Phishing & Scam Incident Report Template

A scattered account of a scam is easy to dismiss

After a phishing attack or scam, everything happens at once — you're changing passwords, calling the bank, and trying to remember exactly what you clicked and when. But your bank's fraud team, the police and reporting agencies all need the same thing: a clear, structured record of what happened, what evidence exists, and what you did about it.

A few panicked sentences in an email rarely gets acted on. A complete incident report — dated, itemised, and signed — reads as evidence, moves faster through a fraud team, and strengthens any claim or police report you file.

Step by step

1. Fill in the incident details as soon as possible: date, channel (email, SMS, call, fake site), and the sender address or URL.
2. Record the technical evidence — originating IP if known, the domain of any link clicked, email headers, and screenshot references.
3. Note the financial and account impact: which accounts, cards or crypto were affected, and any amount lost.
4. Log the actions you've already taken — passwords changed, bank notified, accounts frozen, 2FA enabled.
5. Tick where you reported it (Action Fraud, IC3.gov, FTC, your bank) with each case number, then sign and date.

• A structured six-section incident report form
• Incident details, technical evidence and financial impact
• An actions-taken section to show your response
• A reporting checklist: Action Fraud (UK), IC3.gov and FTC (US)
• A declaration and signature block for use as evidence
• Delivered as Word (.docx) and PDF