To report a hacker to the police, call your local police department’s non-emergency line or go to a station in person to file a report and get a case number, and also file a complaint with the FBI’s Internet Crime Complaint Center at ic3.gov. For most cybercrimes, IC3 is the more effective federal channel; in 2024 it received over 859,000 complaints representing $16.6 billion in reported losses. The strength of either report depends almost entirely on the evidence you bring to it, so the real work starts before you contact anyone.
Gather Evidence First
Law enforcement can only act on what you can show them. Before you call, write down a timeline: when you first noticed something wrong, what the hacker appeared to do, and in what order. Investigators hear vague accounts constantly, and a clear chronology sets your case apart immediately.
Then collect the digital evidence. Screenshots of fraudulent messages, suspicious login alerts from unfamiliar locations, unauthorized transactions, ransom demands, and any direct communication from the hacker all count. Save them to a separate device or a cloud folder the hacker hasn’t touched. If your email was breached, check the sent and forwarded folders for messages the hacker may have used to target other people or reroute account-recovery links.
Pull your bank and credit card statements and highlight every unauthorized charge. Clear financial records help investigators assess severity and decide which charges are available to pursue. 1Office of the Law Revision Counsel. 18 USC 1030 – Fraud and Related Activity in Connection With Computers Finally, pull together anything that might identify the attacker: usernames, email addresses, cryptocurrency wallet addresses, suspicious URLs, phone numbers. Details that look trivial on their own can connect your case to a larger pattern.
Where to File
You have two primary options, and in most cases you should use both.
Local Police
Call your local department’s non-emergency line or walk into a station. Bring your timeline, your evidence, and your financial records. The officer will take your statement and give you a case number. Keep that number: your bank, credit card company, and insurance provider will likely ask for it when you dispute charges or file claims. Local police are the right starting point when the hacker is someone you know, when the crime happened in your area, or when you need an official report quickly for financial disputes.
The FBI’s Internet Crime Complaint Center
For most hacking incidents, file a complaint at ic3.gov. IC3 is the FBI’s central intake point for cyber-enabled crime, and anyone who believes they’ve been affected can submit a report. 2Internet Crime Complaint Center (IC3). About The online form asks for details about the incident, the financial impact, and anything you know about the perpetrator. Once submitted, the complaint is reviewed and may be referred to federal, state, local, or international agencies for investigation. 3Internet Crime Complaint Center (IC3). Home Page
IC3 matters most when the hacking crossed state lines, involved substantial losses, or looks like it might be part of a broader operation. Even if your individual case doesn’t lead to prosecution, your report feeds pattern analysis that helps investigators spot criminal networks and emerging threats.
The U.S. Secret Service
If the hack involved significant financial fraud, like compromised payment systems, stolen credit card data, ransomware, or business email compromise, the Secret Service’s Cyber Fraud Task Forces also investigate. You can report to your nearest field office directly. 4United States Secret Service. Field Offices There is no published minimum dollar threshold, but the focus is on complex, financially motivated cybercrime rather than individual account takeovers.
Be Accurate
Whatever federal channel you use, everything you submit must be truthful. Making materially false statements to federal law enforcement is a separate crime carrying up to five years in prison. 5Office of the Law Revision Counsel. 18 U.S. Code 1001 – Statements or Entries Generally Report what you know, be upfront about what you’re guessing, and don’t inflate losses.
File an Identity Theft Report if Personal Information Was Taken
If the hacker got personal information like your Social Security number, date of birth, or financial account details, file an identity theft report at IdentityTheft.gov. This is separate from a police report and does different work. The FTC’s site walks you through questions about your situation and generates a personalized recovery plan with pre-filled letters and dispute forms you can send to creditors and credit bureaus.
The report itself carries legal weight. Under the Fair Credit Reporting Act, submitting one entitles you to an extended fraud alert lasting seven years on your credit file, well beyond the standard one-year alert anyone can request. 6Office of the Law Revision Counsel. 15 U.S. Code 1681c-1 – Identity Theft Prevention; Fraud Alerts and Active Duty Alerts It also qualifies you for a five-year exclusion from pre-screened credit offers. Many creditors and debt collectors require an FTC identity theft report before they will investigate or remove fraudulent accounts.
