Contents Removal and support

Friction and response

Removal and support

Removing scam infrastructure and supporting a person who has been targeted are separate forms of response. Reporting a malicious site, message or campaign can feed systems that remove malicious infrastructure and are intended to reduce later exposure. Victim-support services instead help with complaint forms, resources and referrals. Neither function substitutes for contacting a financial institution about a payment.

In Australia during 2025, the National Anti-Scam Centre referred more than 8,400 suspected scam URLs to its takedown service, and 89.6% were successfully removed.1 The centre estimated that its website removals avoided A$89.4 million in losses, but this was a model based on average reported loss per reported URL. It was not an observed total from people prevented from visiting each site.1

Public reports can contribute at large scale, although different systems count different things. During the UK National Cyber Security Centre’s 2025 annual-review year, its suspicious-email service received more than 10.9 million public reports. Since April 2020, the centre had removed 412,000 malicious URLs.2 These counts cover reports and URLs, so they should not be compared directly with counts of messages, campaigns or victims.

Support services address another need. During the US Justice Department’s 2025 reporting period, the National Elder Fraud Hotline received 62,913 calls. Staff were reached on 23,515 calls and submitted or assisted with 9,348 FTC or IC3 complaint forms.3 Case managers provide personalized help with reporting, resources and referrals.

In practice, a report button can supply information for takedown, while a hotline or victim service can make a complicated reporting process more manageable. After discovering a fraudulent transfer, the FBI advises contacting the financial institution immediately because infrastructure removal is separate from payment recovery.4

Boundary. A successful takedown does not show how many people avoided loss, whether the original target recovered money or whether copies remain elsewhere. No cited study measures whether a platform report button removes material quickly enough to protect that target. The hotline report also did not measure effects on restitution, repeat victimization, distress or long-term financial stability.3

References

Quizzes
  1. Which task belongs most directly to a victim-support service?

    • Helping with reports and referrals
    • Investigating a suspicious bank transfer
    • Coordinating removal of a malicious site

    Support services can organize reporting and referrals, but they do not control restitution or guarantee financial recovery.

  2. A report of a malicious URL is primarily an input to ____.

    • takedown and disruption
    • automatic bank reimbursement
    • identity authentication

    URL reports can feed disruption systems that seek to remove malicious infrastructure and reduce further exposure.

Comments

No comments yet. Start the conversation.