Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Use the reporting channel that matches what you received: forward a phishing email to [email protected] and report it at ReportFraud.ftc.gov; forward a scam text to 7726 (SPAM) and the FTC; use your mail app’s built-in phishing report; and report unsafe websites through the browser or search service. Before reporting, preserve the original message, sender or number, complete URL, time, and screenshots without clicking again or replying.
What to do before you report
Reporting is most useful when the recipient can inspect the original artifact. Do not click the link again, open another attachment, reply, or call a number in the suspicious message. If the message claims to be from a bank, employer, retailer, government office, or online service, verify it through a phone number on a card or statement, a bookmark you already trust, or the organization’s official site that you type yourself.
As an Amazon Associate I earn from qualifying purchases.
Preserve the evidence safely
- Keep the original email, text, or chat message until the relevant report has been submitted.
- Record the sender’s complete email address, display name, phone number, or social-media handle. A forged display name is not the same as the underlying address.
- Copy the complete URL, including the domain and any path, from the message without visiting it. If your device previews a link, use the preview or copy-link function rather than opening it.
- Save screenshots showing the message, warning banners, payment request, and any fake login page. Include the date and time visible on your device when possible.
- For email, keep the original message in its original form. Some providers ask for the original message or full headers, which contain routing information that a screenshot does not.
Do not forward a malicious attachment to friends or colleagues as a warning. Send it only through the reporting route that requests it, and tell other people to verify the claimed organization independently.
Choose the reporting route by what you received
| Artifact | First-party or government destination | Useful evidence | When to escalate immediately |
|---|---|---|---|
| Phishing email | Your mail provider; [email protected]; ReportFraud.ftc.gov | Original message, sender address, headers if requested, URLs, screenshots | Credentials, payment details, or a work account may have been exposed |
| Scam text message | Forward to 7726 (SPAM), then report to ReportFraud.ftc.gov | Original text, sending number, links, screenshots, time received | You replied, paid, installed an app, or disclosed an account code |
| Suspicious website or domain | Browser’s unsafe-site report; search provider’s phishing, webspam, or ad-reporting route | Complete URL, redirect chain if visible, screenshots, search-result or ad context | You entered credentials, payment data, or identity information |
| Impersonated company | The real company through a verified channel; FTC and, when appropriate, local law enforcement or IC3.gov | Brand being impersonated, message, URL, transaction records, victim details | Fraud, account takeover, extortion, or substantial financial loss |
These destinations collect reports for analysis, abuse prevention, or investigation. A report does not guarantee that a site will be removed or that you will receive a personal reply. Account takeover or financial loss requires direct contact with the real provider and financial institution in addition to reporting.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
How to report a phishing email
Send it to the Anti-Phishing Working Group and FTC
- Preserve the email and note the sender, URLs, attachments, and time received.
- Forward the phishing email to [email protected]. The FTC’s consumer guidance states: “If you got a phishing email, forward it to the Anti-Phishing Working Group at [email protected].”
- Submit the scam to ReportFraud.ftc.gov. Include the impersonated organization, what the message asked you to do, and whether you lost money or shared information.
- After reporting, follow your provider’s retention or deletion instructions. The FTC says to report and then delete the message after checking it.
When a form or investigator asks for the original email, attach or forward the unmodified message rather than pasting only its text. Headers can help identify sending infrastructure and are different from the visible “From” name.
How to report a scam text message
- Do not answer, tap a link, or call the number in the text. Preserve the thread and take a screenshot.
- Forward the message to 7726, which spells SPAM on a phone keypad. Include the original content so the carrier can analyze the sender and link.
- Report the incident to ReportFraud.ftc.gov. Describe the claimed organization, the requested action, and any money or information you provided.
- Block the sender only after preserving what you need for the report. Blocking prevents further contact on that device but does not replace the carrier or FTC report.
The FTC’s guidance says: “If you got a phishing text message, forward it to SPAM (7726).” A carrier report and a government report serve different purposes, so submit both.
Report phishing inside Gmail
- Open Gmail and select the suspicious message.
- Choose More (the three-dot menu).
- Select Report phishing and confirm.
Google says that reporting sends the message and its attachments to Google for analysis to improve spam and abuse protection. Use the in-product report even if you also submit the message to the FTC or APWG; it gives Gmail a provider-specific signal about the account and message.
