Nadia’s dad rang her on a Sunday afternoon, quite pleased with himself. A text had told him he was owed a £13 TV licence refund, and the website it linked to wanted his card number to “process” it. Nadia, a pharmacist in Bradford, took one look and knew. She also knew something most people don’t: you can report a scam website to the NCSC in about a minute, for free, and help get it taken offline for everyone. Here’s exactly how she did it.
Reporting a Scam Website at a Glance
| Where to report | The NCSC’s “report a suspicious website” form on ncsc.gov.uk |
| Cost and time | Free, about a minute |
| What to send | The web address, copied or written down — never clicked |
| What happens next | Takedown requests go to hosting companies; browsers add warnings; you get no personal reply |
| Results so far | 58 million reports; 256,000 scams removed across 454,800 URLs (July 2026) |
| Lost money? | Bank first on 159, then Report Fraud on 0300 123 2040 (Scotland: 101) |
| Scam advert instead? | The ASA’s online scam ad report form |
The Refund Site That Rang Alarm Bells
The site Nadia’s dad found looked convincing: a crest, a blue banner, a countdown saying his refund would “expire” in 20 minutes. Scam websites in 2026 are built to pass a quick glance, and they arrive through texts, emails, search results and social media ads. The public has now sent the National Cyber Security Centre 58 million scam reports, which tells you how industrial this has become. Nadia recognised the tricks because she’d read up on the warning signs of fake online shops: pressure timers, a domain registered weeks ago, a page that exists only to collect card details. Her dad wanted to close the tab and forget it. She wanted the site gone before it reached someone else’s dad, so she reached for the NCSC’s form.
Two Minutes on the NCSC Form
Reporting takes less time than making tea. Open the NCSC’s report a suspicious website form and paste in the web address. The NCSC’s own advice: “Do not click on the suspicious link. Carefully copy and paste it, or write it down on paper first if that feels safer.” You can submit several addresses at once, separated by commas, then pick how you came across the site — email, text message, social media, browsing, or online advertising — and add any detail you like. Not certain it’s a scam? Send it anyway; the NCSC asks for sites that merely “feel suspicious”, and there’s no limit. If you’d rather satisfy yourself first, run our 60-second checks to check whether a website is legit before you buy or report.
What Happens After You Press Send
Your report drops into a genuinely effective machine. Analysts assess the site, and confirmed scams go to the NCSC’s Takedown Service, run with the security firm Netcraft, which gathers evidence and sends takedown notices to the hosting companies serving the pages. The site also gets added to safe-browsing lists, so Chrome, Safari and other browsers throw up a red warning page for anyone who clicks later. Details may be shared with the National Crime Agency and City of London Police. The results are real: 256,000 scams removed across 454,800 web addresses by July 2026. One thing you won’t get is a reply — the NCSC acts on every report but never tells you the outcome. It’s the same pipeline that handles things when you report a scam email to report@phishing.gov.uk.
The Right Report for the Right Scam
Nadia’s dad had actually received two scams in one: a text and the website it pointed to. Each has its own letterbox, and using the right one gets faster results. A dodgy website goes to the NCSC form. A scam email gets forwarded to report@phishing.gov.uk, screenshots included if forwarding fails. A scam text costs nothing to report — you simply forward scam texts free to 7726, which alerts your mobile network as well. A paid-for advert on Google, Facebook or a newspaper site goes to the Advertising Standards Authority. And anything involving lost money needs your bank and Report Fraud, not just the NCSC. Nadia sent the text to 7726 and the website to the form, both before her tea went cold.
Scam Adverts: Hit Them Where They Pay
Plenty of scam websites recruit victims through paid adverts — fake celebrity endorsements and too-cheap deals are the classic bait, and they sit on the same pages as legitimate ads. For these, use the ASA’s online scam ad report: reports are automatically shared with the NCSC and passed to the major platforms and ad networks operating in the UK so the adverts come down. You can also report on the spot. On Facebook or Instagram, tap the three dots on the advert, choose Report ad, then “Misleading or scam ad” and “Send a detailed scam report”. On Google, the three dots beside an ad offer a report option too. Adverts pushing miracle returns deserve extra suspicion — learn the investment scam warning signs before anyone you love clicks one.
Telling the Site’s Landlords
Every scam site rents from two landlords: a registrar that sold the domain name and a host that serves the pages, and both can evict it. A free WHOIS lookup on a site such as who.is usually lists a “Registrar Abuse Contact Email” — a short message there, with the address and what the site is doing, goes straight to the people who can pull the plug. You can also tell Google directly through its Safe Browsing “report phishing” form, which helps flag the site with a warning in most browsers. UK domains have an extra guard dog: Nominet, the .uk registry, suspended 6,315 .uk domains in 2024 after criminal-activity referrals. Knowing how to check who really runs a website turns you from a bystander into the person who got it shut.
What Takedowns Can and Can’t Do
Honesty matters here, because a takedown notice is a firm request backed by evidence, not a court order. Most hosts comply quickly; some, parked offshore, drag their feet for days or ignore requests entirely. Criminals also play whack-a-mole, cloning a dead site onto a fresh domain by the weekend. That’s precisely why the browser blocklists matter — even while a stubborn host stalls, the red warning page still protects visitors. Reporting shrinks a scam’s profitable window from weeks to hours, and that alone starves it. What a takedown can’t do is undo anything you typed. If a password went in, change it everywhere it’s reused and switch on two-factor authentication; if card details went in, ring your bank on 159 straight away and say exactly what happened.
If Money Has Already Left Your Account
The NCSC form takes down websites; it doesn’t get money back, and it isn’t a police report. So if you’ve paid a scam site, work through a different list first. Call your bank immediately — 159 connects you to the fraud team at 26 UK banks, or use the number on the back of your card — because quick calls give the best chance of blocking or reversing a payment. Then make it official by reporting it to Report Fraud, the service that replaced Action Fraud in January 2026: online at reportfraud.police.uk any time, or 0300 123 2040 Monday to Friday, 8am to 8pm. You’ll get a crime reference number; in Scotland, ring Police Scotland on 101. Keep the site’s address, screenshots and amounts — investigators want them.
Two Minutes Well Spent
Nadia’s dad kept his £13 and his card number, and the refund site collected one more report towards its takedown. That’s the quiet power of this habit: when you report a scam website to the NCSC, you’re not filling in a form into the void — you’re feeding a machine that has already removed 256,000 scams. Save the form’s address in your bookmarks this week, and next time a dodgy site appears, spend the two minutes before you close the tab.
Frequently Asked Questions
How do I report a scam website to the NCSC?
Go to the report a suspicious website form on ncsc.gov.uk, paste in the copied web address, say how you found it, and submit. It’s free and takes about a minute.
Does reporting a scam website actually work?
Yes. By July 2026 the NCSC had removed 256,000 scams across 454,800 web addresses, using takedown notices to hosting companies and warning pages in major browsers.
Will the NCSC tell me what happened to my report?
No. The NCSC says it acts on every report received but cannot inform you of the outcome, so don’t expect a reply, an email or a case number.
Can I report a website if I’m not sure it’s a scam?
Yes. The NCSC asks people to send websites that merely feel suspicious, even without certainty, and there’s no limit on how many addresses you can report.
What if I lost money on a scam website?
Call your bank first on 159 or the number on your card, then report it to Report Fraud on 0300 123 2040 — or Police Scotland on 101 in Scotland.
Disclaimer: This article is general information, not financial or legal advice. Reporting routes, phone numbers and figures are correct as of September 2026 — always check ncsc.gov.uk and reportfraud.police.uk for the latest guidance.