Reporting a Fake Inmate Deposit Site

01

How to find someone in jail is stressful enough without discovering that the site you used to send money was a fraud. Scam websites designed to look like legitimate commissary deposit portals have become one of the more targeted forms of financial fraud in the corrections space, preying on families at their most vulnerable. This guide walks through every step of identifying, documenting, and reporting these sites so that you can protect yourself and help shut down the operation.

02Recognizing the Anatomy of a Fake Deposit Site

The first thing families should understand is that fake inmate deposit sites are not amateur operations. They are built to mimic the visual design, branding, and even the URL structure of official commissary and phone providers. Many copy logos, color schemes, and facility names directly from legitimate services. The goal is to create enough visual familiarity that a stressed family member, acting quickly, does not pause to verify.

These sites typically appear through paid search placements, social media advertisements, or links shared in online community groups. Families searching for terms like how to send money to someone in jail or jail commissary deposit will often encounter them at the top of a search results page, positioned above the official provider. The urgency of the situation — a loved one just booked, a call missed, a court date approaching — creates exactly the pressure that fraudsters depend on.

A legitimate commissary provider will always have a verifiable business relationship with the specific detention facility. If a site claims to serve a particular county jail but that jail's official website or phone line points to a different provider, that mismatch is a serious warning. Families can usually confirm the official provider by calling the facility directly or searching the facility's official government website.

URL and domain details reveal a great deal. Legitimate providers use stable, established domains. Scam sites frequently use domains registered within the last few weeks or months, with slight misspellings of the real provider name — an extra letter, a swapped character, a different top-level domain. Checking a domain's registration date through a public WHOIS lookup is a free and quick verification step any family member can perform before entering any payment information.

Payment methods are another tell. Official commissary platforms accept standard credit or debit cards through verified payment processors, and they direct funds through clearly identified channels. A site that demands payment by prepaid debit card, cryptocurrency, wire transfer, gift card codes, or peer-to-peer payment apps is operating outside every norm of the corrections industry.

03How to Document Everything Before You File a Report

When families realize they may have encountered a fake inmate deposit site, the instinct is often to close the tab and move on. That impulse is understandable but costly from a reporting standpoint. Investigators need evidence, and the best evidence is collected in the first minutes and hours after discovery.

Take full-page screenshots of every page you visited on the suspect site. Capture the homepage, the payment page, any confirmation screens, and any email receipts you received. Screenshots should include the full browser URL bar so investigators can see the exact address. Annotating the date and time is helpful, though most screenshots automatically embed metadata with this information.

Save any email communications. Scam operations often send convincing confirmation emails that look identical to legitimate receipts. These emails contain valuable header information that investigators can use to trace the operation's infrastructure. Forward these emails to yourself using a personal email account before reporting, and do not delete them from your inbox.

Record every charge that appeared on your bank statement or card statement. Note the merchant name as it appeared on the statement, the amount charged, the date, and the last four digits of the card used. If additional charges appeared beyond what you authorized — a common secondary fraud pattern — document each one separately.

Note the full URL of the site along with any phone numbers, live chat handles, or physical addresses the site displayed. Fraudulent sites sometimes list fake addresses or repurpose real addresses to build credibility. All of these details become investigative leads. Write them down in a plain document before the site is taken down, which can happen quickly once a fraud complaint reaches the right authority.

04Reporting to Your Financial Institution First

Your bank or card issuer is the first call to make after you discover the fraud. Most financial institutions have a dedicated fraud line available around the clock, and initiating a dispute quickly improves your chances of recovering the funds. Chargebacks on fraudulent transactions are generally available for debit and credit card transactions, though timelines and success rates vary by institution and card network.

When you call, use the word "unauthorized" if you did not knowingly authorize the transaction with a party who had any right to receive it. If you did enter your payment information on the site believing it was legitimate, tell the representative exactly what happened. Describing it as fraud based on deception is accurate and triggers the appropriate investigation workflow at most institutions.

Ask the representative to block any further charges from the same merchant identifier. Scam sites sometimes capture card data and attempt secondary charges hours or days after the initial transaction. Getting a new card number issued — even as a precaution — is worth the minor inconvenience.

Request a written confirmation of your dispute filing. This creates an official record with a case or reference number that you can cite when reporting to external agencies. Keep this confirmation with your other documentation. The entire documentation package — screenshots, emails, bank records, site details — forms the evidence file you will share across multiple reporting channels.

05Reporting to the Federal Trade Commission

The Federal Trade Commission is the primary federal agency responsible for consumer fraud in the United States, and it maintains a dedicated online reporting portal at ReportFraud.ftc.gov. Filing here is free and does not require a lawyer. The FTC uses these reports to identify patterns, investigate repeat offenders, and coordinate with other law enforcement agencies. Individual reports rarely generate a direct response to the filer, but aggregated reports across many victims build the case that triggers enforcement action.