Report phishing in Microsoft Outlook or Teams
Outlook
- With the suspicious message selected, choose Report > Report phishing from the ribbon.
- Complete any confirmation prompt and retain the message until the report is accepted.
Microsoft’s instruction is: “With the suspicious message selected, choose Report > Report phishing from the ribbon.” Organization-managed Outlook installations can add their own reporting controls, so use the security or abuse option supplied by your employer if it differs.
Teams
- Open the message’s More options menu.
- Choose More actions > Report this message.
- Select the security-risk option, then submit the report.
Another mail client or Microsoft 365 workflow
If you use a different mail client, Microsoft asks for the original suspicious email as an attachment to [email protected]. Do not recreate the message by copying its visible text; preserve the original file so technical headers and attachments remain available.
Rank #2
- Ultra-Compact FIDO2 Security Key - Plug-and-stay or carry on a keychain. This USB-A hardware security key offers portable, always-on protection for desktop and mobile use. (Item Size: 0.75 X 0.74 IN x 0.25 IN)
- USB-A Hardware Key for All Devices - Works with USB-A ports on PC, Mac, Android, and other laptop/notebook device. Enables secure, cross-platform login with FIDO2.0 passkey support.
- FIDO Certified Security Key - Meets FIDO and FIDO2 standards. Works with Google, Microsoft, GitHub, Dropbox, and more. Please check service compatibility before purchase.
- Passwordless Login with Passkey - Supports passkey login via WebAuthn and CTAP2. Enjoy password-free sign-ins where supported. Not all websites or services currently support passkeys.
- Advanced Multi-Factor Authentication - Offers 200 FIDO2 passkey slots and 50 OATH-TOTP slots. Strong, flexible 2FA/MFA support across various apps and authentication platforms.
How to report a fake website or phishing domain
Microsoft Edge
- Do not revisit the page merely to submit a report. Use the URL already captured from the message, browser history, or a screenshot.
- In Edge, choose … > Help and feedback > Report unsafe site.
- Enter the suspicious address and any requested context, then submit.
The report route is intended for phishing pages, malicious redirects, and other unsafe sites. A domain can host multiple pages or redirect through several addresses, so include the complete address and explain what the page attempted to collect.
Google Search results, ads, and redirects
For a phishing page, suspicious redirect, or phishing result or advertisement in Google Search, use Google’s in-product Search reporting and webspam/reporting routes. Report the result or ad from the search interface rather than opening the destination again. Capture the result page, visible domain, ad label, and redirect URL if your browser recorded it.
When a domain report is not enough
If you entered a password, card number, one-time code, Social Security number, or other identity information, treat the event as an account or identity incident. Website reporting may help protect later visitors, but it does not reset credentials, reverse a payment, or notify your bank.
Tell the real organization being impersonated
Contact the bank, employer, retailer, delivery service, social network, or government office through a verified channel. Type the known official address, use a number printed on a card or statement, or use a bookmarked account portal. Never use a phone number, reply address, QR code, or “support” link supplied by the suspicious message.
Give the organization the sender or number, complete URL, screenshots, timestamps, and any transaction or account identifiers it needs. Ask whether the message represents a known campaign, whether your account shows unauthorized activity, and what protective action the organization recommends. For a workplace account, notify the security or IT team through its established internal process even if you already reported the message in Outlook or Teams.
Rank #3
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
What to do if you clicked or entered information
If you only opened the link
Close the page without downloading files or interacting with prompts. Update the device’s security software and run a scan if malware may have been installed. Preserve the URL and screenshots for the report. A click alone does not prove that an account was compromised, but it is a reason to check the account for unfamiliar sign-ins, password changes, or new payment activity.
If you entered a password or verification code
- Use the real organization’s app or website, reached through a known-good route, to change the exposed password immediately.
- Make the replacement password unique. Do not reuse it on another service.
- Turn on multi-factor authentication (MFA). The FTC lists a security key as one possible second factor; a FIDO2 hardware security key can protect an account when the service supports it.
- Review active sessions, recovery email addresses, phone numbers, forwarding rules, newly created app passwords, and connected applications. Remove changes you did not make.
