How to Report a Crypto Scam and What to Send

If you were scammed in crypto, report it in three places in roughly this order: the exchange, ATM operator or bank the money moved through, your national fraud agency (in the US, the FBI's IC3 at ic3.gov plus ReportFraud.ftc.gov; in Canada, local police and the Canadian Anti-Fraud Centre; in England and Wales, Report Fraud; in Scotland, Police Scotland on 101), and any regulator that covers the platform involved. Reporting is free everywhere. It rarely brings the money back, but it puts your loss on an official record, can help an exchange freeze funds that have not yet moved, and links your case to other victims of the same operation.

This guide is the practical version: which agency fits your country and your situation, what evidence to collect while it still exists, how to write a report an analyst can act on, and what to expect afterwards. It is built from the agencies' own instructions, read on October 22, 2026, and it does not refer you to any private recovery service. If someone is offering to get your coins back for a fee, read our explainer on why crypto recovery offers are usually a second scam before you reply to them.

Where to Report: A Country-by-Agency Table

The table below lists the official channels by country. Most victims need more than one row: one report to the agency that collects fraud intelligence, one to the police force that can open an investigation, and one to the company that handled the money.

A few details in that table are recent enough to trip people up. The FCA's consumer page notes that Action Fraud changed its name to Report Fraud in a December 2025 update, so older articles and some bank letters still use the old name. In Canada, the CAFC's reporting page sends victims to their local police first and states plainly that it is the role of the local police to investigate. In the US, the IC3 complaint form is the single most useful filing for crypto losses, because the FBI's own guidance for cryptocurrency victims is built around it.

Northern Ireland and other countries are not covered in this table because we could not confirm their current reporting routes from an official page on the check date. If you live elsewhere, your national police site is the safest starting point, and IC3's FAQ confirms it accepts complaints from people outside the US and about suspects located abroad.

The First Hour: Do These Before You Write Anything Long

The order matters more than the paperwork. Some steps lose value by the hour, and a long, polished report filed tomorrow is worth less than a short call made today.

Only after those five steps should you sit down to file. The FBI's 2023 guidance for crypto scam victims is blunt about timing: report right away, and do not wait.

Build Your Evidence Pack

Agencies need specifics. IC3's cryptocurrency page says transaction details are among the most important things to provide, and its 2023 public service announcement for crypto scam victims lists four items as the core: the cryptocurrency addresses, the amount and type of cryptocurrency, the dates and times, and the transaction ID or hash. The checklist below expands that into everything worth gathering. Keep it in one folder, on a device the scammer never had access to.

Two practical points about this pack. First, IC3 does not accept attachments and does not collect evidence. Its FAQ says to keep your original documents in a secure place, because an agency that opens an investigation may ask you for them directly. You will type or paste the key details into the form, and keep the files. Second, if a detail seems irrelevant, include it anyway: the FBI's crypto guidance says exactly that, because a username or domain that means nothing in your case may match one already in another victim's report.

If you are not sure what a transaction hash or an address looks like, our explainer on Bitcoin address formats shows how to tell address types apart, and the guide to how Bitcoin fees and the mempool work explains what a confirmed transaction record contains. The short version: a hash is a long string of letters and numbers that, pasted into a block explorer, opens one specific transfer. Because the ledger is public, as our beginner's guide to how a blockchain works explains, anyone with that hash can verify your payment without needing access to your account.

A Worked Example: Turning a Messy Case Into a Usable Report

Here is a hypothetical case, with every name and figure invented for illustration, showing how the evidence becomes a summary an analyst can read in a minute.

The situation. A US reader met someone on a social network in March. Over five weeks the contact steered them to a "trading platform" website. The reader bought crypto on a regulated exchange and made three withdrawals to deposit addresses the platform displayed. When they tried to withdraw their "profits," the site demanded a 20% "release tax." They paid it once, and then were asked for more. That release-tax demand is the final stage of the scheme mapped in our guide to how pig butchering scams unfold.

What they gathered.

The summary they pasted into the description field.

The full addresses and hashes go into the form's financial transaction fields, not abbreviated as in this illustration. Under the table, the reader wrote six plain sentences: where they met the person, the platform address, the date the withdrawal was refused, the demand for the tax, the date they stopped paying, and the exchange they used. That is the shape analysts can match against other complaints. A ten-page narrative with the addresses buried in paragraph seven is much harder to use.

Notice two things the reader did not do. They did not hire anyone to "trace" the funds before filing, and they did not wait until they had a complete picture. Their exchange records already contained everything the FBI's guidance asks for.

Filing With IC3 in the United States

IC3 is the FBI's intake point for internet-enabled crime, and its FAQ describes what the form asks for: your contact details, financial details including account information, transaction dates and amounts and who received the money, information about the subject (names, addresses, phone numbers, emails, websites and IP addresses where known), a description of what happened, and email headers where relevant. Cryptocurrency cases have the additional transaction details covered above.

