Filing a Complaint and Getting Help: Official Resources

Once the emergency is over, many victims do nothing more: they feel embarrassed, assume that nothing can be done or do not know where to turn. Yet reporting matters, for you and for others. In this lesson you will learn what to report and where, how to file a complaint, how to collect your evidence, and which official services can support you, with a focus on France and pointers for other countries.

You have contained the problem and secured your accounts. Now you need to document it and use the help that exists. It can lead to a refund, the removal of harmful content, the closing of a fraudulent site or even the identification of the criminals. At minimum, it helps authorities see what is happening.

Why report?

• Practical consequences for you: banks and insurers often need a complaint or report to process a claim. For identity theft, it provides proof that you were a victim.
• Protection of others: reports let platforms and authorities detect fraud campaigns, block fake websites and warn the public.
• Accountability: criminals are only prosecuted when someone reports. Individual losses may look small, but investigators connect many reports into one case.
• Support: you will be pointed to people who can help with recovery and with the emotional side.

Step 1: collect and preserve evidence

Before you delete or reset anything more, gather material, and keep it in a safe folder:

• Screenshots of messages, websites, alerts, transactions and profiles, including the address bar and the date.
• Emails in their original form, with headers if you know how to extract them. Keep the message rather than only a screenshot.
• Web addresses, usernames, phone numbers, bank account numbers and payment references used by the attacker.
• Bank statements and receipts, order confirmations, and proof of payments.
• A timeline: when it started, what you saw, what you did, in your own words.
• The list of what was affected: accounts, devices, amounts, data.
• Records of your communications with your bank, the service provider and any authority.

Do not edit the evidence, and do not interact further with the attacker to gather more.

Step 2: notify the right parties

1. Your bank or card issuer, immediately, if money or payment details are involved.
2. The affected service (email provider, social network, shop), through its official reporting channel, to recover or close accounts and remove fake profiles.
3. Your employer's security contact, if work accounts or devices are involved (lesson 6.4).
4. Your mobile operator, if your SIM or phone number was affected.
5. Your insurer, if you have a policy that covers cyber risks or identity theft. Check the conditions and deadlines for declaring a claim.
6. The authorities, as described next.

Official resources in France

Cybermalveillance.gouv.fr

The national platform for assistance to victims of cybercrime, cybermalveillance.gouv.fr, offers a free online diagnostic that identifies your situation (phishing, ransomware, account hijacking, fake support, and more) and gives tailored advice. It can also connect you with qualified service providers close to you, publishes practical guides and awareness material, and runs prevention campaigns. It is a good first stop when you do not know what to do.

The national cybersecurity agency

The ANSSI (cyber.gouv.fr) is the French national authority for cybersecurity. It focuses mostly on organizations, operators of essential services and critical infrastructure, and publishes best-practice guides that are also useful for individuals. Its CERT-FR team issues alerts about vulnerabilities and ongoing threats.

Filing a complaint

For crimes such as fraud, identity theft, harassment, blackmail or unauthorized access to your accounts, you can file a complaint with the police or the gendarmerie. Depending on the case, you may be able to start the process online and then complete it in person. Bring your evidence and your identity document. Ask for a copy of the complaint, as your bank or insurer may require it.

Unauthorized access to a computer system is a criminal offense. In France, the Code pénal (see legifrance.gouv.fr) punishes fraudulent access or remaining in an automated data processing system, as well as interfering with or altering its operation or data. These are the same provisions that, in later courses, we will see apply to anyone who tests systems without authorization.

Other French reporting channels

• Illegal online content (threats, hate, content involving minors, scams) can be reported through the official government reporting platform for illegal content, which transmits cases to the competent services.
• Suspicious text messages: in France, you can forward them to the short code 33700 (the spam reporting service for texts and calls), which helps operators block the senders.
• Phishing and spam emails: dedicated reporting services exist, and your mailbox provider's "report phishing" button is also valuable.
• Cyberbullying of minors and young people: the national helpline 3018, as mentioned in lesson 5.4.
• Personal data problems: after contacting the organization, you can complain to the CNIL, the French data protection authority (lesson 5.1).
• Consumer fraud: consumer protection authorities and associations can help with fake shops and abusive practices.

If you live elsewhere

Most countries have equivalents, and the names vary: a national CERT or CSIRT, a cybercrime reporting portal run by the police, a data protection authority, a consumer protection agency and victim support organizations. Search for "report cybercrime" together with your country's name, and prefer official government websites. Be wary of search results that look official but are paid advertisements or fake "recovery" services, and verify that the address belongs to a government domain.

For understanding threats and good practices at an international level, you can consult recognized frameworks and bodies such as the NIST (nist.gov), which you will encounter again in the next courses of this learning path.

Looking after yourself

Being a victim of cybercrime can be distressing, particularly with identity theft, blackmail, intimate images or harassment. Many people feel shame, anger or anxiety, and some lose sleep for weeks. These reactions are normal. It helps to:

• Remember that it is not your fault: criminals use sophisticated and manipulative techniques, which work on intelligent people.
• Talk to someone: a friend, a family member, a victim support organization or a health professional.
• Take things one step at a time using your checklist, rather than trying to fix everything in one night.
• Seek support specifically designed for you if you face threats or blackmail with intimate content: specialized services exist, and the police take these cases seriously.

Beware of "recovery" scams

After an incident, victims are often contacted by people claiming that they can recover lost money or get a hacked account back, for a fee in advance. These are frequently a second scam. Be suspicious of:

• Unsolicited offers of help after you posted about your loss.
• Promises of guaranteed recovery, or requests for payment in cryptocurrency or gift cards.
• Requests for remote access to your computer, or for your passwords.
• People claiming to be police, lawyers or "recovery agencies" who contact you first.

Real authorities do not ask for payment to recover your money. Use the official channels listed above.

Your turn

Exercise. You lost money after a fake bank-advisor call, and your online banking login was stolen. Prepare your complaint file: list what you need to bring, and which other parties you must inform.

See a solution

1. Evidence file: your identity document; the phone number and the time of the call; screenshots of messages or texts received; bank statements showing the unauthorized transactions; the dates and amounts; the beneficiary account details; a short written timeline.
2. Parties to inform: the bank (block the cards, dispute the transactions, change online banking access), the phone operator if a number was involved, the insurer if relevant, and the police or gendarmerie for the complaint, whose copy you give to the bank.
3. Other steps: change the passwords and second factors of your email and other accounts, check for signs of identity theft, and use the diagnostic on cybermalveillance.gouv.fr for tailored advice.
4. Watch out: for "recovery" offers that request advance payment.

Add to your Security Notebook

Under "7. Incident response", list the official resources for your country (the national platform, the police reporting channel, the data protection authority), your bank's emergency number, and the folder where you will store evidence if needed.

You now have a full picture, from prevention to response. In the final lesson, we will assemble everything into your personal security plan.