If a government website looks fake, has been altered, or asks for information it should not, stop using it and preserve what you saw. Record the exact URL, date and time, save screenshots, and keep the email, text, advertisement, or social post that brought you there. Then notify the responsible agency through a trusted official route. Depending on what happened, also report the incident to the Cybersecurity and Infrastructure Security Agency (CISA), the FBI’s Internet Crime Complaint Center (IC3), the Federal Trade Commission (FTC), IdentityTheft.gov, or the Internal Revenue Service (IRS).
This guide covers U.S. websites and reporting systems. People outside the United States should preserve the same evidence, contact the affected government body through its verified website, and use their own national cyber-incident or consumer-protection reporting service.
As an Amazon Associate I earn from qualifying purchases.
What to do in the first few minutes
- Stop interacting with the page. Do not enter more information, download files, approve a login, or try to test the site. If you are still on it, close the tab rather than clicking additional links.
- Capture the evidence you already have. Write down the complete URL exactly as displayed, including the domain, path, and any unusual characters. Note the date, time, and time zone, what the page asked you to do, and how you reached it.
- Save the delivery message. Keep the original email, text message, social-media post, search advertisement, QR-code destination, or other referral. Preserve message headers when your email service permits it; do not forward a suspicious message in a way that removes those details.
- Use a trusted device or channel for follow-up. Reach the agency by typing a known address yourself, using a previously saved bookmark, or consulting a reliable government directory. Do not use a phone number, email address, or link shown only on the suspicious page.
- Choose reporting destinations based on the harm. The agency’s security contact is the primary route for a website problem. CISA is appropriate for a cyber incident, IC3 or an FBI field office for suspected online crime, and the FTC, IdentityTheft.gov, or IRS for particular kinds of fraud.
CISA’s public cybercrime tip material advises people to keep and record evidence of the incident and suspected source. Evidence is most useful when it is preserved before a page disappears or a message is deleted.
Fake website or compromised legitimate site?
These are related but different incidents, and the distinction affects whom you notify.
#1 Best Overall
- Requires 3 "AAA" batteries (included)
- Unit auto-locks for 30 minutes after 5 consecutive incorrect PINs
A fraudulent look-alike
A look-alike copies an agency’s name, seal, colors, forms, or payment process while operating somewhere it should not. It may advertise a passport, license, benefit, permit, tax, or immigration service and then collect a fee or personally identifiable information without delivering the service. CISA has documented fake government-service sites built to steal information or charge for services that were never provided.
For U.S. public-sector sites, a .gov domain is reserved for verified government organizations. That makes the ending a useful signal, not a complete identity check. A fraudulent site may use a deceptive non-government domain, an easily mistyped name, or a subdomain that puts the real organization name in the wrong part of the address.
A genuine site that has been altered
A real government domain can be compromised. Warning signs include unexpected redirects, new forms, changed payment instructions, malware warnings, defacement, unfamiliar login prompts, or content that conflicts with the agency’s other official notices. A valid domain and an HTTPS connection do not prove that every page or request is safe. A compromised site needs a technical incident report even if its address looks correct.
Free tools Windows power users keep installed
One-click scans. No signup required.
Do not try to prove which category applies by probing the site, uploading test data, bypassing a login, or running a scanner without permission. Report the observable facts and let the agency investigate.
How to verify the agency without trusting the suspicious page
- Start from a known official directory, a government publication you already trust, or a bookmark saved before the incident.
- Check the exact spelling of the domain and the complete host name. A familiar agency name appearing in a path or subdomain does not make the whole domain official.
- Look for the agency’s security contact,
security.txt, vulnerability disclosure policy, or incident-reporting instructions on the trusted site. - For a phone call, use a number obtained independently from the trusted site or a previously verified government document. Never rely on contact details displayed only by the suspicious page.
- If the site is an online service you normally access, compare the page with a known bookmark or a separate official announcement. A visual match is not enough if the address differs.
CISA and FBI guidance describes a security contact as a way for the public to report suspected vulnerabilities, compromised accounts, unsolicited email, and routing problems. The affected agency is best placed to confirm whether its infrastructure was changed or abused.
Preserve evidence safely
Make a compact evidence record before reporting. Include:
- The full URL, copied rather than retyped.
- Date and time, with your time zone when known.
- The device and browser you used, if relevant to reproducing the problem.
- What appeared on the page, what it requested, and what happened after any click.
- How you encountered it: search result, email, text, advertisement, QR code, social post, or another site.
- Screenshots showing the address bar and the suspicious content. Keep the original files and do not edit away useful context.
- The original message or advertisement, including sender information and attachments. Do not open an attachment again merely to obtain more details.
- Whether you entered a username, password, government identifier, payment information, or other personal data.
- Whether money was sent, a transaction was attempted, or an account changed afterward.
Do not email passwords, full payment-card numbers, authentication codes, or unnecessary copies of identity documents. If a reporting form requests a file, remove unrelated sensitive information first. Keep your private copy in a location protected from unauthorized access.
Where to report: match the destination to the incident
These destinations are complementary, not competing choices. One event can require more than one report.
