Home › Knowledge Hub › How to spot a crypto recovery scam
How to spot a crypto recovery scam
A crypto recovery scam is a second fraud aimed at people who have already lost money to a first one. The single most reliable warning sign is a fee requested before anything is recovered, in the United States that is not merely suspicious, it is prohibited under the FTC's Telemarketing Sales Rule. Legitimate providers are contingency-based, name a regulator and licence number you can verify, and never guarantee an outcome.
Why you are being targeted
Being defrauded once makes you a target for being defrauded again. Victim lists circulate, and they are bought and sold. Some are assembled from data breaches, some from the original scam operation itself, and some from public complaints and forum posts.
The result is predictable. People who lose cryptocurrency are frequently approached within weeks by someone offering to get it back. The FBI's Internet Crime Complaint Center recorded more than 10,500 complaints about recovery fraud in 2025, with roughly $1.4 billion in reported losses. That money came from people who had already lost money once.
If someone contacted you unprompted about funds you lost, start from the assumption that they found you on a list.
The warning signs
Any one of these is reason to stop. Two or more is not a close call.
- They contacted you first. Unsolicited approaches by email, social media, Telegram, WhatsApp, or phone about a loss you did not report to them.
- They ask for money before recovering anything. Retainers, "activation fees", "legal costs", "gas fees", "unlock fees", "verification deposits", or taxes.
- They guarantee recovery, or quote a success rate with no denominator behind it.
- They ask for your seed phrase or recovery phrase. No legitimate party ever needs this. Handing it over is handing over the wallet.
- They ask for remote access to your computer or phone.
- They claim to work with, for, or alongside law enforcement. Anyone can file a report with IC3. That is not a partnership.
- They want payment in cryptocurrency, gift cards, or wire transfer to a personal account.
- They pressure you to decide immediately, or say the window is closing.
- They cannot name a regulator. Or they name something that isn't one, see below.
- Their evidence is testimonials. Reviews are cheap. Regulators, licence numbers and outcome data are not.
Australia's ASIC has published a specific alert on this pattern, describing operators who claim they can recover lost funds for an upfront fee, frequently payable in cryptocurrency, and who pose as satisfied former victims leaving recommendations on review sites.
SAM.gov and NATO codes are not licences
This deserves its own section, because it is the most effective trick in the category and almost nobody explains it.
SAM.gov registration is a free, self-service entry in the US System for Award Management. It makes an entity eligible to receive federal contracts or grants. There is no competence review, no background check, and no endorsement. Anyone can register.
An NCAGE code: often presented as "NATO registered", is a five-character identifier used by NATO's cataloguing system to record which manufacturer supplied a given item. It exists so that when NATO stocks a component, the database knows who made it. It is requested through a public portal. NATO does not license companies. There is no such thing as a NATO-licensed investigator.
Both sound governmental. Both are trivially obtainable. Both appear constantly on the websites of firms targeting fraud victims, precisely because a distressed person cannot easily check them.
The same applies to Dun & Bradstreet listings, chamber of commerce membership, and ISO certification. None is a licence to investigate anything.
What an actual licence looks like
| Jurisdiction | What to ask for | Where to verify |
|---|---|---|
| United States | State bar number, or a state private investigator licence | Your state bar's public directory; your state's PI licensing board |
| United Kingdom | SRA number for a solicitor, or FCA authorisation | Law Society "Find a Solicitor"; the FCA Register |
| Australia | Practising certificate, or a state PI licence | Your state's licensing register, PI licensing is state-based |
| Canada | Provincial law society membership, or provincial PI licence | Your provincial law society; provincial licensing body |
| European Union | National bar admission number | Your national bar register |
Verify using the contact details on the register itself, never the ones the firm gave you. Clone firms, operations that copy the registered details of a authorised business, are common enough that the FCA maintains a warning list specifically for them.
The five questions
Ask these before any payment. A legitimate provider will answer all five without hesitation.
