You spot a fake shop. You click the report button. A message tells you the report was received. Two weeks later the site is still up, still taking people’s money. If you have ever wondered why a scam website report seems to vanish into nothing, you are not missing something obvious — the system genuinely does not work the way most people assume it does.

The Report Button Feels Like Something, But Often Is Not

The confirmation screen after you report a scam website creates the impression that something is now in motion. Usually, very little is. The act of submitting a report and the act of forcing a site offline are handled by completely separate organisations, and there is no automatic pipeline connecting them.

This is not negligence or indifference on the part of any one organisation. It is a structural problem baked into how the internet was built and how enforcement is divided across it. Understanding the structure is the only way to understand why “I reported it and nothing happened” is such a common experience.

Where Your Scam Website Report Actually Goes

Most people report scams through one of three routes:

• Browser built-in tools — Chrome and Edge both have report options that feed into Google Safe Browsing and Microsoft SmartScreen respectively.
• National fraud agencies — Action Fraud in the UK, the FTC in the United States, Scamwatch in Australia.
• The hosting company or domain registrar — the hosting company rents server space to the scammer; the domain registrar is the business that sold them the web address, such as GoDaddy or Namecheap.

Browser reports do something useful but limited: they update a shared blocklist that can show a warning to future visitors. They do not remove the site.

National fraud agencies collect reports to identify patterns and build cases against large criminal operations. A single report rarely triggers individual action. The FTC received more than 2.6 million fraud reports in 2023, according to its own published data — the volume alone makes case-by-case responses impossible.

Why Hosting Companies and Registrars Move Slowly

Hosting companies and registrars are not law enforcement. They have no legal power to investigate fraud. What they can do is enforce their own terms of service — and that process involves a human being reading an abuse report, checking whether the complaint clearly describes a terms violation, and deciding whether to act. That can take days. It often takes weeks.

Scammers know this. A common tactic is domain hopping: when one domain gets flagged, the operation simply registers a new one — sometimes within hours — and continues. A fake shop might cycle through four or five domains before any single one is suspended.

Then there is bulletproof hosting: a category of hosting companies that deliberately do not act on abuse reports. These businesses operate in jurisdictions where local law gives them cover to ignore complaints from foreign agencies. Reporting to a bulletproof host achieves nothing.

The Jurisdiction Problem Nobody Warns You About

The internet has no single governing body. A scam site hosted on servers in Moldova, registered through a company in Belize, targeting victims in Canada creates a legal tangle that no single agency can cut through quickly.

UK law enforcement, for example, cannot simply order a server taken down if that server sits in a country with no mutual legal assistance treaty with the UK. Formal cooperation requests exist, but they move slowly — months, not days.

Even within one country, most fraud units are dealing with far more reports than they have staff to process. The frustration people feel when nothing happens is completely justified. The system is genuinely under-resourced relative to the problem.

What Actually Does Get Sites Taken Down

The fastest removals tend to come from payment processors. If Visa, Mastercard, or PayPal stops processing payments for a site, the site loses its reason to exist. Payment processors have their own fraud detection teams and respond to direct merchant complaints faster than most government agencies do.

Reporting to a payment processor is underused. Most people do not think to do it, but if you can see a Visa or PayPal logo at the bottom of a scam page, those companies have a direct financial interest in removing fraudulent merchants from their networks.

Coordinated multi-agency takedowns do happen, but they target criminal networks, not individual pages. Operation Cookie Monster in 2023, which involved agencies from seventeen countries, is one example — that kind of action takes months of preparation.

Major brand impersonation — a site faking Barclays Bank or Amazon — tends to get faster action because the real company has a legal team that files formal notices. A generic fake shop with no famous name attached has no one fighting for it except the victim.

How This Connects to Your Digital Identity

Scam sites survive partly because registering a domain or renting hosting requires no identity verification. You can spin up a fraudulent site in under an hour with a prepaid card and a fake name.

The obvious fix — require real identity verification for anyone who registers a domain — would also create a centralised database of who runs every website on the internet. That database would be a target for authoritarian governments, data breaches, and surveillance. The same anonymity that protects a scammer also protects a whistleblower, a domestic abuse survivor running a support forum, or a journalist working in a hostile country.

There is no clean answer here. Every proposal to increase accountability online carries a corresponding cost to privacy. That trade-off is at the centre of most digital identity debates, and anyone who tells you it is simple is not being straight with you.

What You Can Do That Actually Helps

• Report to the payment processor. Look for card or payment logos at the bottom of the scam page. Visa, Mastercard, and PayPal all have merchant fraud reporting forms.
• Report to Google Safe Browsing and Microsoft SmartScreen. This will not take the site down, but it will warn future visitors in Chrome and Edge.
• Call your bank immediately if you paid. Chargeback rights are time-sensitive — in the UK, Section 75 of the Consumer Credit Act covers credit card purchases over £100, but you need to act quickly.
• File with your national fraud agency anyway. In the UK that is Action Fraud. In the US it is the FTC at reportfraud.ftc.gov. In Australia it is Scamwatch. Your report feeds enforcement data even if no one contacts you back.
• Share the URL in relevant online communities. Collective warnings spread faster than official processes. A post in a consumer advice forum or subreddit can reach thousands of potential victims within hours.

Frequently asked questions

Does reporting a scam website to Google actually do anything?

Yes, but in a limited way. Reporting through Google Safe Browsing adds the site to a shared blocklist. Once it is listed, Chrome will show a warning page to anyone who tries to visit it. The site itself stays up — Google has no power to remove it — but the warning can stop people from handing over their money or personal details.

Who has the actual power to force a scam website offline?

In practice, the parties with the most leverage are payment processors (who can cut off revenue), the hosting company (who can suspend the account), and the domain registrar (who can cancel the web address). Law enforcement can compel action too, but only through legal processes that take time and depend heavily on where the server is physically located.

If I lost money to a scam site, is there any point reporting it?

Yes, for two reasons. First, your report joins a dataset that fraud agencies use to identify patterns and build prosecutions against larger operations — your case may be the detail that connects several others. Second, reporting to your bank or card provider is a separate process with real financial consequences for you personally, and the sooner you do it, the better your chances of recovering the money.

Digital ID keeps coming back because the underlying problem is real: online systems genuinely cannot tell who anyone is. The question is who gets to hold that identity — you, a government database, or a company that sells it on.

There is a version of this where you own your identity and prove things about yourself without handing over your life. That is what we are working on.

Get Wes Kussmaul’s Escape the Plantation free, and follow where this goes.