Rank #2
- Auto-Fill Feature: Say goodbye to the hassle of manually entering passwords! PasswordPocket automatically fills in your credentials with just a single click.
- Internet-Free Data Protection: Use Bluetooth as the communication medium with your device. Eliminating the need to access the internet and reducing the risk of unauthorized access.
- Military-Grade Encryption: Utilizes advanced encryption techniques to safeguard your sensitive information, providing you with enhanced privacy and security.
- Offline Account Management: Store up to 1,000 sets of account credentials in PasswordPocket.
- Support for Multiple Platforms: PasswordPocket works seamlessly across multiple platforms, including iOS and Android mobile phones and tablets.
| What happened | Primary destination | Why and what to include |
|---|---|---|
| The agency’s real website appears hacked, defaced, redirects unexpectedly, or exposes a vulnerability | The agency’s security contact, security.txt, or vulnerability disclosure policy |
The agency can isolate its systems and verify the change. Send the URL, timestamps, behavior, screenshots, and safe reproduction details. |
| A cyber incident affects a government service or infrastructure | CISA’s current incident-reporting channel | Use the live CISA reporting page for the current form and contact method. Describe the technical indicators and impact without sending secrets. |
| A site steals money or information, impersonates an agency, or otherwise appears criminal | FBI Internet Crime Complaint Center (IC3) or an FBI field office | Provide the address, communication trail, losses, payment method, and suspected identity or impersonation details. |
| Consumer fraud, including a deceptive government-service offer | Federal Trade Commission (FTC) | Report the misleading offer, the business or account used, what was requested, and any payment or loss. |
| Identity information was exposed or misused | IdentityTheft.gov | Use the identity-theft reporting and recovery process, then follow the recommended account and credit-protection steps. |
| A tax-related phishing message or fake tax service | Internal Revenue Service (IRS) | Use the IRS’s current phishing-reporting instructions rather than contact details copied from the message. |
Older CISA tip sheets contain legacy email addresses and telephone numbers. Do not treat those historical details as current. Check the live official page immediately before submitting a report.
Report a compromised or vulnerable agency website
1. Find the agency’s trusted security route
Navigate independently to the agency’s official website. Search its footer, privacy or security pages, security.txt, and vulnerability disclosure policy for a security contact. Federal agencies may publish a formal vulnerability disclosure policy that explains how to report a flaw legally and what information researchers may provide.
2. Write a factual subject and summary
State that you are reporting a suspected compromised website, phishing page, exposed data, or other security issue. Give the exact URL and a short description of the visible behavior. Avoid conclusions you cannot support; “the page redirected to an unfamiliar payment form” is more useful than an unsupported claim about who hacked it.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
3. Add timing and access details
Give the first and last time you observed the behavior, your time zone, the route that led you there, and whether the behavior occurred on more than one device or network. If the issue is repeatable without risk, explain the normal sequence of clicks. Do not include passwords, authentication tokens, full card numbers, or personal data that is not needed to investigate.
4. Attach evidence carefully
Attach screenshots and the original referral message when the agency’s policy permits it. Keep your own unmodified copies. If a file contains unrelated personal information, crop or redact that material while preserving the URL, timestamp, and relevant content.
5. Stop after a safe report
Do not continue testing, attempt to access administrative functions, or publish exploit details. The agency’s policy may describe an approved method for exchanging technical information. Follow that method and wait for instructions.
Report a cyber incident to CISA
Use CISA’s current incident-reporting form or channel when the matter is a cyber incident affecting a government service, infrastructure, or public-facing system. Check the live CISA reporting page for the current endpoint because contact methods can change.
Recommended Free Tools
Describe the affected organization if known, the exact address, the observed activity, when it occurred, and the potential impact. Include indicators such as redirect destinations, suspicious file names, or message details only when you can provide them safely. Say whether you entered information or paid money. CISA can receive an incident report even when you are not certain which agency owns the system; provide your best identification and explain the uncertainty.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
A CISA report does not replace notifying the affected agency. The agency can disable a fraudulent page, reset a compromised service, or warn users who may have been exposed.
Report suspected online crime to the FBI or IC3
A fake government site that takes payment, steals credentials, harvests identity information, or impersonates an agency may involve a crime. File a complaint with the FBI’s Internet Crime Complaint Center (IC3) or contact an FBI field office through a separately verified official channel.
Include the financial loss or attempted loss, payment method, transaction dates, recipient details, the site and messages used, and the information you supplied. Preserve receipts, transaction confirmations, wallet addresses, and correspondence. Do not delay urgent financial action while completing a complaint: contact the bank, card issuer, or payment service using the number on a statement or card.
IC3 and an agency security contact serve different purposes. IC3 documents possible criminal conduct; the agency’s security team handles the government system or impersonation problem.
Use the FTC, IdentityTheft.gov, or IRS for specific harms
Consumer fraud
Report deceptive government-service offers to the FTC. Explain what the seller claimed, how the claim was presented, the address or account involved, what you were asked to provide, and any money paid. Keep the report focused on the fraudulent conduct rather than forwarding passwords or complete identity documents.
