a Link

Do not click a link in a search ad, a forum post, or an email. Search engines display paid ads above organic results, and scammers buy ads for terms like "official fraud reporting URL check" to place their mirror at the top of the page. Type the known address into a new browser tab. If you do not know it, look it up on a separate device or through a government directory page, not through a search result on the same screen.

Check the Certificate Owner, Not Just the Padlock

The padlock icon indicates an encrypted connection, not a legitimate site. Phishing mirrors use free SSL certificates. Click the padlock and inspect the certificate subject. A real government certificate for IC3 is issued to a domain under ic3.gov. A mismatch between the certificate owner and the domain you intended to visit is a phishing indicator, even if the page renders perfectly.

A fake IC3 reporting site is rarely a one-off. It is part of an impersonator cluster that may include phony support accounts on social media, fake support ticket replies in forums, and cold-call scripts. The impersonator account contacts victims who have publicly posted about their fraud loss, offering a direct link to "the new IC3 intake form." That link leads to the mirror.

The credential reuse rate makes this dangerous beyond the immediate report. If the victim uses the same email and password on the fake form that they use elsewhere, those credentials are tested against email providers, cryptocurrency exchanges, and banking sites within minutes via credential stuffing. One phished report can cascade into multiple account takeovers before the victim realizes the form was fake.

Takedown responsiveness for these mirrors is slow. A phishing domain hosted on a bulletproof provider may remain active for 72 hours or longer, even after abuse reports are filed. During that window, dozens of victims submit their data. The evidence volatility is extreme: the mirror may vanish without warning, taking the server logs with it. Preserve the URL and a screenshot with the full address bar visible before you do anything else.

Agency	Correct Domain Suffix	Common Phishing Variant
IC3 (United States)	.gov	.gov-secure.co, .ic3.gov.com
Action Fraud (United Kingdom)	.gov.uk	.actionfraud.police.uk.com
ReportCyber (Australia)	.cyber.gov.au	.reportcyber.gov.au.co
Canadian Anti-Fraud Centre	.antifraudcentre-centreantifraude.ca	.antifraudcentre.ca

Do not rely on the page's visual appearance to avoid a fake Action Fraud portal. Phishing kits replicate the Action Fraud branding, form fields, and even the reference number format. The only reliable signal is the domain. Action Fraud's real intake form lives on a .police.uk subdomain, and the root domain ends in .gov.uk.

Scammers exploit the fact that most victims do not know the correct domain. A search for "report fraud UK" returns a mix of legitimate links, sponsored ads, and forum posts with malicious URLs. The impersonator account may also send a direct message on a platform like WhatsApp or Telegram, claiming to be a police support officer and providing a "secure intake link." That link leads to the mirror.

If you have already submitted data to a suspected fake Action Fraud portal, assume the information is compromised. Change the password on any account that used the same credentials immediately. Contact Action Fraud by phone using the number published on the real .gov.uk site, not any number displayed on the suspect page. The public report granularity of official data means your individual report may not be acted on, but adding the mirror domain to the intelligence pool helps takedown efforts and protects subsequent victims.

An official fraud reporting URL check takes 30 seconds and prevents credential harvesting. For every agency, write down the exact domain you intend to visit before opening a browser. Compare it character by character against the address bar after the page loads. Look for transposed letters, extra hyphens, and words like "secure," "portal," or "verify" inserted into the domain.

United States

The IC3 intake form is at a .gov domain. Any variant with .org, .com, or a hyphenated suffix is a phishing mirror. The FBI does not charge a fee to file a report. An advance-fee scam that demands payment to "process" or "prioritize" a complaint is fraudulent.

United Kingdom

Action Fraud's reporting service is at a .police.uk address under the .gov.uk hierarchy. The site never asks for payment. Recovery scams frequently reference Action Fraud case numbers to sound legitimate, but real Action Fraud staff do not cold-call victims to offer fund recovery.

Australia

ReportCyber is part of the Australian Cyber Security Centre at .cyber.gov.au. The form does not require a fee. Scammers deploy fake support ticket replies that mimic the ACSC's email templates, including forged case numbers and return phone numbers that connect to a call center running a recovery scam.

