How to Report a Cybercrime: FBI, Police & Worldwide

What to prepare before you report

You don't need a perfect dossier to report a hack, but thirty minutes of preparation turns a vague complaint into something an analyst can actually act on. Write it down before you open any reporting form:

• A timeline, in plain language - when you first noticed something wrong, what you were doing, and what changed around that moment: a login alert, a disabled account, a payout detail that isn't yours.
• What was affected - accounts, devices, servers, domains. Flag anything that holds other people's data; that decides whether breach-notification duties apply later.
• Evidence, preserved not cleaned - export suspicious emails with full headers, screenshot ransom notes and extortion messages, pull authentication and mail logs with timestamps intact, and don't wipe or rebuild anything yet.
• Financial impact so far - amounts, dates, the account the money left from, and where it went if you know. Recovery windows for stolen funds are measured in hours, not days.

One rule governs everything you submit: facts, not theories. "Received email at 14:32, clicked link, session created from an unrecognized IP at 14:39, mailbox rules changed at 14:41" moves an investigation forward. "I think it's a nation-state group" doesn't. Leave attribution to the people with the telemetry.

United States

In the US, the FBI's Internet Crime Complaint Center - IC3 - is the main reporting channel, and it genuinely is not just for big cases. No agent opens a file over every single report, but IC3 exists to aggregate: your complaint joins thousands of others, and patterns in that data decide which infrastructures get seized, which crews get indicted, and where task forces focus. Small reports build big cases.

If money moved - a business email compromise, an authorized push payment, a drained account - call your bank's fraud line first, then file with IC3. Banks can freeze or recall transfers, but only inside a short window that closes fast. Speed beats completeness here: make the call, then do the detailed report.

The other channels, depending on what happened:

• CISA - if the incident hits critical infrastructure or otherwise important systems, report the significant cyber incident to CISA alongside IC3. CISA coordinates the federal response and publishes advisories other defenders act on.
• Local police - for identity theft, file a report with your local department. You will need the police report number for credit disputes and identity-theft affidavits.
• Your state attorney general - most run consumer-protection units that accept cybercrime and fraud complaints, useful for local pressure and pattern tracking.
• identitytheft.gov - the FTC's recovery hub for identity theft. It builds a personal recovery plan and generates the affidavits and pre-filled dispute letters you'll need.
• Public companies - material-incident disclosure obligations may apply; your legal counsel makes that call, not a blog post.

United Kingdom

Action Fraud is the national reporting centre for fraud and cybercrime, run by the City of London Police. File online, describe what happened, and you get a reference number plus an assessment by the National Fraud Intelligence Bureau. It is the front door for almost every cybercrime report in the UK.

Two more channels matter for organizations:

• NCSC - if the incident hit an organization (your employer, your company, a key supplier), report it to the National Cyber Security Centre. Significant incidents get analyst attention and practical guidance, and the NCSC turns victim reports into protective threat data for everyone else.
• FCA - regulated financial firms have mandatory incident-reporting obligations to the Financial Conduct Authority. If that's you, compliance already owns that timeline.

If there's immediate danger or an active incident with physical risk, call 999. Non-urgent crime that needs officers on the ground goes through 101.

European Union

There is no single EU-wide victim portal. You report to your national police cybercrime unit - every member state has one - and that national channel is what feeds Europol's European Cybercrime Centre (EC3). EC3 doesn't take reports from individuals directly; it coordinates cross-border cases built from national reports. ENISA, the EU's cybersecurity agency, works on capability-building and coordination rather than case intake.

If it's ransomware, also check No More Ransom - a Europol-backed project with free decryption tools for many strains. If a decryptor exists for your variant, you may avoid both the ransom payment and a full rebuild.

Companies, note the separate clock: if you handle EU personal data, a breach will usually trigger GDPR's 72-hour notification to your national supervisory authority. That's a data-protection duty that exists alongside, not instead of, the police report - and it's the one with real penalties attached.

Australia and Canada

Australia: ReportCyber, run by the Australian Cyber Security Centre, is the national online reporting channel for individuals, businesses, and government. Reports are triaged and referred to police where a crime needs investigating, so file there first - and contact your local police station as well if you need officers involved. Money moved? Your bank first, same rule as everywhere.

Canada: report to the Canadian Centre for Cyber Security for intake and guidance, and to your local police service for the criminal side. Regulated financial institutions carry their own reporting duties; if that's you, compliance owns that timeline. And yes - bank's fraud line before anything else if funds moved.

Rest of the world

For everywhere else, start with the FIRST member directory - the Forum of Incident Response and Security Teams lists national CSIRTs by country, and your national team is the right first contact almost everywhere. They triage, coordinate, and route to police when a criminal case exists.

Financial fraud with an international angle has one more lever: Interpol runs I-GRIP, a program built specifically to intercept and freeze stolen funds while they move across borders. You still report domestically - your national police or CSIRT engages the Interpol channel on your behalf. That's exactly what these cooperation mechanisms exist for.

After you report

Whatever channel you used, three things from here. First, save the reference number - screenshot it, email it to yourself; it is the key to everything that follows. Second, add new information to the existing case number instead of filing duplicates. When you find fresh indicators or the damage grows, update the original report (IC3 explicitly supports this). Third, adjust expectations: you will not get daily updates. Agencies triage by scale, pattern, and evidence quality, and silence is normal - it doesn't mean nothing is happening.

And keep your own containment moving in parallel: rotate credentials from a clean device, revoke active sessions, and watch financial accounts for follow-on attempts. The report starts the official process; it doesn't protect you while that process runs.

When reporting isn't enough

A report starts an investigation and, sometimes, freezes stolen money. It does not evict an intruder, clean a server, or close the hole they walked through - that's incident response, and it's a different job. If you're dealing with an active compromise, start with the technical walkthrough on what to do when you've been hacked, or go straight to the scenario that matches: ransomware first steps or business email compromise recovery. And if you'd rather hand the technical side to someone who does this for a living, get in touch - I handle incident response engagements remotely, worldwide.