Reporting a Cyber Crime: Report Fraud, IC3 and More
When your business is hit by fraud, phishing or a cyber attack, knowing where to report it saves precious time. This guide explains how to report a cyber crime in the UK and the US: who to call first, which official service handles what, and what information to have ready.
Key takeaways
- If money has left your account, call your bank first. Speed gives the best chance of stopping or recalling a payment.
- In England, Wales and Northern Ireland, report to Report Fraud, which replaced Action Fraud on 4 December 2025. In Scotland, call Police Scotland on 101.
- In the US, report cyber crime and business email compromise to the FBI's IC3 at ic3.gov, and scams to the FTC at ReportFraud.ftc.gov.
- If personal data was involved, check whether you must notify the ICO in the UK (within 72 hours) or regulators under state law in the US.
- Keep a written log with times and save evidence before you report.
Many small businesses never report cyber crime. Some feel embarrassed, some assume nothing will happen and some simply do not know where to go. That is a mistake. Reporting can help your bank and the police trace money, it creates an official record your insurer may ask for, and it helps agencies spot patterns and warn other businesses.
This guide is about where and how to report. It complements our cybersecurity checklist and our article on spotting phishing. Reporting rules and services change, so check the official websites named here for the latest details. This is general information, not legal advice; if you are unsure about your legal duties, especially around personal data, speak to a qualified adviser.
First things first: who to call in the first hour
Before you fill in any official form, deal with the things that cannot wait. The order matters.
- Call your bank if money was sent. Use the number on your card or bank's official website. Ask them to try to stop or recall the payment and to contact the receiving bank. In the US, this is the best chance of recalling a wire transfer. Every hour counts.
- Contain the problem. Disconnect affected devices from the network, but do not wipe or switch them off before taking advice, so evidence is kept.
- Secure accounts from a clean device. Change passwords for compromised email and other accounts using a device you trust, and sign out all active sessions.
- Call your insurer or IT provider. If you have cyber insurance, use the insurer's incident hotline early, because many policies have notification requirements.
- Start a written log. Note times, what you saw, who you spoke to and what you did. This makes every later report faster and more accurate.
Common mistake
Waiting to report until you "know everything." By then, stolen money may have moved through several accounts. Report what you know now, and add details later.
Reporting in the UK
The UK has different reporting routes depending on where you are and what happened.
England, Wales and Northern Ireland: Report Fraud
Report Fraud is the national service for reporting fraud and cyber crime. It replaced Action Fraud on 4 December 2025. You can report online at reportfraud.police.uk or by phone on 0300 123 2040. Use it for business email compromise, invoice and payment redirection fraud, ransomware, hacked accounts and other online crime. You should receive a reference number; keep it for your bank and insurer.
If a crime is in progress or someone is in immediate danger, call 999 as usual.
Scotland: Police Scotland
In Scotland, report cyber crime and fraud to Police Scotland by calling 101, or 999 in an emergency.
Suspicious emails and texts
Not every suspicious message is a crime with a victim yet. If you receive a phishing email but did not act on it, forward it to [email protected]. Forward scam texts to 7726, which is free. These reports help block scam websites and senders.
Personal data breaches: the ICO
If an attack exposed personal data, such as customer or employee details, you may have to report it to the Information Commissioner's Office (ICO). Under UK GDPR, you must report a personal data breach within 72 hours of becoming aware of it, unless it is unlikely to result in a risk to people's rights and freedoms. If the risk to individuals is high, you must also tell them without undue delay. Record every breach internally, even ones you decide not to report. The ICO helpline is 0303 123 1113, and there is an online report form on ico.org.uk.
The NCSC (National Cyber Security Centre) also publishes free guidance for small businesses on responding to incidents and recovering safely.
Reporting in the US
In the US, the main federal routes depend on whether the incident is a cyber crime against your business or a consumer-style scam.
FBI Internet Crime Complaint Center (IC3)
The IC3, at ic3.gov, is the FBI's central point for reporting internet crime. Use it for business email compromise, ransomware, hacked systems and online fraud that cost your business money. When a wire transfer is involved, contact your bank first, then file an IC3 complaint quickly with as much transaction detail as you can.
Federal Trade Commission (FTC)
Report scams, fraud and identity theft to the FTC at ReportFraud.ftc.gov. This suits fake invoices, impostor scams, scam texts and situations where someone used your business or personal identity. The FTC uses reports to spot trends and bring cases.