If your Social Security number was compromised, the Social Security Administration directs you to file through the FTC rather than through SSA itself. 7Social Security Administration. Report Stolen Social Security Number The FTC report becomes the foundation for disputing any fraudulent use of the number.
Protect Your Accounts and Finances in Parallel
Reports are necessary, but they won’t stop a hacker who still has your credentials. These steps should happen alongside your reporting, not after.
Call Your Bank and Card Issuers
Call the fraud department of every financial institution where you have seen unauthorized activity. Ask them to freeze or close compromised accounts and reverse fraudulent transactions. Speed changes your legal exposure.
When a hacker gets into your bank account without stealing your physical card, which is the typical remote-hack scenario, the tiered $50 and $500 liability caps that apply to lost or stolen cards don’t apply. Instead, you need to report unauthorized transfers within 60 days of the date your financial institution sends the statement showing them. Report within that window and you owe nothing for the unauthorized transfers. Miss it, and you can be liable for every unauthorized transfer that occurs after the 60-day period until you finally notify the bank. 8Consumer Financial Protection Bureau. 1005.6 Liability of Consumer for Unauthorized Transfers
If the hacker did steal your debit card number or the card itself, stricter timelines apply. Reporting within two business days of learning about the theft caps your liability at $50. Waiting longer but still reporting within 60 days raises the maximum to $500. After 60 days, the cap disappears entirely. 9Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability Either way, report immediately.
Place a Fraud Alert or Credit Freeze
A fraud alert is a flag on your credit file telling lenders to verify your identity before opening new credit in your name. The initial version is free, lasts one year, and you only need to contact one of the three major credit bureaus, Equifax, Experian, or TransUnion, because that bureau must notify the other two. 10Federal Trade Commission. Credit Freezes and Fraud Alerts An FTC identity theft report qualifies you for the seven-year extended alert.
A credit freeze goes further. It blocks anyone, including you, from accessing your credit report to open new accounts until you lift the freeze. Freezes are free to place and lift under federal law, but unlike fraud alerts, you have to contact each of the three bureaus separately. 10Federal Trade Commission. Credit Freezes and Fraud Alerts For most hacking victims, a freeze is the stronger move. An alert asks lenders to check your identity; a freeze keeps the report inaccessible in the first place.
Secure Your Accounts
Change passwords on every compromised account first, then every account that shared the same password or was linked to a compromised email. Use a different password for each service. Turn on two-factor authentication wherever it is available; this one step blocks most unauthorized logins even if your password is already out there. Notify service providers like email, social media, and cloud storage through their security or account-recovery channels so they can flag suspicious activity and help you restore access if you have been locked out.
What Happens After You File
After filing with local police, you’ll get a case number and a copy of the report. After filing with IC3, you’ll get a complaint confirmation. IC3 is explicit that you will not receive follow-up communication about the status of your complaint; your report enters an analytical pipeline, and if it warrants further investigation, the appropriate agency takes over without notifying you. 3Internet Crime Complaint Center (IC3). Home Page
The honest reality is that most individual hacking cases don’t end in an arrest. Hackers routinely operate from other countries, use anonymizing tools, and route attacks through compromised third-party systems. Agencies receive hundreds of thousands of complaints a year and prioritize based on the scale of the operation, the strength of available evidence, and whether the case connects to a broader network. A case involving $800 taken from one bank account, genuinely harmful to the victim, typically won’t draw the same resources as a ring that compromised thousands of accounts.
Filing is still worth doing. Your police report creates a legal record you’ll need for bank disputes, insurance claims, and credit bureau disputes. Your IC3 complaint feeds intelligence databases that help investigators connect cases; the person who hacked you may have hacked hundreds of others, and your report could be the piece that completes the picture.