Several rules on the IC3 FAQ save people trouble:

Victims aged 60 and over can get help completing the complaint from the National Elder Fraud Hotline at 833-372-8311, which IC3's cryptocurrency page lists for that purpose.

The scale of what IC3 receives explains why the quality of your report matters. Its 2025 annual report counted 181,565 complaints involving cryptocurrency with reported losses of about $11.366 billion (page 52 of the report). Your complaint joins that pile; clear transaction details are what let an analyst connect it to the right cluster.

Other US Agencies, and When Each One Fits

IC3 is the core filing, but the FTC's guidance on crypto scams lists several more destinations. Each covers a different kind of misconduct, and filing with more than one is normal.

Canada: Police First, Then the CAFC

The Canadian Anti-Fraud Centre sets out its victim steps in a fixed order, and following that order makes later reports easier.

The CAFC also published an impersonation alert, last modified July 2, 2026, describing callers who pose as bank investigators or claim to work with the CAFC, and recovery scammers who pose as the CAFC, police or another government agency and ask for "administrative fees," "security deposits" or "cryptocurrency or wire transfer fees." The alert lists what the CAFC and police will never do: ask you to transfer money or make a payment, ask for remote access to your device, ask for banking information, passwords or verification codes, or ask you to take part in an investigation by sending money.

United Kingdom: Report Fraud, Police Scotland and the FCA

GOV.UK's guidance tells people in England and Wales who think they have lost money or been hacked because of an online scam to contact Report Fraud, online at reportfraud.police.uk or by phone on 0300 123 2040, and tells people in Scotland to report the crime to Police Scotland. The FCA's page adds the Scotland phone route, 101, and Advice Direct Scotland on 0808 164 6000.

The FCA sits second in the sequence. Its consumer page says that if you have lost money to a scam you should contact Report Fraud and then report it to the FCA, and it asks you to check the firm on the FCA Firm Checker first, calling 0800 111 6768 if you cannot find it. The FCA is explicit about its limits: it can only look into scams involving financial services it regulates, and it cannot help you get your money back. It also warns that people who have been scammed are at greater risk of being targeted again by firms pretending to recover lost funds.

If you made a payment from a UK bank account to buy the crypto, the FCA's advice is to tell your bank immediately. UK readers working out the tax consequences of a loss should see our separate guide to how HMRC taxes crypto, because theft and fraud do not fit neatly into the disposal rules.

Telling the Exchange Where the Coins Landed

If stolen funds reach an exchange that verifies its customers, that exchange holds records of who controls the receiving account. So there are two exchanges to think about.

The exchange you sent from. This is the company with a contractual relationship with you. Use its in-app support or fraud form, give the transaction hashes, and say clearly that the transfers were made as a result of fraud. The FTC tells victims to ask for a reversal and refund, but you should expect the answer that an on-chain transfer cannot be reversed by the sender's exchange. The useful outcomes are different: the exchange may flag the receiving addresses, may preserve records for police, and may protect your account if the scammer also had your login.

The exchange the funds went to. If the receiving address belongs to another exchange, and a block explorer label or an investigator can tell you which one, that exchange is where a freeze could theoretically happen. Expect that it may only be able to act on a formal request from law enforcement rather than on a victim's email, which is one more reason to get a police or IC3 report filed early and to quote its reference in any message to the exchange. Write once, factually, include the hashes and the report number, and ask them to preserve records. Do not send threats, and do not pay anyone who claims to have a contact inside an exchange who can release funds.

When you are choosing where to keep crypto in future, our exchange reserve risk checklist covers what to check about a platform before trusting it with a balance.

What Happens After You Report

Expectations are where most victims get hurt a second time, so it is worth being precise about what each agency says it does.

If any money does come back, it comes through official processes outside your control, such as a law-enforcement seizure or an exchange freezing an account before the funds move on. IC3 says it will never directly contact you for information or money, so a request to pay before receiving funds is itself a warning sign. The FTC's crypto guidance puts the underlying problem simply: with cryptocurrency, you can usually only get your money back if the person you paid sends it back.

That is not a reason to skip reporting. Reports are how agencies see that the same domain, username or address cluster appears across many victims, and a filed report is the record that shows who lost what if any later process needs it.

Edge Cases and Common Mistakes

Waiting until you are "sure" it was a scam. If a platform refuses withdrawals unless you pay a fee or tax first, treat that as confirmation. The FBI's guidance says not to wait, and IC3 says to file even if you are unsure your complaint qualifies.

Reporting only to the platform that scammed you. A fake trading site's "support desk" is the scammer. Reports go to the exchange you actually used, to agencies, and to police, never to contacts the platform supplies.