Identity theft
If you supplied identity information or believe it is being used, use IdentityTheft.gov’s reporting and recovery process. Follow its recommendations for securing accounts, documenting the incident, and contacting affected institutions. Identity-theft reporting is not a substitute for notifying the agency whose site was copied or compromised.
Tax phishing
For a message or website pretending to be a tax authority or tax service, follow the IRS’s current phishing-reporting instructions. Use the IRS website reached through a trusted route; do not reply to the suspicious message or use its telephone number.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →If you entered a password, payment detail, or personal information
- Leave the suspicious site. Do not return to it to change the information; use the genuine service instead.
- Change exposed passwords. Start with the real agency or service account, then change any other account that reused the same password. Use unique passwords and do not disclose the new ones to a reporter.
- Contact the financial institution. Use the number on your card, statement, or verified banking application. Ask about unauthorized charges, replacement cards, payment reversals, and account monitoring.
- Secure email and identity accounts. Review sign-in activity, revoke unfamiliar sessions, update recovery details, and enable multifactor authentication where available.
- Monitor for follow-on abuse. Watch account statements, password-reset notices, benefit records, tax correspondence, and unfamiliar credit activity. Keep a dated log of every contact and transaction.
- Report the exposure. Tell the affected agency, CISA when appropriate, IC3 or the FTC for the relevant conduct, and IdentityTheft.gov or the IRS for the matching harm.
When contacting an institution, explain that your information was entered into a suspected impersonation or compromised website. Ask what evidence it needs and whether it recommends additional account restrictions.
Rank #4
- Offline Local Storage for Privacy:This Password Keeper stores all your login credentials directly on the device, with no cloud or internet connection, helping reduce exposure to hacking and data breaches.
- Full Control of Your Sensitive Data:Unlike cloud-based managers, this physical device keeps your passwords entirely under your control. Your information never leaves the device, and you won’t share it with third-party servers.
- Built-in Device Password Protection:Add an extra layer of security with optional device password protection, helping prevent unauthorized access to your stored records if the device is misplaced.
- Compact Hardware Vault for Credentials:A secure alternative to handwritten notes or spreadsheets, this portable device lets you store unique, complex passwords for all your accounts in one place.
- Simple USB Type-C Access:Connect via the included USB Type-C cable to your laptop, phone, or standard 5V charger to view and navigate your passwords on the built-in screen, no internet required.
Information that makes a report useful
Public reporting guidance from CISA and the FBI identifies several details that help an organization triage an incident:
- Date and time of the activity.
- Location or affected web address.
- Type of activity, such as phishing, redirection, defacement, unauthorized payment request, or exposed form.
- People, accounts, devices, or equipment involved, when known.
- The submitting organization, if you are reporting on behalf of a business or public body.
- A designated contact who can answer follow-up questions.
These are helpful fields, not a mandatory checklist for every member of the public. Submit a clear partial report rather than waiting for perfect attribution. Say “unknown” where appropriate and distinguish what you observed from what you suspect.
Common mistakes that make the situation worse
- Trusting HTTPS or a padlock. Encryption protects the connection; it does not establish that the operator is a legitimate government agency.
- Using contact details on the suspicious page. A scammer controls those details and can route your complaint back to the scam.
- Deleting the original message. Keep it until reports and investigations are complete.
- Sending secrets in a report. Passwords, one-time codes, and full payment details are not needed to establish that a site is suspicious.
- Trying to hack back or investigate aggressively. Further access can damage evidence, expose you to legal risk, or alert an attacker.
- Reporting only once. The technical incident, criminal conduct, consumer fraud, and identity theft may be handled by different organizations.
- Assuming a
.govaddress guarantees safety. It verifies the type of registrant, not that every page is unaltered or every request is legitimate. - Waiting for certainty. A precise description of suspicious behavior is enough to start triage.
For organizations reporting on behalf of others
Organizations should preserve logs and a chain of custody for screenshots, messages, and network indicators. Identify the affected service, the time window, the number and type of users potentially exposed, and a person authorized to answer follow-up questions. Separate technical indicators from personal records, and transfer sensitive material only through the receiving agency’s approved channel.
Federal vulnerability disclosure policies are designed to let the public report suspected flaws legally and give agencies a formal process for receiving them. Follow the published scope and rules instead of attempting unapproved testing.
What non-U.S. readers should do
CISA, IC3, the FTC, IdentityTheft.gov, and the IRS are U.S. services. If the website belongs to another country, preserve the same evidence and contact the responsible ministry or agency through a verified official directory. Then use your country’s national cyber-incident response service, police cybercrime unit, consumer-protection authority, or identity-theft service as applicable. Do not assume that a U.S. report will reach a foreign government body.
Why formal reporting channels matter
In a September 2, 2020 release about the federal vulnerability disclosure policy directive, then-CISA Assistant Director for Cybersecurity Bryan Ware said: “Cybersecurity is strongest when the public is given the ability to contribute, and a key component to receiving cybersecurity help from the public is to establish a formal policy that describes how to find and report vulnerabilities legally,”
A formal security contact gives an agency a controlled way to validate a report, protect other users, and coordinate remediation. Your role is to preserve what you observed, avoid additional exposure, and route the report according to the harm.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchQuick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
