Report a Scam
Help protect others by reporting scams you've encountered
Reporting a scam to ScamSupport does two specific things. First, the message you submit becomes training data that improves the detection model running in everyone’s browser — the more independent reports a particular pattern attracts, the more confidently the scanner flags the next variant when someone else pastes it in. Second, the report (after personal details are stripped and a moderator has reviewed it) joins the community scam database, where it serves as a quick-lookup confirmation that other people have flagged the same campaign. Neither of those is a substitute for reporting to official UK channels — Report Fraud, your bank, the NCSC, your mobile network — for which the right routes are documented on the UK Scam Reporting Guide.
You do not need to be certain a message is a scam to submit it. The most useful reports we receive are the borderline ones — messages the submitter looked at twice, felt uneasy about, but was not sure how to read. Those are the cases where the model has the most to learn from, and where one extra independent confirmation often tips the cluster from “suspicious individual case” into “confirmed active campaign”. If something felt off when you read the message, that is sufficient grounds to report it.
Your report helps improve our detection algorithms
Personal details are best-effort redacted before storage
Reports are moderated before any public posting
We never share your contact email without explicit consent
What a single report actually does
A single report on its own has limited weight — one person flagging one message is consistent with both an active scam and a misread legitimate email. The decision logic the model uses is therefore cluster-based: when several independent reports arrive for messages that share a sender domain, a subject line and a body-text signature, those reports are joined into a campaign cluster and the cluster’s overall weight grows quickly. Three independent reports of the same Royal Mail redelivery text in two days is conclusive; the same message reported once a week ago and once today might still be a real fraud-alert someone read wrong.
That is why even a borderline submission is useful. You may not be sure whether the message is a scam, but the fact that you found it suspicious enough to report — in the same week as several other people independently reporting something structurally similar — is meaningful data. If the cluster forms, the model treats the pattern as elevated risk on the next scan; if it doesn’t, no harm done and your report just sits, unused, in the moderation queue.
If you have lost money or shared personal details, please also use the official channels — reporting to ScamSupport is the civic contribution that helps the next person, but it doesn’t trigger any of the recovery mechanisms (bank reimbursement, CIFAS protection, takedowns) that change the outcome for you. Our Recover section walks through the right sequence; the brief version is: bank first, Report Fraud second, 7726 / report@phishing.gov.uk third, this form whenever.
Why Reporting Matters
Every scam report we receive does two things. First, it strengthens the detection model — when many people independently report the same wording, sender pattern, or impersonated brand within a short window, those signals get weighted more heavily, so the next person who pastes that message into ScamSupport sees a clearer warning. Second, the report becomes part of the public community database, so others searching for the same suspicious subject line can confirm in seconds that it is in active circulation.
You don't need to be certain it's a scam to report it. If something felt off — a tax refund you weren't expecting, an account-suspension warning when you haven't logged in, a delivery notice for a parcel you didn't order — submit it anyway. False positives are far less damaging than missed campaigns, and your gut feeling is often more accurate than you think.
What Happens After You Submit
Reports are queued for moderator review. We aim to review every submission within a few days, depending on volume — we're a small team, so we won't promise a 24-hour SLA we can't consistently meet. When a report is approved, we strip personal details (email addresses, phone numbers, card-like number patterns, postcodes, NI numbers) from the message body before it enters the public database, then tag it with the scam type and the impersonated brand. High-volume campaigns are surfaced in the weekly digest and on the community database page.
If you provided your email and the report involves a serious or unusual fraud pattern, we may follow up with a short clarifying question. We will never ask for your password, your card number, or any login credential. Anyone who emails you claiming to be from ScamSupport asking for sensitive information is themselves running a scam — please report that too.
Where Else to Report
Reporting to us helps the community, but for serious incidents you should also use the official channels in your jurisdiction:
- UK: Report Fraud (reportfraud.police.uk) for fraud and cybercrime; forward suspicious texts to 7726; forward phishing emails to report@phishing.gov.uk.
- US: FTC at reportfraud.ftc.gov; phishing emails to reportphishing@apwg.org.
- Brand impersonation: forward to spoof@paypal.com, stop-spoofing@amazon.com, reportphishing@apple.com, or phish@office365.microsoft.com — each company actively pulls downinfrastructure used to impersonate them when they have evidence.
What Makes a Good Report
The submissions that strengthen the model the most have three things: the original sender address, the full subject line, and the body of the message exactly as you received it. A screenshot is fine if you can't easily copy the text, but a copy-paste is more useful because it preserves the punctuation and capitalisation patterns the detection model uses as features.
If you received the message via SMS, WhatsApp, or another messaging app rather than email, mention that in the description field. The same scam phrasing scores differently depending on the channel.
You don't need to write commentary or analyse the message yourself. Just paste it.
When Reporting Won't Help
One important caveat: don't reply to the original message to "test" whether it's a scam, and don't follow links to "see where they go". Replying confirms your address is live and makes you a higher-value target for the next campaign. Just paste, submit, delete.
Need Help?
If you've already been scammed, take these steps:
- Contact your bank or payment provider immediately
- Change your passwords if credentials were compromised
- Report to your local police department
- Report to the appropriate organisation (PayPal, Amazon, Apple, etc.)
- Consider filing a report with national fraud agencies (ActionFraud in UK)
- Monitor your accounts for suspicious activity
- Consider credit monitoring services