Filing several near-identical IC3 complaints. Each new complaint should only add information, marked as a supplement to the original. Duplicates make matching harder.

Paying for a blockchain "trace" before filing. Tracing shows where coins went; it does not move them back. Agencies can do their own analysis with the hashes you provide.

Deleting the chat out of embarrassment. Chat logs are evidence of the false promises. Archive them instead.

Sharing your recovery phrase with anyone who says they can help. No agency asks for it. The CAFC's alert says police will never ask for passwords or verification codes, and the same logic applies to a seed phrase.

Forgetting the ATM operator. If you fed cash into a crypto kiosk, the FTC tells you to contact the ATM operator immediately, exactly as you would an exchange. State kiosk limits and refund rules differ widely, as set out in bitcoin ATM scams and the state laws that now apply. Keep the receipt the machine printed.

Forgetting the tax side. Your records of what you bought, when, and what was lost will be needed whatever the tax treatment turns out to be. US readers can start with our US crypto tax explainer for how basis and records work, and should get professional advice on any loss claim.

Reporting to a lookalike of an agency. Scammers impersonate these agencies, and IC3 asks people to include the link in their complaint when a website impersonates it. Type the official address yourself: ic3.gov, reportfraud.ftc.gov, antifraudcentre-centreantifraude.ca, reportfraud.police.uk. IC3's home page says it will never contact you directly for information or money and does not work with any non-law-enforcement entity to recover funds.

If Someone Contacts You About Your Report

A message that arrives after you file, offering an update, a refund or a "case officer" for a fee, deserves suspicion by default. IC3 says it will never directly contact you for information or money; the CAFC says it does not contact individuals to request money; the FCA says it cannot get your money back. If the contact claims to be from one of those bodies, end it, look up the agency's number yourself, and add the new contact details to a fresh report as a supplement. Our guide to crypto recovery scams breaks down the scripts these follow-up callers use, stage by stage, so you can spot one in the first message rather than the third payment.

For background on how custody works and why nobody can reach into your wallet to reverse a payment, what a crypto wallet actually holds is a short read. Our other scam guides, including the FTC-based red-flags checklist, are collected on the scams and fraud topic hub.

Once your reports are filed, the most useful next hour you can spend is on the crypto recovery scams guide, because victims who have just reported a loss are the people those callers target first, and recognising their opening line is what stops the second loss.

Frequently Asked Questions

How do I report a crypto scam in the US?

File a complaint with the FBI's Internet Crime Complaint Center at ic3.gov, including the cryptocurrency addresses, amounts and types, dates and times, and transaction hashes, plus how you met the scammer and any websites involved. Also report at ReportFraud.ftc.gov, notify the exchange or ATM operator you used, and add the SEC or CFTC if the scheme was a fake investment or trading platform. Contact local police if the matter is urgent.

Can I get my money back after reporting a crypto scam?

Usually not, and no agency promises it. The FTC notes that crypto payments can usually only be returned if the recipient sends them back, IC3 forwards complaints rather than investigating them itself, and the FCA says it cannot recover money for you. Reporting still matters because it can support an exchange freeze, a seizure in a wider case, and the record you would need if any funds are later recovered.

Does it cost anything to file a report?

No. Filing with IC3, the FTC, the CAFC, Report Fraud or the police is free. IC3, the CAFC and the FCA all warn about people who ask for money to recover losses, and anyone asking you to pay to file a report or to release funds should be treated as a scammer.

Will IC3 contact me after I file?

IC3's FAQ says you will not hear from IC3 and that it cannot give you the status of your complaint. If an agency needs more information, law enforcement makes contact. Save the confirmation page when you file, because IC3 cannot send you a copy later.

What if I live outside the US but the scammer used a US platform?

IC3 accepts complaints from people in other countries and about subjects located abroad, so you can file there as well as with your own national agency. In Canada that means local police and the CAFC; in England and Wales, Report Fraud; in Scotland, Police Scotland on 101.

Has Action Fraud been replaced in the UK?

Yes. The FCA's consumer guidance notes that Action Fraud changed to Report Fraud in a December 2025 update. People in England and Wales report at reportfraud.police.uk or on 0300 123 2040. In Scotland, the route is Police Scotland on 101.

Should I report a crypto scam if I did not lose any money?

Yes. IC3's cryptocurrency page encourages reports even where no financial loss occurred. An attempted scam still gives investigators the domain, usernames and addresses that may match other victims' losses.

Sources

This guide is general information, not legal advice, and reporting procedures change; confirm the current process on each agency's official site before you file. CryptosEyes does not recommend or refer to any private recovery service. If you are being pressured right now to send more money to get earlier money back, stop, and report that contact too.