F‑Secure prides itself on delivering some of the most insightful guides on how to protect your­self online. And when it comes to how to report a scam website, it isn’t always easy to know where to start.

But reporting a scam website is an important step in making the internet a bit safer, and it can help prevent others from falling victim to cyber criminals, while also making the internet a generally better place for all of us.

The fastest way to spot a scam shopping site is to check a shop with F-Secure Online Shopping Checker. And if you’ve read our guide on how to spot scam web­sites, you will already be one step ahead, and know some of the tell-tale signs to look out for, such as browser warnings, too-good-to-be-true offers and web­sites that mimic your bank’s login site but have a subtly different URL. However, you still need to be careful. And if you do spot a fake website, make sure you don’t engage with it in any way, such as contacting the owners via email, providing personal or payment details, or messaging them via social media.

Lastly, don’t forget that how you report a scam website is going to vary depending on your location, but some universal tips will still apply, and can hopefully ensure that the scammer you’ve identified won’t be operating for much longer.

1. Record the website details

Before you report a scam website to the relevant authorities (and bear in mind that not every country has a dedicated reporting system for scam sites), it’s important to record the details they are likely to ask for. So, this is the best time to take a screen­shot, make a note of the site’s URL, write a few words about why you think the site isn’t legitimate, and list details about any payments that might have been made (such as the amount, how the money was sent, and on which date).

2. Report to the appropriate authorities

Depending on where you live, there should be a national body that provide the opportunity to report a scam website. For example, in the U.S. you can visit the Federal Trade Commission (FTC) to report a scam online. And once it comes to reporting the details, organizations such as the FTC will ask for information, such as whether the offending site is pretending to be another brand, what details it might have stolen, and if it’s involved in identity theft.

As well as reporting the scam at a national level, you should also contact your local police authority to report any fraudulent online stores.

3. Contact your bank if necessary

If you’ve already provided financial information or made a purchase on a scam website, contact your bank or payment service provider and give them the trans­action and website details (the phone number and other details are often printed on your card). Your bank or payment provider will provide further advice and potentially reverse fraudulent trans­actions. And once you have done this, you can then minimize your risk of any further issues by following these tips.

4. Report to the host

With some basic sleuthing you can often find out where a website is hosted. Simply make a note of the scam site’s URL, visit the ICANN Lookup tool, enter the URL, and then scroll down to the Registrar Information section. Here you should be able to see the name of the scammer’s web host, with a link below. Click the link and then navigate to the contact section, where you should be able to send a report to the company that registered the domain. Based on your report, the registrar (which is often the same company that provides hosting) may then be able to either suspend or remove the offending site.

5. Tell Google all about it

As the world’s most popular web browser, Google does a lot to protect you from scam sites, using its Google Safe Browsing service which maintains a list of potentially harmful web­sites. And when someone visits one of these sites in Google Chrome it triggers a warning, designed to prevent them from phishing and malware attacks. But Google doesn’t spot every offender, so you also have the option to report scam site manually via this web form. And it’s worth doing this manually to ensure that it gets logged.