Report telecom fraud twice: first to the affected carrier or service provider, then to the public agency that fits the harm. If the incident is time-sensitive, contact local law enforcement directly rather than waiting for an online referral. Preserve original messages, call records, bills, account notices, payment documents and provider correspondence while keeping a dated timeline. If a fraudulent cellular account was opened in your name, request transaction records from the business and keep your written request. A government investigator can also ask a communications provider to preserve records under 18 U.S.C. § 2703(f), but that statutory preservation duty is not triggered by a victim’s request alone.
This guide covers the United States. Other countries use different regulators, police procedures and evidence rules; outside the U.S., contact your local telecom regulator, police service and consumer-protection authority.
What to do in the first hour
- Secure the affected account. Contact the carrier or service provider through contact details you already know are official. Ask it to lock down the account, investigate unauthorized activity, explain how to obtain incident records, and provide a case or confirmation number. If your phone has lost service unexpectedly, state that clearly and record the exact time.
- Protect connected accounts. Use a trusted connection and device to change passwords for email, banking, payment and other accounts that rely on the phone number. Ask financial institutions to review unauthorized transactions. Do not delete suspicious texts, emails or voicemail while trying to clean up the account.
- Preserve what is visible now. Save the original messages, call logs, account alerts, bills, receipts and screenshots. A screenshot is an additional copy, not a replacement for the original file or message.
- Choose the public reporting route. Internet-enabled fraud can be reported to the FBI’s Internet Crime Complaint Center (IC3). Contact local law enforcement directly when the loss, account takeover or continuing activity is time-sensitive.
- Start a timeline. Write the date, time zone when known, phone number, account, device, carrier and event. Separate what you personally observed from what a representative, bank or another person told you.
Choose the right reporting path
No single form handles every telecom-fraud case. Use the harm and urgency to decide where to report. These routes can be used in parallel.
| Situation | First contact | Additional action |
|---|---|---|
| Unauthorized carrier account, SIM change, eSIM activation or port-out | Affected carrier or service provider | Local law enforcement if time-sensitive; IC3 when internet-enabled crime is involved |
| Fraudulent cellular account opened with your identity | Business that opened or serviced the account | Request transaction records under FTC identity-theft guidance; report to law enforcement and IC3 when applicable |
| Online scam using calls, texts, links or payment services | IC3 and the affected provider | Local law enforcement for an urgent loss or ongoing takeover; notify your bank or payment service |
| Immediate account takeover or continuing financial harm | Local law enforcement directly | Carrier, bank and IC3 reports; tell investigators which provider records may disappear |
IC3 reviews complaints and forwards them to law-enforcement or partner agencies as appropriate. Filing does not guarantee an investigation, prosecution or recovery. Intake procedures can change, so read the live IC3 instructions before submitting.
Recommended Free Tools
#1 Best Overall
Report to the carrier without losing useful evidence
Use an official channel
Find the carrier’s contact information in a prior bill, account statement or official account portal rather than relying on a number supplied in a suspicious message. Tell the representative that you are reporting unauthorized activity and ask for account security measures, an investigation and written instructions for obtaining records.
Record every interaction
For each call, chat, email or store visit, record the date and time, channel, representative or department, case number, facts you reported, action requested and response received. Keep confirmation emails, chat transcripts and letters in their original form. If the representative gives only a verbal explanation, write down the wording as soon as possible and identify it as your contemporaneous note.
Ask for specific documentation
Request the incident or case number, the date and time of any SIM, eSIM or port change, the account activity the provider can disclose, and the process for requesting records. A provider may limit what it releases to a consumer, so ask what can be supplied to you and what would require a law-enforcement request. Do not assume a carrier must provide every internal record or retain it for a particular period.
File an IC3 complaint when the conduct is internet-enabled
IC3 is appropriate for many scams involving online accounts, text-message links, internet calling, digital payments or other internet-enabled conduct. Complete the form with a factual sequence rather than a theory about who committed the crime.
