When you search for a government form, the first results are often ads for private websites that look official. They charge extra fees for something that is free or cheaper on the real site, and some steal your data.
Type these yourself, or open them from a link on usa.gov:
ESTA (visa waiver travel): esta.cbp.dhs.gov
US visas: travel.state.gov (and the visa application site linked from it)
USCIS forms: uscis.gov/forms. Every USCIS form is free to download.
Your USCIS case: uscis.gov and your USCIS online account
How to tell a real government site
The address ends in .gov (some state sites use .us, and the military uses .mil). Look at the real web address, not the page title.
.com, .org, .us.com, .online sites selling "ESTA applications", "I-94 services" or "green card lottery entry" are private businesses or scams.
The Diversity Visa (green card lottery) entry is free and only on the official State Department site.
Real sites do not ask you to pay with gift cards or crypto.
Phishing means fake emails, texts or calls that try to make you click a link, open a file or share information.
Signs:
Urgency: "Your visa will be canceled in 24 hours."
A sender address that does not match the organization, or a strange link.
Requests for passwords, SSN, A-number, bank details or codes.
Spelling mistakes and odd greetings ("Dear customer").
An unexpected attachment, or a QR code to scan.
Do not click. Open the official site or app yourself.
If you clicked and entered a password, change it at once, on the real site, and turn on two-step sign-in.
If you entered card details, call your bank.
Report phishing emails to reportfraud.ftc.gov, and forward scam texts to 7726 (SPAM).
Clicking the top search result without noticing the word "Sponsored".
Paying a website $90 to "check" your ESTA when the official fee is lower.
Uploading your passport to a site you found through an ad.