Local police, CISA and state rules
Your local police department may take a report too, which some insurers and banks ask for. CISA publishes free guidance for small businesses on preventing and responding to incidents. If personal information was exposed, state data-breach notification laws may require you to notify affected people and, in some states, a regulator. These laws vary by state, so check the rules for each state where affected people live or speak to a lawyer.
| Situation | UK | US |
|---|---|---|
| Money sent to a fraudster | Your bank, then Report Fraud (or Police Scotland on 101) | Your bank, then IC3 |
| Business email compromise | Report Fraud or Police Scotland | IC3 |
| Ransomware | Report Fraud or Police Scotland; your insurer | IC3; your insurer |
| Phishing email, no loss | [email protected] | FTC at ReportFraud.ftc.gov |
| Scam text | Forward to 7726 | FTC at ReportFraud.ftc.gov |
| Personal data exposed | ICO within 72 hours if notifiable | Check state breach notification laws |
Reporting in the EU
EU countries have their own national police and cyber crime reporting services, so check your country's official police website. If a personal data breach is involved, the same 72-hour rule applies under the EU GDPR: report to your national data protection supervisory authority unless the breach is unlikely to result in a risk to individuals.
What information to have ready
A good report is specific. Gather these details before you start the form, and keep copies of everything.
- Your business details: name, address, contact person and a phone number that is not on a compromised system.
- Timeline: when you noticed the problem, when it likely started and the key steps you took, from your written log.
- Financial details: amounts, dates, your bank account, the receiving bank and account details and any transaction references.
- Communications: the suspicious emails with full headers if possible, text messages, phone numbers, web addresses and screenshots.
- Technical details: affected devices and accounts, any ransom note (photograph it) and anything your IT provider has found.
- Reference numbers: from your bank, insurer and any earlier reports.
Pro tip
Put the reporting contacts in your incident plan now, on paper as well as on a shared drive: your bank's fraud line, your insurer's hotline, Report Fraud or IC3, the ICO helpline and your IT provider. During an attack, your email and files may be unavailable.
Example
Imagine Marcus runs a small building supplies firm in Manchester. His accounts assistant pays a supplier invoice to new bank details sent by email, then the real supplier calls asking where their money is. Marcus phones his bank's fraud line straight away and asks them to contact the receiving bank. He then reports the fraud to Report Fraud online and notes the reference number. Next, he calls his insurer and asks his IT provider to check the mailbox for forwarding rules. Because the email account also held customer contact details, he records the incident and takes advice on whether it needs reporting to the ICO. His written log, with times, makes each call quicker than the last.
After you report
Reporting is not the end of the process. Follow through with these steps.
- Keep your reference numbers with your incident log, and share them with your bank and insurer.
- Expect limited updates. Police and agencies receive many reports and may not contact you about each one. Your report still helps.
- Beware of recovery scams. Criminals sometimes contact victims claiming they can recover lost money for a fee. Official agencies do not charge to investigate.
- Fix the root cause. Turn on MFA, add a call-back rule for bank detail changes, review backups and update your incident plan with what you learned.
- Tell your team. Share what happened, without blame, so everyone recognizes the next attempt.
Cyber crime reporting checklist
- Bank's fraud line saved somewhere you can reach without email
- Insurer's incident hotline and policy number recorded
- UK: Report Fraud (reportfraud.police.uk, 0300 123 2040) or Police Scotland on 101
- US: IC3 (ic3.gov) and the FTC (ReportFraud.ftc.gov)
- Phishing emails forwarded to [email protected]; scam texts to 7726
- ICO helpline (0303 123 1113) for personal data breaches
- A written incident log template ready to use
- A list of evidence to preserve and collect
Frequently asked questions
Is it worth reporting a small loss?
Yes. Small losses add up, and your report may connect to a wider investigation. Your bank and insurer may also need an official reference number before they can help.
What happened to Action Fraud?
Action Fraud was replaced by Report Fraud on 4 December 2025. For England, Wales and Northern Ireland, report online at reportfraud.police.uk or call 0300 123 2040. In Scotland, contact Police Scotland on 101.
Do I have to report a cyber attack to the ICO?
Only if personal data was affected and the breach is likely to result in a risk to people's rights and freedoms. If so, report within 72 hours of becoming aware. Record all breaches either way, and check the ICO's guidance or take advice if you are unsure.
Should I report to IC3 and the FTC?
They serve different purposes. IC3 focuses on internet crime such as business email compromise and ransomware, while the FTC collects reports on scams and identity theft. Choose the one that fits your situation; reporting to both is fine where both apply.
Related reading
The bottom line
When cyber crime hits your business, call your bank first if money moved, contain the damage and start a written log. Then report through the right channel: Report Fraud or Police Scotland in the UK, IC3 and the FTC in the US, and the ICO or your national authority if personal data is involved. Save those contacts in your incident plan today, so that on a bad day you can act in minutes rather than searching for the right website.
