Spotted a scam? Report it and tell one person

You recognise a fraudulent message, close it and continue with your day. You did not click, so the incident feels finished. It may be finished for you, but the same message could be reaching a parent, colleague or somebody expecting a similar delivery who will not spot the trap.

Reporting a scam is not an admission of failure. You do not need to conduct your own investigation first. The most useful response is to provide simple, accurate information promptly to the right place.

End the contact first

Do not reply to the scammer, call the supplied number or reopen the link “to make sure”. If the story concerns a known person or business, verify it through another route: a number from your contract, the official app, a workplace chat or a website address you type yourself.

Preserve only what is safe: a screenshot, sender address, telephone number, message text, page address and contact time. Do not download the attachment again or forward a live link into a group chat. You can warn people without redistributing the trap.

Match the report to the situation

A suspicious message or site affecting people in Poland can be submitted through incydent.cert.pl. Report a profile, advert or listing to the platform carrying it as well. At work, use the established route to the helpdesk or security team even when nobody has entered information.

If you sent money, contact the bank or payment provider first because time matters. If you supplied a password, change it through the genuine service and end unfamiliar sessions. Report attempted fraud or theft to the police, retaining correspondence and transaction records.

Tell one person without shaming anyone

A short conversation may protect somebody who receives the same story. Explain what caught your attention and how you verified it. There is no need to name the person who nearly clicked or make them an example for the whole company.

If somebody close to you lost money, ask for facts instead of saying “how could you fall for that?”. Shame delays calls to banks and makes evidence harder to collect. The scammer deliberately creates pressure so that a reasonable person acts faster than usual.

Reporting does not promise an instant result

The page may not disappear immediately after a form is submitted, and money is not automatically returned. Reports still help connect similar cases, block infrastructure, warn other people and build investigations against those responsible.

Retain the report reference if one is provided, but be wary of anyone later offering “guaranteed recovery” for another fee. Information about the first incident can be used in a second scam attempt.

What the source says and what Breachroad recommends

On 28 August 2026, the US Federal Trade Commission explained why reporting a scam matters. The FTC says reports enter a database available to law enforcement, help identify patterns and inform public warnings. It also encourages people to tell one person they know about the scam’s method.

Breachroad recommends a four-part response: end the contact, preserve minimal evidence, report it to the relevant organisation and warn others without sharing the active link. In an organisation, a culture where someone can promptly say “I nearly clicked” matters more than pretending employees never make mistakes.

If money has already been lost, also read our guide to recovery scams. We help organisations build a healthy reporting culture through cybersecurity training.