- Gather the timeline, numbers, email addresses, URLs shown in messages, payment details, carrier case number and copies of earlier reports.
- Describe what happened in chronological order. Distinguish a displayed caller ID from a verified caller identity because caller ID can be inaccurate.
- Identify the accounts, devices and providers affected, the financial or service impact, and any continuing risk.
- Submit the complaint and save or print the confirmation and a complete copy before closing the page.
Keep the confirmation with your evidence. IC3’s forwarding process is an intake and referral mechanism, not a promise that an agent will contact you or that money will be recovered.
Contact local law enforcement when timing matters
Contact local law enforcement directly when an account takeover is ongoing, substantial time-sensitive loss is occurring, or you need an incident documented promptly. Tell the officer or intake desk that provider records may be relevant and identify the carrier, account, phone number, dates and case number. Bring or provide copies, not the only copy, of your timeline and key records.
An online complaint can supplement a direct report; it should not delay a response to a continuing or urgent event. Ask for the report or incident number and preserve the submitted narrative.
Preserve evidence in a form investigators can use
Build a dated timeline
Use one entry for each event. Include the time zone when known and mark uncertainty instead of guessing.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Date and time (time zone if known) — event — source of information — action taken — case numberExamples of events include the last normal call or text, loss of service, an account-alert email, a bank payment, a carrier conversation and each report filed. Label whether an entry is something you observed, a document shows, or another person told you.
Keep originals and make working copies
Retain original texts, emails, voicemail, carrier notices, bills, receipts and account alerts. Do not edit, crop or annotate the only copy. Export messages or save screenshots as additional copies, preserving the surrounding conversation and visible date, time and sender information where possible. Keep the original file in its native location or format and do not alter metadata unnecessarily.
Collect the core evidence set
| Evidence | What to capture | Important qualification |
|---|---|---|
| Calls and caller ID | Displayed number, date, time, duration, call log and voicemail | Displayed caller ID can be inaccurate and does not prove who called. |
| Texts, email and links | Full message or thread, sender details, timestamps, attachments and the exact link as displayed | Keep context, not only selected excerpts. |
| Carrier activity | SIM or eSIM notices, port-out alerts, outage details, bills, account changes and incident number | Record when service changed and what the provider said. |
| Money and identity records | Payment receipts, bank or payment-service entries, invoices, applications and account statements | These are especially relevant when a cellular account was opened using your identity. |
| Reports and correspondence | Carrier, bank, police and IC3 submissions, confirmations and replies | Save or print the completed IC3 complaint and retain the copies. |
Store the package securely
Keep a controlled backup and an inventory listing each file, date and description. Limit access to people helping with the case. The National Institute of Justice guide on digital evidence covers documentation, collection, packaging, transport and storage; it was written for first responders in 2008, so use its handling concepts rather than treating it as a current consumer checklist.
Request records when identity theft created a cellular account
If someone opened a phone account in your name, follow the Federal Trade Commission’s identity-theft record-request guidance. Send a written request to the business and keep proof of your identity, the request itself, delivery evidence and the response. Ask for records connected to the transaction, such as:
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minute- Invoices and account statements
- Credit applications or service applications
- Payment and transaction records
- Other documents identifying how the account was opened or used
FTC guidance explains that businesses may provide identity-theft transaction records to the victim or to a law-enforcement officer acting on the victim’s behalf. It does not establish an unlimited right to every carrier record, internal security note or unrelated customer document. The exact request process depends on the circumstances and the business.
Understand provider preservation under 18 U.S.C. § 2703(f)
The 2024 U.S. Code edition states:
“A provider of wire or electronic communication services or a remote computing service, upon the request of a governmental entity, shall take all necessary steps to preserve records and other evidence in its possession pending the issuance of a court order or other process.”
The statute specifies preservation for 90 days, with a possible additional 90-day extension when a renewed request is made. This is a mechanism for a governmental entity to ask a covered provider to preserve records while legal process is obtained.