- What licence do you hold, from which regulator, and what is the number? If the answer is SAM.gov, NCAGE, or "we're registered", that is your answer.
- Do you charge anything before funds are recovered? If yes, walk away.
- What exactly do I receive for the fee? A tracing report is a document. It is not a recovery, and it cannot compel anyone to return anything.
- What is your success rate, and out of how many cases? A percentage without a denominator is marketing. "We only accept cases we can win" describes an intake filter, not results.
- Will you put "no recovery, no fee" in writing? If they will not write it down, they did not mean it.
Why an upfront fee is disqualifying
In the United States this is a matter of law, not judgement. The FTC's Telemarketing Sales Rule prohibits requesting or receiving payment for recovery services before the money is recovered. The 2016 amendment extended that ban beyond telemarketing to cover losses from any prior transaction, including online ones.
The reasoning is straightforward. The business model of charging fees to recover money that usually cannot be recovered is functionally indistinguishable from fraud, whatever the intention behind it. Contingency arrangements align the provider with the outcome; advance fees pay them regardless.
Outside the US the legal position varies, but the logic does not. A provider confident in the outcome takes a share of it.
What a credible provider looks like
They are more cautious than you want them to be. They tell you the odds are poor before they tell you anything else. They distinguish between tracing funds and recovering them, and they are explicit that they have no power to freeze, seize, or reverse anything. Courts, regulators and exchanges hold those powers, not private companies.
They will ask you to report to law enforcement first, because that is free and it is the step with the best documented odds. They will decline cases. And they will put their terms in writing before asking for anything.
If a provider's first message is more optimistic than anything on this page, that is information.
Increasingly the same offer arrives described as AI-driven tracing. Our guide to AI agent scams covers why the technology does not change what is possible.
If you have already paid
You are not stupid, and you are not alone. This is a professionally-run category of fraud that specifically targets people in distress.
- Stop paying immediately. There is no point at which the story resolves.
- Keep every message, invoice, receipt and wallet address. This is a separate crime from the original fraud and should be reported separately.
- Report it to your national channel, IC3 in the US, Action Fraud in the UK, ReportCyber in Australia. Our country guides explain which channel leads to an investigation.
- Contact your bank if you paid by card or transfer, and say the word "fraud".
- Expect another approach. Having paid once marks you on the list as someone who pays.
Frequently asked questions
Is every company offering crypto recovery a scam?
No, but the category is heavily contaminated and the burden of proof sits with the provider. Legitimate blockchain analysis firms and law firms do exist and do useful work. The distinguishing features are a verifiable licence, a contingency fee structure, honest framing of the odds, and a clear statement of what they cannot do.
Someone says they can reverse my blockchain transaction. Is that possible?
No. Confirmed transactions on public blockchains cannot be reversed by any private party. Funds can sometimes be frozen by an exchange that holds them, or recovered through a court order, but the transaction itself is permanent. Anyone claiming otherwise is either mistaken or lying.
They showed me my funds on a blockchain explorer. Doesn't that prove they found them?
No. Blockchain explorers are public and free. Anyone can look up a wallet address and show you a balance. Seeing where funds went is not the same as being able to retrieve them, and it requires no special access.
What if they claim to work with the FBI?
Filing a complaint with IC3 is something any member of the public can do. It does not constitute working with the FBI. Federal agencies do not partner with private recovery firms to return individual losses, and they never charge fees.
Is it worth paying for a tracing report?
Sometimes, if the loss is recent, you have the transaction IDs, and the funds landed somewhere identifiable. The report can support a police file or a civil claim. Be clear that you are buying a document, not a recovery, and never pay before the work is done.
How do recovery scammers find me?
Victim lists are traded, assembled from data breaches, from the original scam operation, and sometimes from public complaints and forum posts where people describe their loss. If you posted about it anywhere public, assume that is how.
Not sure whether your case is worth paying anyone for?
Nine questions, an honest answer, including when the answer is that nobody can help. No email address required.
Evaluate my case free