NCMEC Sent My Report to the FBI: What Happens in the First 90 Days.

Last Updated on: 4th August 2026, 01:33 am

A CyberTipline referral is an investigative lead, not a criminal charge. It is certainly not an automatic “sentencing guideline” or a guarantee that law enforcement will pursue the matter. It does not even mean your report is guaranteed to move forward. NCMEC referred over 18.8 million reports to law enforcement agencies across the country in 2025. Most of these referrals end here. Only some advance, and most of these that advance will remain open for months or longer. Only a minority of referred reports will turn into criminal charges. If your report was routine, don’t expect a phone call. NCMEC created the CyberTipline in 1998 to receive reports from the public and electronic service providers and to assist law enforcement. A provider must make a report when 18 U.S.C. 2258A triggers its mandatory reporting duty. The statute requires reporting apparent violations involving computer-generated material, sexual abuse content, sexual exploitation material, or “child pornography.” The mandatory reporting duty triggers on actual knowledge. A provider is obligated only when it “has actual knowledge” of a potential violation. This duty is triggered by “actual knowledge,” not by suspicion or allegations. With the enactment of the 2024 REPORT Act, Providers must now report apparent violations of 18 U.S.C. § 1591 involving a minor or 18 U.S.C. § 2422(b) as well. Once the report is filed, law enforcement agencies assess them based on a priority list. If the report is flagged as a priority, it may be sent to a local office within hours. Otherwise, it likely won’t get a prompt look. Once at the office, it will likely sit on a desk for a while. At this stage, the next 90 days will be critical, but it won’t be the first one that really matters.

What happens after NCMEC refers my report to the FBI?

1. Pre-Investigative Tasks

When the FBI gets your report, it doesn’t automatically kickstart an investigation. Instead, there are several pre-investigative steps. During the first 90 days, these tasks might include:

• CyberTipline intake,
• Queueing,
• Assignment, and,
• Deconfliction.

These are essentially administrative tasks handled behind the scenes. At this stage, your report doesn’t get assigned to an agent but to a supervisor for review. The supervisor checks for “actionable information” (e.g., an IP address, physical address, or phone number) and a “substantial nexus” to a potential criminal case. If these conditions are met, your report then enters the queue to be assigned to a designated FBI field office, a task-force officer, or to be assigned as a lead for existing cases. During this process, the FBI checks if your report overlaps with ongoing investigations at other federal or local agencies. These are the basics behind the scenes before the FBI decides if your report warrants investigative action.

2. Who Reviews a CyberTipline Referral?

Once assigned to a field office or a task-force officer, a CyberTipline referral may be reviewed by one or more federal agencies. In many cases, a report will be reviewed concurrently by agents at the FBI, Homeland Security Investigations (HSI), the National Center for Missing and Exploited Children, and local law enforcement. Depending on the referral, the review process may involve various federal agents or local police officers. The review process typically takes time, and your report could remain in a review queue for an indefinite period.

3. How is the Referral Routed?

The referral process from NCMEC triggers several routing options. A report can go directly to the FBI Cyber Division, and then from the Cyber Division to the appropriate field office or task-force officer. In some cases, the report may go directly to HSI, local police, or an Internet Crimes Against Children (ICAC) task force. The number of agencies reviewing your referral depends on the urgency and characteristics of your report.

4. How Does the FBI Triage the CyberTipline Referrals?

The FBI will triage CyberTipline referrals based on several key factors. The most important factor is urgency. If a report comes with evidence that a child is in danger, it will be routed immediately to the relevant agency. Other factors include duplication (did multiple people report the same thing?), timeliness (is the report recent or old?), jurisdiction (which agency has jurisdiction?), and actionability (does the report contain enough information to pursue?). After this triage process, the FBI can decide which agency or agencies are in the best position to review the report.

5. What Happens to the Reports That Go into the FBI’s Queue?

If the FBI determines that your report doesn’t present an urgent danger, it will go into the agency’s CyberTipline queue. In this queue, hundreds of reports await assignment to investigative officers. FBI investigators receive far more CyberTipline referrals than they have the resources to handle, and the queue will only move forward if certain criteria are met. In 2025, NCMEC identified and escalated more than 53,000 reports that were urgent or involved a child in imminent danger, and these jump the queue; most others must wait for an available investigative officer to pick up the case.

What legal steps can investigators take in the first 90 days?

1. What tools do the FBI and other agencies have for the first 90 days?

In the first 90 days after a CyberTipline referral, investigators at the FBI and other agencies may use several tools to investigate further. These tools include (among others):

• Preservation requests;
• Subpoenas;
• Search warrants;
• Consent requests;
• Knock-and-talk contacts;
• Interviews;
• Undercover work; and,
• Surveillance.