What the statute does not do
- A victim’s request alone does not trigger the statutory preservation duty.
- Preservation is not the same as disclosure. Keeping records does not mean the provider must give them directly to a consumer.
- The provision does not guarantee that every type of carrier data exists, remains available, or will be produced.
- It is not a promise that a provider will retain records for a particular period without a government request.
How to help investigators use it
Report promptly and tell investigators which provider, account, number, device and date range matter. Explain that records may include account changes, porting or SIM activity, billing, authentication events and communications. Ask the investigator whether a preservation request is appropriate. Do not represent to the carrier that the statute has already been invoked unless a governmental entity has actually made the request.
Special handling for SIM-swap and port-out incidents
A SIM swap or port-out can disconnect your number while an intruder receives calls or text messages intended for you. Record the exact time service stopped, whether the device displayed an emergency-only or no-service state, any eSIM or SIM notification, and the first successful reconnection. Preserve carrier alerts, authentication messages and every conversation with the provider.
Ask the carrier to secure the account, reverse unauthorized changes where possible, investigate the change and explain its documentation process. Keep the case number and the provider’s written findings. An FCC circular discusses documentation in this area, but the available material does not establish current final-rule text, effective dates or a universal consumer entitlement. Verify the operative FCC order before asserting that a carrier must provide a particular document or meet a particular deadline.
Keep reports, records and originals organized
Create a folder with read-only or otherwise protected copies and an index. A practical layout is:
- 01-Timeline: the dated event log and updates
- 02-Carrier: bills, notices, chats, letters and case information
- 03-Communications: original messages, exports, voicemail and email
- 04-Financial: payment records, invoices and statements
- 05-Reports: IC3, police, bank and other complaint confirmations
- 06-Identity-request: written requests, proof of identity and business responses
Keep a separate working copy for highlighting or analysis. Never overwrite the original. If you hand material to an investigator, note what was provided, when, to whom and under which report number.
Common mistakes that weaken a telecom-fraud report
- Relying on caller ID alone: the displayed number may be spoofed or otherwise inaccurate.
- Deleting the conversation: removing suspicious messages destroys context that may show the sequence and link destination.
- Submitting only screenshots: screenshots can omit metadata and surrounding messages; keep originals and exports too.
- Waiting for a perfect case: report the known facts and update the carrier or investigator as new records arrive.
- Assuming IC3 guarantees action: IC3 forwards complaints as appropriate but does not promise investigation, prosecution or recovery.
- Demanding every carrier record as a consumer right: FTC identity-theft guidance concerns transaction records, while disclosure of other provider data may require law-enforcement process.
- Confusing preservation with access: a government preservation request keeps records available; it does not itself release them to you.
- Using the 90-day period as a personal deadline: the statutory period applies after a governmental request and can involve a renewed request; it is not a general carrier-retention guarantee.
- Overstating an FCC requirement: verify current final rules before claiming a documentation entitlement or deadline for SIM-swap or port-out cases.
What to expect after filing
The carrier may open an internal investigation, restore service, reverse unauthorized changes or explain that certain records require a law-enforcement request. A bank or payment service may run a separate fraud review. IC3 may route the complaint without contacting you, and local law enforcement may request additional originals or a more specific timeline.
Keep adding dated entries when you receive a response, discover another transaction or submit another report. Preserve each new document with its source and case number. If investigators ask for a device or original file, clarify what they need and document the transfer so your evidence inventory remains accurate.
U.S. scope and legal caution
This procedure is designed for U.S. incidents. State laws, agency practices and the current text of federal statutes can affect a particular case. The statutory language quoted above is from the 2024 U.S. Code edition; confirm the current codification and applicable state law before relying on it as legal advice. For incidents outside the United States, use the reporting channels designated by the relevant national telecom regulator, police service and consumer-protection authority.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Say something about this film