How to Write an IC3 Complaint That Investigators Can Actually Use
Most IC3 complaints are unusable because they describe a loss instead of documenting one. Here is the structure, the exact fields, the evidence to attach, and the wording that turns a complaint into a lead.
A Complaint Is a Document. Not a Story.
The difference between a complaint that gets clustered and one that gets filed and forgotten.
What this guide says in 5 lines
- IC3 complaints are read by pattern-matching systems and analysts, not by a caseworker assigned to you personally.
- The complaint that works is structured, dated and specific: addresses, txids, amounts, timestamps, platform names.
- Attach the trace as a document. Never describe evidence you could have attached.
- File once, thoroughly, rather than repeatedly with new details. Duplicates dilute the cluster.
- The confirmation number is the deliverable. Banks, exchanges and lawyers ask for it.
The IC3 is not a recovery service and it will not assign an agent to your case. It is a federal intake and clustering system: complaints are parsed for patterns, and patterns are what get resources. That single fact determines how you should write yours. A complaint that reads as a narrative of betrayal is filed and forgotten. A complaint that reads as a structured incident record with addresses, hashes and timestamps can be matched against thousands of others and become part of an operation.
This guide gives you the exact structure that survives that parsing, the fields that matter most, and the wording that keeps your complaint factual rather than emotional — not because emotion is wrong, but because it is not what the system reads.
What the IC3 actually does with your complaint
Understanding the pipeline changes what you write. A complaint enters a database, is parsed for structured fields, and is then available to analysts and to law enforcement partners who query it. Nobody reads it end to end on the day it arrives. What gets surfaced is what is queryable: an address, a domain, a phone number, a wallet cluster, a payment route.
This is why the most valuable thing you can put in a complaint is not a description of how you felt, but the identifiers that let your case be joined to others. If your complaint contains the same receiving address as four hundred others, it becomes part of a cluster. If it contains only a story, it becomes a row.
Write for the query, not for the reader. Ask yourself: if an analyst searched for one string from my complaint, would it find the right case?
The fields that matter most
The IC3 form asks for a lot. These are the fields that carry the most weight, in order, and the ones worth getting exactly right before you submit.
| Field | Why it matters | How to get it right |
|---|---|---|
| Cryptocurrency address(es) | The primary clustering key across complaints | Copy exactly, never retype. Include every address funds touched. |
| Transaction hash(es) | Proves the transfer exists and is verifiable by anyone | One per line, with amount and asset beside each. |
| Domain and URL of the platform | Links the on-chain event to a real-world operation | Include the exact URL, plus any mirror or app-store listing. |
| Payment method and route | Determines which institutional remedies remain | Name the bank, card, app or exchange, not just “bank transfer”. |
| Dates and times with timezone | Establishes chronology and tests credibility | Use the transaction timestamp, not your memory of the day. |
| Amount in USD and in crypto | Sizes the loss and enables threshold-based action | Give both, and state the exchange rate source if you converted. |
| Contact details of the scammer | Phone, email, social handle, wallet label | Include every identifier, even ones that look throwaway. |
The structure that survives parsing
Use this order. It mirrors how an analyst reads a case, and it keeps the identifiers near the top where they are most likely to be extracted.
- 01One sentence stating what happened, with the total amount and the date range. No preamble.
- 02The identifiers: every crypto address, every transaction hash, every domain, every phone number and email.
- 03The chronology: a numbered list of events with dates, amounts and the route each payment took.
- 04The platform description: what it claimed to be, how you were recruited, what it showed you.
- 05The evidence list: what you are attaching, named item by item.
- 06The institutional steps you have already taken, with reference numbers.
- 07What you are asking for: a record, a cluster match, and referral to the appropriate field office.
Do not attach your seed phrase, private key, exchange password or a photo of your ID unless the form explicitly requires it. The IC3 will never ask for a seed phrase, and no legitimate follow-up will either.
Wording that helps, and wording that hurts
The same facts can be written in ways that either support or undermine the complaint. These are the substitutions that matter most.
| Instead of | Write | Why |
|---|---|---|
| “They stole my life savings” | “I transferred 4.2 ETH (approximately $14,300) to address 0x… on 2026-09-14 at 11:42 UTC.” | The second is queryable and verifiable; the first is not. |
| “I think it was a scam” | “The platform stopped withdrawals on 2026-09-20 and the support channel was deleted.” | State the observable fact, not your conclusion. |
| “The address is 0xABC… (from memory)” | Copy the address from the explorer and paste it. | A single wrong character makes the identifier useless. |
| “I was told to invest” | “I was contacted on WhatsApp by +1… on 2026-08-02, who directed me to example-platform.com.” | Names the recruitment vector, which is itself a cluster key. |
| “Please get my money back” | “I am requesting that this be recorded and matched against other complaints involving these addresses.” | Asks for what the IC3 can actually do. |
What to attach, and how to name it
Attachments are read far more often than free text, because they are structured. Name every file so that it is self-describing without opening it, and keep the set small enough that it is actually reviewed.
- A written trace as a PDF or text file: numbered hops, dates, amounts, addresses.
- Transaction confirmations or explorer screenshots, one per transfer, named by txid.
- The platform's own pages: deposit page, withdrawal page, terms, any “profit” dashboard.
- The recruitment conversation, exported rather than screenshotted where the app allows it.
- Any document the scammer sent: contracts, statements, ID images, invoices.
- Your own bank or exchange records showing the funds leaving your control.
Name files like evidence, not like photos: trace-2026-09-14-0xabc123.pdf, txid-0xdef456.png. An analyst scanning a folder should not have to open anything to know what it is.
After you submit
You will receive a confirmation number. That number is the deliverable, and it is what banks, exchanges, insurers and lawyers ask for. Record it in the same file as your trace, and quote it in every subsequent letter.
Do not resubmit the same incident repeatedly with small additions. Duplicates dilute the cluster and make your case harder to follow. If something material changes — a new address, a new platform, a new loss — file an update and reference the original confirmation number.
Expect no individual follow-up. That is normal and it is not a sign that nothing happened. The value of the complaint is cumulative, and it is realised when your identifiers match enough others to become a pattern.
File at IC3.gov and ReportFraud.ftc.gov the same day, and quote both reference numbers in your bank and exchange correspondence. Two federal reference numbers change how a compliance desk reads your letter.
Common questions
Build the complaint from a single form
The Report Builder turns your evidence set into a structured complaint, a demand email and legal drafts — free, in your browser, in about four minutes.
Primary sources and further reading
- FBI IC3 — File a Complaint www.ic3.gov
- FBI IC3 — Internet Crime Report www.ic3.gov
- FTC — Report Fraud reportfraud.ftc.gov
- Chainalysis — Crypto Crime Report www.chainalysis.com
External links open in a new tab and are provided so you can verify the underlying material yourself. TrueMoneyTalk is not affiliated with these organisations.
Keep reading
Someone you know may be in this situation right now.
Disclaimer: this guide is general information, not legal, financial or recovery advice, and it is not a substitute for advice from a licensed professional in your jurisdiction. Individual outcomes vary and are never guaranteed.