- Tell the provider that the credential or code was exposed and ask whether it can revoke sessions, tokens, or recovery methods.
Changing a password and enabling MFA reduce further risk; they do not erase a message already sent or undo an attacker’s actions. Check other accounts only if they reused the exposed password, and change those credentials as well.
If you entered card or bank information
Call the financial institution using the number on the card, statement, or official website. Explain that the details were submitted to a phishing site, ask about blocking or replacing the instrument, and review pending and completed transactions. Report unauthorized transfers or charges through the institution’s fraud process as soon as possible.
If identity information was exposed
For Social Security information or other identity details, use IdentityTheft.gov for tailored recovery steps. Follow the site’s recommendations for documenting the incident and protecting affected accounts.
If malware may have been installed
Disconnect a device from sensitive accounts if you suspect active compromise, update its security software, and run a scan. Avoid entering new passwords on that device until it is checked. If it is managed by an employer or school, contact the responsible security team using a trusted channel.
Recommended Free Tools
Rank #4
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- USB TYPE C Connectivity & DONGLE Design: Designed for PCs, Macs, laptops, iPhones, and Android devices that utilize a USB-C port. Plug and stay, or carry it on a keychain. (Item Size: 0.73 x 0.60 x 0.30 inches)
- Enhanced MFA (FIDO2 & TOTP/HOTP): Strengthen your security with flexible options. Use the Manager App to access TOTP/HOTP features for accounts that do not yet support FIDO2.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID. NFC functionality is not supported.
Business and impersonation incidents
Businesses should preserve the message, domain, hosting or redirect details visible to them, affected customer records, and transaction evidence under their incident-response procedures. Notify the impersonated company so it can warn customers, suspend fraudulent accounts, or work with its registrar and hosting providers.
Report the fraud to the FTC and APWG. Depending on the facts and location, a business may also report to local law enforcement and the FBI’s Internet Crime Complaint Center at IC3.gov. Use the official incident-reporting process required by your organization, insurer, regulator, or contract. A customer-facing takedown request should not replace preserving evidence for investigators.
What to include in every report
- Artifact: email, text, chat, web page, search result, advertisement, or phone call.
- Source: complete sender address, phone number, account handle, domain, and URL.
- Timeline: when you received it, clicked, replied, paid, or noticed unauthorized activity, with the time zone when relevant.
- Impersonation: the organization, person, service, or event the scam claimed to represent.
- Request: password, one-time code, card payment, wire transfer, gift card, software installation, or other action demanded.
- Impact: information entered, money sent, accounts accessed, devices affected, and any steps already taken.
- Attachments and headers: provide the original files only to a trusted reporting channel that requests them.
Describe what you observed rather than guessing who operated the domain. A look-alike address can be registered by one party, hosted by another, and used in a campaign that changes quickly; accurate artifacts are more useful than an unsupported attribution.
Reporting limits and the right escalation
Use provider reports to improve filtering or disable accounts, carrier reports to investigate abusive messages, and government reports to build enforcement and consumer-protection records. None of these routes guarantees takedown or a personal response, and a report cannot recover money by itself.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteEscalate immediately to the real account provider and bank when there is possible account takeover or financial loss. Use IdentityTheft.gov for identity-exposure recovery, and consider law-enforcement or IC3.gov reporting for business fraud or significant loss. Keep confirmation numbers, copies of submitted reports, and the evidence set together in case a provider, investigator, or financial institution asks for a follow-up.
A concise decision checklist
- Stop interacting with the suspicious message or site and preserve the original evidence.
- Match the artifact to its first-party route: mail provider for email, 7726 for texts, browser or search reporting for websites, and the real company for impersonation.
- Send the US consumer report to ReportFraud.ftc.gov; add APWG for email or the carrier route for SMS.
- If information was entered, secure the account, contact the financial institution when relevant, and use IdentityTheft.gov for identity information.
- For business incidents or major fraud, preserve records and consider local law enforcement and IC3.gov.
The FTC’s 2025 consumer guidance identifies email as the top method scammers used to contact people in 2024. That figure describes the FTC’s consumer reporting context, not every country or every phishing campaign, but it is a useful reason to keep both email-specific and general fraud-reporting routes ready.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
