ScamX CMS

Tag: ncsc

  • Reporting a Scam in Vietnam: The Old Portal Is Gone, and 156 Does More Than You Think

    Start with a correction, because almost every Vietnamese guide still gets this wrong. The national scam reporting address that has been printed everywhere since 2023, on the old cyberspace portal, no longer exists — the domain resolves to nothing at all. Reports sent there go nowhere. The national cyber security centre’s current reporting portal is at canhbao.ncsc.gov.vn.

    The bank first, because nothing else holds the money

    Call your bank’s hotline the moment you realise, and go to the police the same day. Vietnam has no consumer reimbursement rule for scam transfers — none of the 2024 and 2025 reforms create a right to a refund — so everything depends on reaching the money before it is withdrawn or moved on. That window is hours.

    What those reforms did do is make transfers traceable. Since 1 July 2024, any transfer above ten million dong needs a face check against your chip ID or VNeID data, and once your transfers pass twenty million in a day, every further transfer that day needs one however small. That is identification, not insurance: it helps investigators name the account holder afterwards. Statements that victims “can get their money back” because of it are describing traceability, not a refund.

    The police report is the only route that can investigate

    File a written report — đơn trình báo or đơn tố giác tội phạm — at your ward or commune police station, in person. There is no online consumer intake for this. Bring your chip ID card, the sending and receiving account numbers and names, the amounts and exact times, the bank names, and screenshots of the whole conversation, which in most cases means Zalo or Messenger.

    156, for the calls and the texts

    The national spam and scam line is 156, free to call, and it also takes structured SMS reports. The syntax matters: for a spam SMS send S (number) (description), for a nuisance call V (number) (description), and for a scam call LD (number) (description). Telecoms operators act on these — a reported number gets forced re-verification, then one-way suspension, then two-way, then termination. It can kill a number. It cannot recover a dong.

    The check almost nobody uses

    You can text a domain name to 156 and be told whether it is a genuine registered site. It is free, it takes seconds, and it is a distinctly Vietnamese tool that barely anyone uses. Do it before entering anything on a site that arrived in a message.

    One thing that is not a scam checker, despite its name: the trusted-network directory is an opt-in certification list that organisations apply to join. A site being absent from it means nothing at all.

    The reporting portal is a warning system, not a case system

    Be clear about what the national portal does. It aggregates warnings. It does not open a case for you, does not give you a case number, and does not recover money. Report there so that others are warned, and go to the police for your own case.

    The scam that comes second, wearing a badge

    The cyber security centre has itself published a warning about a site impersonating it and advertising “help getting your scammed money back, 99.9% success”. This is the most reliable pattern there is: the recovery service that finds you after you have been scammed is the second scam, and it will wear the branding of the police or of the agency you just reported to.

    The other pattern to know: a caller claiming to be the police or a traffic inspector persuades you to install an app or open a link, takes control of the phone, and empties the account from your own device. No Vietnamese agency asks you to install anything to resolve a case.

    And the site

    If the scam ran through a website, the company hosting it and the registrar that sold the domain can take it down, usually within hours of a clear report with the exact address and a screenshot. That is quicker than any official channel, in Vietnam as everywhere else.

  • Reporting a Scam in New Zealand: 105, the NCSC and Internal Affairs

    New Zealand keeps its scam reporting simple, which is a virtue until you need to know which of the four routes actually does the thing you want. Money, crime, technical incident, and spam are four different desks.

    The bank, in the first minutes

    Consumer Protection puts it as plainly as any government page anywhere: contact your bank immediately, because the sooner the bank knows, the greater the chance of getting the money back. Use the number in your banking app, not one from any message you have received.

    New Zealand banks have signed up to anti-scam commitments in their Code of Banking Practice, and if you are unhappy with how your bank handles your case, the Banking Ombudsman Scheme can review it once the bank’s own complaints process is finished.

    105 is the police report

    If you have lost money, report it to the Police on 105 — free, 24 hours, or online through the 105 service. Call 111 instead if it is happening right now or someone is in danger. Note that the old police scams advice page is gone; 105 is the route.

    The NCSC, for the technical side

    Report the incident itself — the phishing site, the account takeover, the malware — at ncsc.govt.nz. The National Cyber Security Centre absorbed CERT NZ, so if you are looking for CERT NZ, or find a government page still naming it, this is where it went. The NCSC helps you understand and contain the incident; it does not recover money or prosecute.

    Spam texts and emails go to Internal Affairs

    The Department of Internal Affairs enforces the spam rules and takes reports of scam TXT messages and emails at dia.govt.nz. Two limits worth knowing: it covers text, email and fax only, and it does not investigate unsolicited phone calls, postal mail or pop-ups. Investment offers from unlicensed operators belong with the Financial Markets Authority instead.

    IDCARE if your identity is exposed

    IDCARE is free and covers New Zealand on 0800 121 068. If a scammer has your passport, licence or IRD details, it will build you an ordered plan for replacing documents and notifying the right agencies, which is the part people find hardest to work out alone.

    What to have ready

    Screenshots of the messages and the site, the account or payee details you paid, the amounts and times, the number or address that contacted you, and your bank’s transaction reference. Take the screenshots before you block anyone.

    The honest expectation

    Consumer Protection does not soften it: most scams come from overseas, and it is very difficult to get money back once it has been sent there. That is an argument for speed on the day, not for skipping the report — the report is what makes the next person’s warning possible.

    And the second approach

    Official New Zealand advice lists this as a step in its own right: some scammers target people who have just been scammed, including by pretending to be an agency that can return all your money for a fee. Nobody legitimate will ever ask you to pay to get your money back.

    The page itself

    If the scam has a website, the fastest takedown is not a government one. The hosting provider serving the page and the registrar that sold its domain can both remove it, usually within hours of a clear report that names the exact address and what the page does.

  • Reporting a Scam in the UK: Your Bank, 7726 and [email protected]

    Reporting a scam in the UK means talking to three different organisations, and none of them does all of it. One is about your money, one is about the crime, and one is about the message or the website. Doing all three takes about fifteen minutes.

    Your bank comes first

    If money has left your account, call your bank before you report anything to anybody else. Use the number on your card or in the banking app, not one from the message that caught you out. Ask them to stop or recall the payment and to freeze the card or account if the details are compromised.

    Since 7 October 2024, banks have had to reimburse most people who were tricked into sending a payment to a fraudster, and the rules say within five business days of the claim — though a firm can stop that clock while it gathers information, there is a cap of £85,000, and some banks apply an excess. Reporting quickly, and being straight about what happened, is what makes that process run rather than stall.

    The crime: reportfraud.police.uk

    Fraud in England, Wales and Northern Ireland is reported at reportfraud.police.uk, or on 0300 123 2040 if you would rather talk to someone. The report goes into the national fraud database, where it is matched against other reports; a single report rarely produces an investigation, and a hundred matching ones often do.

    In Scotland it is different: contact Police Scotland on 101, or through the contact form on their website. If a crime is happening right now or someone is in danger, that is 999 wherever you are.

    You will be given a reference number. Keep it. Your bank, your insurer and your employer may all ask for it, and it is the only thing that proves the report exists.

    The message: 7726 and [email protected]

    Forward a scam text to 7726 — it spells SPAM on a keypad, it is free, and every mobile network in the UK accepts it. You will get an automatic reply asking for the sender’s number; sending it back is part of the process and is safe to do.

    For a scam call, text the word Call followed by the caller’s number to 7726 instead.

    Suspicious emails go to [email protected], run by the National Cyber Security Centre. Forward it even if you are not sure — you are not wasting anybody’s time, and the service is automated on the way in. Scam websites have their own reporting form on the NCSC site. Millions of reports have gone in this way and tens of thousands of scam sites have been removed as a result, but you will never hear the outcome of your own, which is the trade-off for a service that can run at that scale.

    What each one can and cannot do

    Your bank can move money and block cards. The police can investigate a pattern. The NCSC can get a site taken down and the message blocked. None of them can do the other two jobs, which is why “I reported it” so often ends in “and nothing happened” — the report went to the party without the power to act on that part of it.

    There is a fourth party nobody mentions: the company hosting the page, and the registrar that sold its domain name. A clear abuse report to the host — the exact address, one sentence on what the page does, a screenshot — is frequently the fastest way a scam page comes down, faster than any official route.

    If you clicked, or entered something

    Change that password on the real site now, and anywhere you reused it, then turn on two-step verification. If you gave card details, call your bank. If you read out a one-time code to someone on the phone, assume they are inside the account already and use the provider’s account-recovery process rather than a password change.

    If you installed anything they asked you to install, particularly remote-access software during a “bank security” or “tech support” call, treat the device as no longer yours. Remove the software, change your banking credentials from a different device, and tell the bank exactly which program it was.

    Afterwards

    Check your credit file for accounts you did not open. If your details are circulating, Cifas offers a protective registration that makes lenders take extra steps before granting credit in your name. And expect a follow-up attempt: people who have lost money once get contacted again by someone offering to recover it for a fee. That is the same fraud with a different script.