Home › