Crypto Recovery Scams: How to Spot a Fake Recovery Service

The Most Common Second-Scam Pattern

After a crypto theft or fake investment, a new contact claims to have found the funds. They may say they work for a regulator, police, exchange, blockchain tracing company or law firm. A polished report or dashboard shows a “recovered” balance. Before release, the contact asks for an activation payment, tax, compliance certificate, insurance bond or wallet connection. The payment creates a new loss; the displayed balance may not exist.

The joint European supervisory authorities’ crypto fraud and scams factsheet warns about “recovery room” fraud aimed at people already harmed by a scam. Victims may be approached by someone impersonating a public authority or claiming to arrange reimbursement. Previous victim status makes the contact more plausible, not more trustworthy.

Red Flags and What They Mean

One red flag is enough to pause. Some legitimate professionals charge transparent fees for analysis or legal work. The problem is an unverifiable result, access demand or invented requirement to pay a third party before funds can be released.

Verify the Service Without Using Its Own Claims

1. Find the firm’s legal name, registration, address and named professionals independently. A name printed on its PDF is not verification.
2. Use an official bar or professional register if it presents itself as a law firm. Check the person and firm, not just a logo.
3. Contact the exchange or authority through its published website or app. Do not call a number supplied in the suspicious message.
4. Ask for a written proposal stating the specific deliverable, evidence needed, fee and limits.
5. Ask what account or asset is allegedly reachable and how that fact was verified. An explorer label is not an identified customer or frozen balance.
6. Pause before paying or signing. A genuine provider can explain its work without demanding a password, seed phrase or remote access.

ESMA’s warning about impersonation using its name and logo says fraudsters have claimed to help people recover lost money and demanded administrative fees. ESMA says it will not approach victims for personal details or a fee under that pretext. A forged regulator letter can look formal; check the agency’s own site rather than the letter’s contact details.

What Legitimate Recovery Work Looks Like

A credible first assessment starts with the actual loss, transaction hashes, service accounts and evidence of the instruction or theft. It may produce a transaction schedule, a cautious service lead, a report to a platform or authority, a complaint, or advice that there is no proportionate next step. The analyst should distinguish on-chain facts from assumptions about who controls an address.

The legitimate recovery process depends on whether assets can be located at a service, whether the service can act, and whether an authority or legal claim can support restriction and return.

A lawyer can assess a legal step — see When Do You Need a Crypto Recovery Lawyer? — but cannot issue a police order or unilaterally reverse a confirmed blockchain transfer.

Ask for a written scope tied to a practical decision. Examples are “identify whether the destination is plausibly a regulated custodian,” “prepare a documented platform notification,” or “assess whether a complaint is viable.” A fee for a clearly described service is different from a supposed tax payable into a stranger’s wallet to unlock an invented balance.

If You Have Already Paid a Recovery Scammer

Act as though this is a new incident. Do not send another amount in an attempt to retrieve the first payment.

1. Stop contact and save the full conversation, website URLs, invoices, wallet addresses, transaction hashes and bank or card references.
2. If you paid by bank or card, contact the provider immediately and ask what recall, dispute or security action is available.
3. Notify the genuine exchange or wallet service used for the payment. Give the full transaction identifiers and the suspected recipient.
4. If you exposed credentials, change them from a trusted device, terminate sessions and review linked email, API keys and withdrawal settings.
5. If you disclosed a seed phrase or approved a malicious contract, treat that wallet as compromised and seek qualified security assistance about moving any remaining assets safely.
6. Report both the original scam and the second incident to the national police or cybercrime reporting channel, keeping the losses separate.

The steps in How to Report a Crypto Scam and Preserve Evidence can be used for both incidents. Record the actual amounts paid, not a fictional “recovered balance” shown by the scammer.

The Crypto Scam Investigation: Evidence to Preserve checklist helps keep original files and a chronology.

Get a Free Recovery Scam Assessment

Do Not Mistake a Report for a Return of Funds

A transaction chart can be useful, but ask whether the report supplies the full hashes, networks, dates, sources for labels and limitations. A screenshot saying “funds located” does not establish a freeze, account owner or entitlement to the balance.

If the sender claims that police or an exchange already holds funds, ask the genuine authority or provider to confirm through its own channel.

Europol’s warning on fake Europol correspondence describes criminals using its identity to seek payments or information, and directs recipients to report suspicious contact to local or national police. Do not pay a person claiming to be an investigator to obtain an “authorisation certificate.”

Mistakes That Expose Victims to Another Loss

• Publishing your full case and contact details under a social-media post. Scammers can use them to craft a convincing approach; share evidence only through verified channels.
• Trusting reviews on the seller’s own website. Verify named professionals and the entity through independent registers.
• Believing a transaction hash proves funds are waiting for you. It proves a recorded transaction, not a refund account.
• Connecting a wallet to a purported recovery portal. A signature or approval may grant asset access.
• Paying a “tax” to a wallet address supplied in chat. Verify any real legal obligation independently with a qualified local adviser.
• Deleting the second scam conversation out of embarrassment. Preserve it as evidence and report the additional loss.

Never give any recovery provider your seed phrase, private key, exchange password, live 2FA code or unrestricted remote device access. A legitimate case assessment can use read-only transaction records and secure communication.

Get a Case Assessment

If you suspect a recovery offer is false, or have paid a second scammer, Get a Free Case Assessment from P&P Crypto Asset Recovery. Share the offer, payment details and any existing authority or platform reference through a verified channel. We can help identify immediate protective and reporting steps without promising recovery.