How to Report Cyber Crime in California: Agencies, IC3, and Credit Steps

If you’ve been hit by cybercrime in California, file reports at three levels at once: the FBI’s Internet Crime Complaint Center (IC3) for federal tracking, your local police department or sheriff’s office for an official report, and the California Attorney General’s Cybercrime Section for state-level investigation. Knowing how to report cyber crime in California means understanding that no single agency handles every type of case, and that financial recovery almost always depends on having a paper trail from more than one of them. Digital evidence degrades quickly, banks and credit bureaus will ask for documentation before they’ll act, and the sooner each report is in, the better your odds.

Which Agency Handles What

Most victims should contact all three levels rather than guessing which one owns the case. Each exists for a different purpose.

The IC3 is the FBI’s central intake for cybercrime complaints. It covers fraud schemes that cross state or international lines, large-dollar losses, ransomware, and crimes with no clear local connection.¹ IC3 analysts review every complaint and route it to the appropriate FBI field office or partner agency.² Whether anyone acts on your individual case depends on the receiving office’s priorities, so don’t treat this as your only filing.

Your local police or sheriff is the right contact when there’s a physical or local element, or when you need an official police report for your bank or credit bureaus. For identity theft, California law requires your local agency to take a report and give you a copy if you live or do business in its jurisdiction.³

The California Attorney General’s Cybercrime Section investigates and prosecutes unauthorized computer intrusions, internet fraud, cryptocurrency-based money laundering, cyberstalking, and cyber-extortion.⁴ The AG also funds five regional High Technology Theft Apprehension and Prosecution (HTTAP) task forces that back up local agencies with digital forensics expertise.⁵

One boundary worth knowing: the California Highway Patrol’s Computer Crimes Investigation Unit handles violations of Penal Code 502 only when a state government agency is the victim.⁶ If you’re an individual, the CHP is not your contact.

What to Gather Before You File

Investigators lose ground when victims report weeks later with vague recollections. Before you sit down to file anywhere, pull together as much of the following as you can. You don’t need everything on this list, but more detail makes a stronger complaint.

A timeline: when the first suspicious contact happened, when you realized something was wrong, and when you discovered any financial loss.
The method of attack: phishing email, fake website, ransomware, phone scam, social media impersonation, or something else.
Communication records: screenshots of emails, texts, direct messages, and any other exchanges with the suspect. Keep the originals too.
Technical details: full email headers from fraudulent messages, URLs, IP addresses if you have them, and any usernames, phone numbers, or profiles the suspect used.
Financial records: transaction logs, statements showing unauthorized charges, wire transfer receipts, cryptocurrency wallet addresses, and the total dollar amount lost.

Take screenshots early. Scammers delete profiles, take down fake websites, and purge message histories. A timestamped screenshot is worth far more than a memory of what a page said.

How to File With IC3

IC3’s complaint form is at ic3.gov and runs through seven steps.⁷ It takes about 20 to 30 minutes if your evidence is already gathered.

Step 1 asks who is filing and your basic contact information.
Step 2 collects your full address, age range, and whether you’re filing for a business. Business filers are also asked about operational impact and critical infrastructure sector.
Step 3 covers financial transactions: whether you lost money, the total, how it moved (wire, cryptocurrency, gift card, debit or credit card, peer-to-peer), the amount and date of each transaction, and whether you’ve already contacted your bank.
Step 4 asks for everything you know about the suspect: name, address, phone, email, website, social media, and IP address. The fields are optional; fill in what you have.
Step 5 is a free-text description up to 3,500 characters. Clear chronological detail matters most here.
Step 6 is optional technical information: email headers, cryptocurrency data, ransomware file hashes, other witnesses, and whether you’ve already reported to another agency.
Step 7 is a typed digital signature acknowledging that providing false information is a federal crime.

After you submit, you’ll get a confirmation number. Save it. IC3 does not investigate directly or send case updates.²

Filing a Local Police Report

For identity theft, this step is both legally required and practically essential. Under Penal Code 530.6, any California law enforcement agency must take a report from a victim who lives or does business in its jurisdiction, provide a copy, and begin an investigation.³ If the crime actually occurred elsewhere, the agency can refer the case to the correct jurisdiction, but it still has to take your initial report.

Don’t let a desk officer wave you off by saying cybercrime isn’t their department. The statute doesn’t give agencies discretion to decline identity theft reports from local residents. If someone used your personal information for any unlawful purpose, including obtaining credit, goods, services, or medical care in your name, it falls under Penal Code 530.5 and you’re entitled to a report.⁸

That police report unlocks several things at once. Banks and creditors ask for it before closing fraudulent accounts or reversing unauthorized charges. Credit bureaus require it, or an FTC Identity Theft Report, to place an extended fraud alert. And if someone commits a crime using your identity, the court record must note you weren’t the person who committed it.⁸

Reporting to the California Attorney General

The AG’s reporting page directs victims to three channels: your local law enforcement agency, your nearest HTTAP-funded high-tech task force, or the AG’s Cybercrime Section directly.⁹ The Cybercrime Section’s own caseload covers unauthorized computer intrusions, internet fraud, cryptocurrency money laundering, organized retail crime involving significant digital evidence, cyberstalking, and cyber-extortion.⁴

This filing matters most when the crime is too technical for a local department to handle alone. Small-town agencies rarely have digital forensics teams, and the Cybercrime Section exists partly to fill that gap, providing investigative and technical support statewide, including in rural counties without their own HTTAP task force.⁴

Lock Down Your Credit

Once reports are filed, move fast to stop a thief from opening new accounts in your name. Federal law gives you two tools: fraud alerts and credit freezes. Many victims should use both.

