How to Report Scams

Start where the bait arrived. In Gmail, Outlook, and most work clients there is Report phishing / Report junk / a phishing ribbon — that signal is more useful than a forward to ten coworkers. Marking spam is weaker than marking phishing when the client offers both; phishing means "this impersonates a brand or asks for secrets," not "I do not want newsletters." On the phone, mark the SMS as junk/spam and block the sender. Do not tap "unsubscribe" on a smish — that confirms a live number. In chat apps, use the in-app report/block on the account that pitched the fake job or the "CEO" voice note. Stores matter because Module 2 fake apps live there. Play Store and App Store have a report control on the listing — that is how a clone "trading" app gets reviewed. Social networks and classifieds have report on the post, not a duel in comments. Workplace: follow the playbook you were given (report button, security mailbox your IT published). You are handing them the message, not a forensic disk image you carved from a stranger's server.

Do not forward the attachment to friends, family group chats, or a personal Gmail "archive" that auto-opens previews. .html, .iso, double extensions, and password-zip "invoices" are how malware leaves your incident and becomes theirs. If IT asks you to submit the mail, use their official report path — many clients attach headers without you sending the payload to a random alias. Screenshots of the visible message (sender line, subject, date) are evidence. Re-clicking the link to "get a better screenshot" is a second incident.

If money or cards were involved, the bank/card/wallet is a reporting channel, not a suggestion. Use the number printed on YOUR card, the official app you already installed from the real store, or the bank site you type the way Topic 4 taught — never a link or callback number from the scam. Say you want to report fraud or unauthorized activity on YOUR account. Ask about freezing the card, reversing a transfer if still possible, and a dispute reference number. Write that number down. That is your evidence pack's spine. Platforms (payment apps, marketplaces) have in-app "report a payment / report this user" flows. Use those. For a scam site or phishing domain, the hosting/provider report is optional and still official — registrar or platform abuse forms you navigate to yourself, not a crowdsourced "takedown as a service" tweet. Your country may have a cybercrime or consumer-protection portal you already know from news or your bank's own fraud page. Go there if you already know it. This course will not invent a URL, a ministry name, or a "global FBI inbox." If you do not know the portal, the bank and the platform button still count.

Evidence you can keep without attacking anyone: screenshot of the full sender/handle (not cropped to hide context), date and time, amount and currency if money moved, the scam URL or wallet or phone written as text (so you are not tempted to tap it), and the bank/platform reference number. Store that in a notes file you control — next practical — not in a public album. You do not need the attacker's home address. You do not need to "trace the wallet on-chain as a hunt." Investigators, if any, work from official reports. Your job is a clean pack, not a dossier.

Email headers are the Received / Message-ID / Return-Path trail that shows which servers handled the message. Analysts and some banks ask for "full headers" or "show original." In Gmail that is the three-dot menu → Show original; other clients say View source / View headers. Copy that into the ticket they opened — the bank portal or IT case — not into a Discord. Headers are not a license to query other people's mail servers. They are a paste of YOUR message's metadata. Never put passwords, OTPs, backup codes, or card PANs into a report form. Real intake does not need the secret you already rotated. If a form asks for the password "to verify you," that form is another phish. Stop. Type the institution yourself and start over. Reporting is not a second login.

This is a UI hunt on an account you own. You will not send a real phish to Cyberlium, Mentor, or classmates. You will not file a false report against a real brand. You will locate the control, write where it lives, and chmod 600. If your provider uses different words (Report junk / Report abuse), write those words. The skill is knowing the button before you need it under shame.

mkdir -p "$HOME/cyberlium-lab"
NOTES="$HOME/cyberlium-lab/report-scams.txt"

{
  echo "report-scams notes — MY accounts, official channels only"
  echo "date: $(date -Iseconds 2>/dev/null || date)"
  echo ""
  echo "mail_provider: (Gmail / Outlook / work / other — name yours)"
  echo "report_phishing_control: (menu path you actually found)"
  echo "  example shape: three dots → Report phishing  /  Junk → Phishing"
  echo "sms_junk_or_block: (where on YOUR phone)"
  echo "store_report_if_relevant: (Play Store / App Store listing report — if you use stores)"
  echo ""
  echo "if money ever involved:"
  echo "  bank_path: official site I TYPE or number printed on MY card"
  echo "  I will ask for a dispute / fraud reference number"
  echo ""
  echo "headers_if_asked: Show original / View headers on MY message"
  echo "  paste only into the bank or IT ticket they opened"
  echo ""
  echo "evidence_pack_template:"
  echo "  - screenshot with full sender visible"
  echo "  - date/time"
  echo "  - amount (if any)"
  echo "  - URL / wallet / phone as TEXT (do not tap again)"
  echo "  - bank or platform reference number"
  echo ""
  echo "country_portal: only if I already know it — I will not invent a URL"
  echo ""
  echo "ETHICS:"
  echo "No forwarding attachments. No hack-back. No doxxing. No revenge."
  echo "No passwords / OTPs / codes in report forms."
} > "$NOTES"
chmod 600 "$NOTES"
ls -l "$NOTES"

You now report on the channel that received the bait, preserve a quiet evidence pack, give headers only when official intake asks, and take money issues to the bank you already have — never to a number in the text. Forwarding malware is how incidents spread. Hack-back and doxxing are out of scope. Next — Hardening After a Close Call — you connect Topic 4's password manager, MFA, and recovery kit to this topic's urgency, gift cards, and cloned voices, and you write a family callback rule before the next emergency.