Much of this sounds like a standard phish kit. Unfortunately I don't think the police can do much. Often you can actually find the perpetrator's info, but they're in Nigeria where nobody cares.
Once Chrome starts blocking the site, that will stop the bleeding. The contact the host and domain registrar, if possible. If the phish kit is piggybacking on a WordPress site (very common), find the person who owns that site and message them if you can.
First of all, I'd report the site to Google Safe Browsing and to PhishTank: https://safebrowsing.google.com/safebrowsing/report_phish/?h... https://www.phishtank.com/
Once Chrome starts blocking the site, that will stop the bleeding. The contact the host and domain registrar, if possible. If the phish kit is piggybacking on a WordPress site (very common), find the person who owns that site and message them if you can.