So you're being targeted by a phishing campaign
Resources & references on where to report phishing attempts
Here is a quick reference list to report phishing and/or other cybercrimes:
Cybersecurity Incident Reporting Resources
| Country | Agency (link) | Specialization |
|---|---|---|
| United States | Fusion Center Locator | Threats to public safety, including cybercrime |
| United States | IC3 Reporting | All cybercrimes |
| Canada | My Cyber Portal | Cybercrime & malware submission |
| United Kingdom | Action Fraud - National Fraud & Cyber Crime Reporting Center | All cybercrimes & fraudelent activity |
| United Kingdom | National Cyber Security Centre (NCSC) | All cybercrimes (anonymous) |
Why bother contacting these agencies?
Congratulations! You've been selected to win a free iPad. No wait, the CEO needs you to purchase prepaid gift cards and immediately send him the codes. Actually, this is IRS.gov, and you didn’t pay all your taxes. How presidential of you! If you don’t send payment to this Bitcoin wallet address in the next 24 hours, you’ll be fined and audited.
If these hyperbolic inbox threats sound familiar, how do you deal with them? For most of us, we know to avoid clicking any links and then delete the message. But what if you know these emails are targeting a more vulnerable group, such as your elders or non-technical leadership at an organization you care about?
You report the incident… but to whom?
In the United States, your context will matter as there are multiple paths to reporting phishing. You can forward the email to the Anti-Phishing Working Group (APWG) at reportphishing@apwg.org.
If you work for a government or tribal agency or if the phishing attempt threatens public safety, report it to your local Fusion Center. These state-run intelligence centers have a dedicated tip line to investigate all threats to public safety, including cybersecurity. You will receive follow-up on your report.
For most other scenarios, you should report the phishing attempt to the FBI’s Internet Crime Complaint Center (IC3), follow-up may occur.
To the North
For our Canadian readers—individuals, small businesses, IT professionals, or government institutions—there’s a dedicated portal to report cyber incidents through My Cyber Portal.
Across the Pond
For UK friends, you can either report this directly to the police at the Action Fraud website. Alternatively, you can actually call them by dialing 101 (the national non-urgent police phone #).
If discretion is needed, you can also report the incident to the National Cyber Security Centre (NCSC) which states that they will not share the report with regulators, even the Information Commissioner's office.