2. What is a preservation request, and why is it important for an investigation?

A preservation request is a demand to preserve all material that may be relevant to an ongoing investigation. A preservation request is essential for maintaining the chain of custody and can allow investigators more time to obtain a warrant if needed. Without a preservation request, a provider could delete relevant records, such as email archives, before investigators obtain a court order. So, a preservation request allows investigators to avoid that risk.

3. When will a search warrant be issued during an investigation?

Search warrants are often sought to seize devices, such as computers and mobile devices, which may contain evidence of illegal activity. While there are no specific warrants, the FBI can request a warrant if it has probable cause to seek one. This warrant may also authorize the seizure of devices, computers, and other digital records. In most cases, investigators will seek to seize all devices that are readily available at the time of execution.

4. What is a “knock-and-talk”?

A “knock-and-talk” occurs when an investigator or other agent contacts an individual. Knock-and-talks are pre-arrest contacts, and this means that the individual being contacted does not have a warrant yet. These contacts may serve several purposes. They allow the investigator to interview the individual, obtain a consent to search the premises, or seize devices if voluntarily offered. At this point, the agent will try to establish rapport, while obtaining as much information as possible.

5. Why do investigators subpoena provider records?

Investigators subpoena provider records to find the subscriber information tied to a particular IP address. With a subpoena, investigators can obtain records such as the IP address, email address, and phone number. In many cases, this information can then be used to pinpoint the individual who used the device. Once investigators have a name and address, they can identify the individual and begin further investigation steps.

6. When will investigators take these steps, and how long will the investigation last?

In some cases, a CyberTipline report contains enough information for investigators to seek a preservation request, search warrant, or other legal process. But in many other cases, the report remains a weak investigative lead that requires follow-up. In these cases, the FBI may not take an initial step until months after the report was filed. The length of a CyberTipline investigation will vary from case to case. As a result, the 90-day investigation is merely a snapshot of the entire process.

7. What happened to the 90-day record preservation duty under the new reporting law?

Under the original reporting law, providers had to preserve reported material for 90 days after filing a report. But this law required providers to maintain this information, and this had previously been codified under 18 U.S.C. 2258A. However, after the enactment of the REPORT Act in 2024, that period was lengthened, and 18 U.S.C. 2258A(h)(1) now treats a completed CyberTipline submission as a request to preserve the reported contents for 1 year after submission. But, for all intents and purposes, it remains an essential part of federal law enforcement procedure.

Todd Spodek and the attorneys at Spodek Law Group handle federal cases of this kind from New York, Brooklyn, Queens and Los Angeles.

1. Why is it hard to trace an IP address to a person?

There are several reasons why it is not as simple as tracing the IP address to a person. An IP address is simply a sequence of numbers that identifies an account, but it doesn’t uniquely identify a person. Even if investigators have the account information, it doesn’t necessarily mean they know who was using the account. An IP address could be shared by multiple people, and a person might use different IP addresses in their personal and professional lives. It can also be difficult to identify the person at the computer when the internet is shared via Wi-Fi. Even if a provider has the IP address, that address can change. This is known as dynamic IP attribution, which means that the IP address is assigned to the person for a short period of time. As a result, any attempt to trace the IP address requires the exact timestamp that was tied to the IP address, which can make it a time-consuming process.

2. What else can make identifying the person who sent an apparent violation hard?

Several other factors can make it hard to trace a person who sent a reportable violation. For example, if a person uses a Virtual Private Network (VPN), it can hide the IP address of the internet-connected device. Thus, an investigator cannot identify the subscriber who has the apparent originating IP address. This can be extremely hard to trace, and it can take years of work. Additionally, if someone uses a shared public Wi-Fi, there is no IP address to trace. The internet could be coming from a neighbor’s Wi-Fi or from the public internet. When it comes to campus networks, like in universities or colleges, this is another case in which tracing IP address attribution can be hard. After investigators find the internet-service provider for the apparent IP address, they have to obtain the logs for the campus network. Once they get the network logs, they can identify the person’s laptop or other device connected to the campus network. In other cases, the report might not have information that the investigator could easily use to trace. This means the report would go into the CyberTipline queue for an investigative officer to pick up. This is again a time-consuming process, and it can lead to additional investigative steps before any further action can be taken. In mobile carrier network reports, the process is slightly different. The platform IP address does not identify a physical location; rather, it only identifies the carrier. Investigators will then seek the carrier’s records to find the person tied to the apparent mobile IP address. This can be a more complex process, and it requires the carrier’s records as well as the platform’s records.

3. How important is the jurisdictional data for CyberTipline reports?

Jurisdictional data is the information about the geographic location where an apparent violation occurs. Without this, it may be hard for the FBI or other agencies to promptly route the report to the nearest office. The more time it takes to route, the more likely it is for a person to evade law enforcement. According to NCMEC’s 2025 report, over ten percent of industry reports lacked usable jurisdictional information. Once provided with the report, the relevant federal or state law enforcement agency will check to determine if it has the jurisdiction to investigate. If not, the report is then forwarded to another agency. Again, this can take months.