Fraud Alerts

A fraud alert tells lenders to verify your identity before issuing new credit. You only need to contact one of the three major credit bureaus (Equifax, Experian, or TransUnion); that bureau has to notify the other two.¹⁰ An initial alert lasts one year and is available to anyone who suspects fraud.¹¹ You can renew it.

An extended fraud alert lasts seven years but requires an identity theft report, either a police report or an FTC report filed at IdentityTheft.gov.¹⁰ The extended alert also removes you from prescreened credit and insurance offer lists for five years.

Credit Freezes

A freeze is stronger. It blocks the credit bureau from releasing your report at all, which means no one can open a new account in your name, including you, until you lift it.¹⁰ Unlike with alerts, you have to contact each of the three bureaus separately. Under federal law, placing and lifting a freeze is free, and phone or online requests must be processed within one business day.¹²

California adds its own layer. Under Civil Code 1785.11.2, a credit reporting agency must give you a unique PIN or password to manage the freeze and send written confirmation within 10 business days.¹³ Identity theft victims who submit a valid police report alleging a Penal Code 530.5 violation are exempt from any state-law fees.

A freeze stays in place until you lift it. When you apply for credit, you can lift it temporarily for a specific lender or a specific window rather than removing it entirely.

Notify Your Bank Fast

Federal law caps your liability for unauthorized card charges, but the caps change based on how quickly you report. Speed is everything.

Credit Cards

Under the Truth in Lending Act, your maximum liability for unauthorized credit card charges is $50, and only if the issuer met several conditions, including giving notice of your potential liability and a way to report the loss.¹⁴ Most major issuers advertise zero-liability policies and waive even that $50. If only your card number was stolen and you still have the physical card, you generally owe nothing. Report the fraud as soon as you notice it.

Debit Cards and Bank Accounts

Debit cards are less forgiving. Liability under the Electronic Fund Transfer Act is tiered:

Within 2 business days of learning about the loss or theft, your liability is capped at $50 or the amount of unauthorized transfers before you notified the bank, whichever is less.¹⁵
After 2 business days but within 60 days of your statement, liability can rise to $500 for transfers that occurred after the two-day window closed.¹⁶
After 60 days from your statement date, you could be responsible for every unauthorized transfer that occurred after the 60-day window, with no cap.¹⁶

Check your statements regularly and report anything suspicious within two business days. If something kept you from notifying the bank in time, like a hospital stay or extended travel, the bank must extend these deadlines to a reasonable period.¹⁵

When a Business Loses Your Data

Sometimes the breach isn’t anything you did. Under Civil Code 1798.82, any business operating in California that experiences a data breach must notify affected California residents in writing, within 30 days of discovering it. The notice has to be titled “Notice of Data Breach” and must explain what happened, what information was exposed, what the business is doing, and what you can do. It must be at least 10-point type with clearly displayed headings.¹⁷ If a company holding your data is breached and you’re never notified, that itself is a potential violation worth reporting to the Attorney General.

Clearing Fraudulent Accounts Off Your Credit Report

Under the Fair Credit Reporting Act, identity theft victims can require credit bureaus to block fraudulent information from their files. To use this right, identify the specific accounts or entries that resulted from the theft, prove your identity, and provide a copy of your identity theft report, either a police report or an FTC IdentityTheft.gov report.¹⁰ Once a fraudulent debt is blocked, no debt collector can continue pursuing you on it.¹¹

You can also send written requests directly to the businesses that reported the fraudulent information, telling them to stop reporting it to credit bureaus. Include the same identity theft report and specify which accounts are fraudulent. That stops the bad data at its source.

Filing an FTC Identity Theft Report at IdentityTheft.gov is worth doing even if you already have a police report. The FTC report generates a standardized document that creditors and bureaus often accept more readily than a local police report, and the site builds a personalized recovery plan based on the type of fraud you experienced.

1
Internet Crime Complaint Center. About
2
Internet Crime Complaint Center. FAQ
3
California Legislative Information. California Code PEN 530.6
4
California Department of Justice. Cybercrime Section
5
State of California – Department of Justice – Office of the Attorney General. High Technology Theft Apprehension and Prosecution Program
6
California Highway Patrol. Reporting Computer Crimes for State Employees
7
Internet Crime Complaint Center. Complaint Form
8
California Legislative Information. California Code PEN 530.5
9
California Department of Justice. Report a Crime
10
Federal Trade Commission. Credit Freezes and Fraud Alerts
11
Office of the Law Revision Counsel. 15 U.S. Code 1681c-1
12
Office of the Law Revision Counsel. 15 USC 1681c-1 — National Security Freeze
13
California Legislative Information. California Code CIV 1785.11.2
14
GovInfo. 15 USC 1643
15
Office of the Law Revision Counsel. 15 USC 1693g
16
eCFR. 12 CFR 1005.6
17
California Legislative Information. California Code CIV 1798.82