Canada

The Canadian Anti-Fraud Centre is at .antifraudcentre-centreantifraude.ca. The hyphenated bilingual domain is itself a verification signal. A mirror using a single-language domain or a .com variant is fraudulent. The CAFC does not initiate contact to request payment for investigation services.

The advance-fee spiral begins with a small request, often under a hundred dollars, described as a processing charge or a blockchain analysis fee. Once that is paid, a second fee appears: an expediting charge, a legal clearance fee, a cross-border transfer tax. Each payment justifies the next. The victim's sunk-cost commitment deepens, and the impersonator uses the authority of the agency name to pressure compliance.

No real government cybercrime reporting portal charges a fee to file a complaint. IC3, Action Fraud, ReportCyber, and the CAFC are all free. If any page, caller, or message demands payment to submit, process, or investigate a report, it is an advance-fee scam. Stop contact immediately. Do not engage to argue or demand a refund: the same impersonator account often pivots to a recovery scam, offering to return the lost fees for an additional upfront payment.

The recovery scam after a fraud loss is so common that it has its own victim loss band, separate from the original incident. A person who lost funds in a wallet drain or a phishing attack is contacted by a "recovery specialist" who claims to trace the transaction on the blockchain. The specialist cites Chainalysis or CipherTrace by name, shows a fabricated report, and demands an upfront tracing fee. The funds are never recovered, and the victim is now out two sums instead of one.

The immediate loss is your data. A phishing mirror captures your name, contact information, and the narrative of your original fraud incident. That narrative often contains wallet addresses, exchange account names, transaction hashes, and details of your security setup. An info-stealer embedded in the phishing kit may also extract session tokens from your browser, granting the attacker access to accounts you are currently logged into without needing your password.

Session token theft is faster than credential stuffing. A stolen token is valid for the lifespan of the session, which can be hours or days. During that window, the attacker can change account recovery settings, add new two-factor methods, or initiate withdrawals. The two-factor bypass rate for token-based attacks is effectively complete, because the token represents an already-authenticated session.

Then comes the secondary fraud. The impersonator uses your report details to contact you as a fake investigator. They reference your case, your loss amount, and the date of the incident. This specificity is what makes the recovery scam convincing. The victim believes that only a real investigator could know these details. In reality, the details came from the victim's own submission to the mirror.

Evidence volatility is highest in the first 24 hours after a phishing mirror is discovered. The domain may be taken down, the server logs wiped, and the phishing kit redeployed under a new name. Before you file a report with the real agency, capture the full URL of the fake page, including the scheme and any subdomains. Take a screenshot that shows the address bar, not just the page content. Save the page source if you can.

Screenshots alone are weak evidence. They lack metadata, can be altered, and do not preserve the network request chain. If you have the technical ability, save the HAR file from your browser's developer tools. This records every request the page made, including the exfiltration endpoint where your data was sent. That endpoint is often a clue that links the mirror to other phishing infrastructure.

Chat logs vanish fastest. If an impersonator account contacted you on a messaging platform, export the conversation immediately. Many platforms strip metadata on export, so also take screenshots that show the sender's profile ID and the timestamps. These details are what allow investigators to cluster impersonator accounts and link them to known fraud campaigns. A wallet address that appears in a chat log is more valuable than one reported in isolation, because it ties the address to a specific lure.

Every step above collapses into one rule: navigate to the official domain yourself, check the suffix against the jurisdiction table, and never pay a fee. The phrase "verify cybercrime reporting site" is not a suggestion; it is the single action that separates a filed report from a stolen identity. If you remember nothing else, remember that a government domain ends in .gov, .gov.uk, .cyber.gov.au, or the equivalent for your country, and nothing else.

Scammers count on victims skipping this check. The phishing mirror looks right, the pressure to file quickly is real, and the victim is often exhausted. That is the moment the impersonator wins. The 60 seconds it takes to inspect the URL, type the address manually, and check the certificate is the cheapest insurance you will ever buy against a secondary fraud that compounds the original loss.

If you have already submitted to a mirror, contain the damage immediately: change passwords on every service that shared those credentials, revoke active sessions, and contact the real agency by phone. Then file a report about the mirror itself. Takedown recurrence is high, and the same infrastructure will reappear, but each report adds to the takedown pressure and shortens the window the next mirror stays live.