1. Do you get status updates after NCMEC refers your report to the FBI?

Not necessarily. Even though you are a witness in an investigation, your report could stay silent for months or longer. If you have any additional information, you can contact NCMEC to give it. However, the FBI and other agencies are not required to update victims or the NCMEC. As a result, investigators will reach out only if they need you to clarify certain information, such as screenshots, devices, or online communication. So, even if it seems like no one is looking at your report, chances are that it is still under investigation.

2. What should you do after reporting a CyberTipline referral?

If you think that there are grounds to seek criminal charges, you may want to take action now before law enforcement gets involved. To do this, make sure to preserve all messages, screenshots, usernames, dates, links, and evidence from any apparent crimes. If you did report a platform-specific report, make sure you have confirmation from the platform, as well. These are all important pieces of evidence, and keeping copies will allow law enforcement to quickly establish a nexus. Otherwise, the report will remain an investigative lead. You should also be extremely careful about getting in touch with the person you suspect. If the individual thinks you are reaching out to threaten or to taunt them, it could put themselves or the suspect in a risky situation. If the individual is going through a crisis, they might try to find you or may send harmful messages to your home or personal devices. If you are concerned about what the suspected person will do, seek the assistance of an experienced legal team immediately.

3. What is Take It Down?

If images of your child have been leaked online, then you can use Take It Down. Take It Down is NCMEC’s free online service for removing underage images from the internet. With this tool, families can submit images, and once verified, those images are stored with a hash. This means they are not identifying, but hashed. After that, they will be added to a database that allows platforms to find the image and take it down. If the image is already online, then this allows you to preserve the evidence for investigators while removing it from the internet. Take It Down received over 130,000 submissions in 2025 that covered over 273,000 files. As a result, images were hashed and added to the database. Minors whose images are depicted in the reports can also file a report without exposure to prosecution. With the 2024 legislation, the new protection is available for parents, guardians, legal representatives, mandated reporters.

• FBI
• Department of Homeland Security
• Children’s Online Privacy Protection Act
• Internet Crimes Against Children Act
• National Center for Missing and Exploited Children (NCMEC)
• National Sex Offender Public Website (NSOPW)
• Reporting an apparent child sexual abuse material (CSAM) violation

What outcomes are possible by day 90 of the investigation?

There are five main outcomes possible by day 90 after the FBI or other law enforcement agency’s intake of a CyberTipline report:

1. The CyberTipline lead was administratively closed. No charges will be sought. This often happens when there is no actionable information or other issues.

2. The CyberTipline lead is still open. This occurs when investigators are waiting for a return on a subpoena. An agent or officer is then tasked with updating the status of the investigation, usually every 30 to 90 days.

3. The CyberTipline report is urgent. Agents intervened in time to rescue the child, and this also had the benefit of promptly detaining a suspect. About 51,000 reports end up with this outcome each year.

4. The individual was identified as a suspect. They received a target letter from the FBI’s office or a grand jury subpoena. Our federal criminal defense attorneys frequently communicate with prosecutors during this phase of the investigation before an indictment is returned. We attempt to resolve matters without an indictment, as this is the best way to protect our clients’ reputations and avoid any public record of a CyberTipline referral.

5. The individual was not identified by day 90. The CyberTipline lead is still open, but the investigator has’t found any additional actionable information yet. This is a common outcome; most of the reports will remain investigative leads until a definitive IP attribution can be established.

If there was a significant delay between the date of the reported apparent violation and law enforcement’s intervention, our attorneys can argue that the evidence is stale. In some cases, an argument about defective attribution could be presented as well. In other cases, if there is a gap of several months in the investigation, the attorney can argue that this amounts to prejudicial investigative action. The time allowed to act varies. While in physical cases, staleness is often an issue after a few weeks, in online cases, the court tolerates delays of months and even years. Courts recognize the complexity of tracing someone’s identity online, especially in cases where someone has used a VPN, public Wi-Fi, or even a school computer.

If the report lacked a determinable state, the report went directly to federal law enforcement only. In such cases, it is likely that the individual is being prosecuted on federal charges. If a state was involved, the federal agency will determine whether the case is federal or should be handed over to state law enforcement. If the federal agency hands the case over, it will be determined by whether there is an interstate nexus or whether other jurisdictional factors are involved. At this stage, the individual should not wait to find out why they are under investigation. The sooner they engage counsel, the better.

Get Advice on Your Situation

If you want someone to look at the specifics of your case, Spodek Law Group handles federal criminal defense nationwide from New York and Los Angeles. The firm has been practicing since 1976 and its motto is simple: we owe loyalty to only you. Call 212-300-5196.