When completing the FTC report, provide the site's URL, the amount you lost, the date of the transaction, and a plain-language description of what happened. The form allows you to upload attachments, so include your screenshots and any confirmation emails you saved. The more detail you provide, the more useful your report is to investigators building a case against the operation.

The FTC also shares reports with state attorneys general and with international consumer protection agencies through the Consumer Sentinel Network. This means a single report to the FTC can inform multiple enforcement efforts simultaneously. Families who were defrauded across state lines — which is common with online fraud — particularly benefit from this cross-agency data sharing.

06Reporting to the Internet Crime Complaint Center

The Federal Bureau of Investigation operates the Internet Crime Complaint Center, commonly known as IC3, at ic3.gov. IC3 accepts complaints about internet-facilitated fraud, which is exactly what a fake inmate deposit site represents. Filing with IC3 is separate from filing with the FTC and should be done in addition to, not instead of, the FTC report.

The IC3 complaint form asks for your contact information, the suspect's contact information as best you can determine it, a description of the incident, and financial details including the amount lost. The site's domain name, any email addresses used in communications, and any merchant names that appeared on your statement are all relevant here.

IC3 analysts review complaints and refer qualifying cases to appropriate law enforcement agencies. Cases involving significant dollar amounts, multi-state victims, or sophisticated technical infrastructure are more likely to trigger active investigation. Even if your individual case does not result in a direct referral, the data you submit contributes to the intelligence picture that identifies major fraud operations targeting the corrections-adjacent family support space.

07Reporting to Your State Attorney General

Every U.S. state has an attorney general's office with a consumer protection division that investigates fraud affecting state residents. State-level reporting complements federal reporting because state attorneys general have enforcement jurisdiction within their borders and can move quickly on operations that are specifically targeting residents of their state.

Find your state's consumer protection reporting page by searching your state name alongside "attorney general consumer complaint." Most states have an online submission form. Provide the same documentation package you prepared for the FTC — site URL, screenshots, financial records, and a plain-language account of the incident. Some state offices will follow up directly with the complainant, which federal agencies typically do not do.

If the fake site appeared to be impersonating a real business that operates in your state — for example, copying the branding of an official commissary provider licensed to work with your state's correctional facilities — note this explicitly. Impersonation of a licensed business is a distinct legal matter that state investigators treat seriously.

08Reporting to the Domain Registrar and Web Hosting Provider

Taking the fraudulent site offline is a parallel goal to financial recovery and criminal reporting. Domain registrars — the companies through which a domain name is registered — have abuse policies that allow them to suspend domains used for fraud. Most registrars list an abuse contact email address in the WHOIS record for the domain.

To find the registrar, search the domain in a public WHOIS lookup tool. The registrar's name and abuse contact information will appear in the results. Write a brief, factual email explaining that the domain is operating as a fraudulent site targeting families of incarcerated individuals, attach your screenshots, and include the site's full URL. Many registrars respond to well-documented abuse reports within a few business days.

Separately, you can report the site to the web hosting provider if you can identify it. Tools that analyze domain technical records — DNS lookup tools available free online — can sometimes reveal the hosting company. The hosting provider's abuse team can suspend the site's server access independently of what the registrar does. Pursuing both channels simultaneously increases the chance that the site is taken offline quickly.

You can also report the site's URL directly to Google's Safe Browsing program through their report a phishing page form, and to Microsoft's SmartScreen program. These reports trigger the warnings that appear in Chrome, Firefox, Edge, and other browsers when a user tries to visit a flagged URL. Getting a site flagged in these systems protects the next family that encounters it through a search result.

09Reporting to the Corrections Facility Being Impersonated

If the fake site was impersonating a specific county jail or the official provider contracted to serve that facility, the facility itself deserves notification. Facility administrators and their contracted vendors have their own legal and regulatory relationships and a direct interest in stopping impersonation. They may already be aware of the fake site, or your report may be the first they hear of it.

Call the facility's main administrative line and ask to speak with whoever handles inmate services or vendor relations. Explain what happened, provide the URL of the fake site, and offer to share your documentation. Some facilities will forward the information to their legal team, who can contact the registrar and hosting provider directly with the added weight of an institutional complaint.

The official provider itself — the company legitimately contracted to handle commissary and phone for the facility — is another reporting target. Legitimate providers actively monitor for impersonation because it damages their brand and their relationships with facilities. Most have an abuse or fraud contact accessible through their official site. A single email with your screenshots and URL can trigger a legal takedown process that moves faster than a government report alone.

