Report Fraud, a Fake Regulator, or a Suspicious Scheme
Use this page to securely record suspicious emails, messages, websites, advertisements, calls, and other activities that may be associated with financial fraud or attempts to obtain your personal or financial data unlawfully.
If you have already lost money or suspect account compromise:
- contact your bank, payment provider, exchange, or card issuer immediately;
- where necessary, block your cards, restrict online access, and change your passwords;
- preserve correspondence, receipts, URLs, screenshots, telephone numbers, and any other available evidence;
- contact the competent authorities in your jurisdiction if harm has already occurred or there is a risk of repeated debiting.
ISFCA analyses such signals, identifies recurring patterns, and issues public alerts, but does not replace the police, courts, banks, or other authorities empowered to make binding decisions.
Select the type of situation
Have you received a suspicious email?
What not to do
- do not follow links or click buttons contained in the email;
- do not reply to the sender or continue the correspondence until authenticity has been verified;
- do not enter usernames, passwords, card details, or verification codes on pages opened from the email;
- do not open attachments, particularly files with extensions such as .zip, .exe, .docm, or similar formats.
How to record and report the matter appropriately
- take screenshots of the email, the sender’s address, and the message header;
- record the subject line, the time of receipt, and all domains used;
- forward the email to the address specified by your bank or security team (for example, phishing@yourbank.example);
- where appropriate, include the same materials in a report to ISFCA using the form below or by sending them to report@isfca.org.
Such reports assist in identifying new phishing campaigns, updating threat indicators, and warning users and organisations more quickly about recurring scenarios.
Have you received a suspicious SMS message or telephone call?
What to do first
- do not disclose verification codes, PINs, CVV numbers, passwords, or any other confidential data;
- if the caller claims to represent a bank, regulator, or public authority, end the call and contact the organisation directly using its official telephone number;
- retain the number, the text of the message, the date, and the context of the conversation;
- block the contact in your phone and messaging applications after preserving the relevant evidence.
How to report a suspicious contact
- pass the information to your bank, payment service, or another affected organisation;
- where appropriate, submit a complaint to the telecommunications provider or platform through which the message was delivered;
- if the contact relates to financial transactions, investments, a purported “compliance check”, or the release of funds, report it to ISFCA.
Comparison of numbers, communication scripts, and narratives helps identify serial fraud campaigns more quickly and supports the issuance of relevant warnings.
Do you suspect that a website is fake?
How to record and report it
- retain the full URL and take screenshots of the key pages;
- do not download files or run installers offered by such a resource;
- submit the information to the competent cybersecurity centre in your country and, where appropriate, to ISFCA for comparison with other cases.
Information concerning fraudulent websites supports domain blocking, strengthens client warnings, and reduces the operational lifespan of fraudulent infrastructure.
Have you identified suspicious advertising or an investment offer?
What to look for
- promises of guaranteed, exceptionally high, or “risk-free” returns;
- use of regulators’ logos and the names of well-known organisations without genuine links to registers or official confirmations;
- references to “official approval” without documents, a licence number, or a clearly identified jurisdiction;
- false testimonials, repetitive success stories, pressure through urgency, and demands for additional payment as a condition of withdrawal.
How to report such advertising appropriately
- take screenshots of the advertisement and the page to which it leads;
- use the platform’s built-in reporting mechanism;
- where appropriate, notify the advertising or consumer regulator in your country;
- send the materials to ISFCA if the advertisement relates to financial products, investments, crypto-assets, or payment services.
Timely complaints help remove fraudulent advertisements, update platform filters, and warn potential victims before funds are transferred.