10Protecting Yourself After the Fact

Once you have filed reports and initiated a bank dispute, turn your attention to hardening your own information security. If you entered a credit or debit card number on a fake site, that number is likely in the hands of the operators. Request a new card immediately if you have not already. Monitor your statements daily for the next several weeks and dispute any unfamiliar charges as they appear.

If you entered any personal identification information — a driver's license number, a Social Security number, or a date of birth — consider placing a fraud alert or credit freeze with the three major credit bureaus. A credit freeze is free under federal law and prevents new lines of credit from being opened in your name without your explicit approval. Fraud alerts are also free and require creditors to take additional steps to verify identity before extending credit.

Change passwords on any accounts where you reused a password that you may have also entered on the fake site. Phishing sites sometimes prompt for account creation, and fraudsters test harvested credentials across banking and email platforms. Using a unique password for every account — and a password manager to keep track of them — is the most effective long-term defense.

11How InMato Approaches This Problem

Understanding how to report a fake inmate deposit site is one part of the answer. The other part is choosing starting points that eliminate the risk of encountering a fake site in the first place. InMato LLC functions as an information, search, and referral service, which means its role is to connect families with verified, official providers — not to process payments itself. When you use the InMato platform to locate a county jail inmate search result, you are directed to the official, licensed provider for that specific facility rather than navigating a search engine result page where fraudulent sites compete for clicks.

This design is deliberate. InMato reviews each provider connection to ensure families reach the correct institutional vendor. Because InMato never touches user money — funds go directly from the family to the official facility provider on that provider's secure system — there is no point in the InMato workflow where a fraudster could intercept a deposit. The platform's county jail inmate search covers 289 jail systems across 14 states, and every referral points to a verified, licensed provider rather than an impersonation site.

Families who want more than a one-time search can access InMato+ at $19.99 per month per loved one, with self-service cancellation available at any time. This tier adds booking-watch alerts, release and transfer alerts, court date alerts, and real-time case tracking with court-document summaries. InMato Core, the free tier, remains free for every family with no time limit and requires no account to search. The goal is that the people who most need to find a loved one in jail free of charge can do so without encountering predatory intermediaries.

12Building Long-Term Awareness in Your Community

Reporting a fake site is an act that benefits far more people than yourself. The corrections-adjacent fraud space is under-reported compared to other forms of consumer fraud, partly because families are embarrassed or afraid to come forward, and partly because many do not realize reporting is possible. Sharing your experience — in community groups, with social workers, with public defenders' offices, and with family advocacy organizations — multiplies the impact of your individual report.

Court-appointed defense attorneys and public defenders often have direct relationships with families navigating the first days after a loved one's arrest. Providing information about fake deposit sites to these professionals gives them something concrete to pass along to the families they encounter. Social workers embedded in re-entry programs are similarly positioned to circulate this information to the people who need it most.

Jail booking alerts through a legitimate service can reduce the window in which a family, operating under stress and time pressure, might click on a fraudulent link. When families receive an alert that their loved one has been booked and are simultaneously given verified deposit instructions, they have no reason to conduct an independent search that could land them on a fake site. This is one reason family support infrastructure matters as much as fraud awareness in the overall effort to protect vulnerable families.

13About InMato LLC

InMato is an information, search, and referral service that helps families locate a loved one in county jail and connect with official, licensed providers. Founded by J.T. Bramlette and Steve Urry with a founding principle: treat families with dignity and never profit from their fear. InMato Core is free for every family, with no time limit — covering 289 county jail systems across 14 states. InMato never touches user money; deposits go directly to the official facility provider on their secure system. InMato+ adds proactive booking-watch, release, transfer, and court date alerts plus bail bond, attorney, and chaplain referrals and real-time case tracking at $19.99/month per loved one, cancel anytime. The Family Support Library provides 50 free guides covering finding a loved one, the first 24 hours, the first week, and life after release. Available in English and Spanish. InMato LLC, a Delaware limited liability company, headquartered in Santa Barbara, California.

14Get Started with InMato LLC

Search for your loved one now at inmato.com — free for every family, with no time limit. Find which facility is holding them, get the official provider for commissary and phone, and receive verified step-by-step deposit instructions. No account required to search. Available in English and Spanish. Get started within 48 hours of a booking and never pay for a search.

Originally published at https://www.inmato.com/blog/reporting-fake-inmate-deposit-site

Written by InMato

15Related Articles

• [Supporting a Loved One on a Mental Health Watch List in Jail](https://www.inmato.com/blog/supporting-loved-one-mental-health-watch-list-jail)
• [Nonprofit Support for Incarceration Costs](https://www.inmato.com/blog/nonprofit-support-incarceration-costs)
• [Emergency Funds for Families of Incarcerated Individuals](https://www.inmato.com/blog/emergency-funds-families-incarcerated-individuals)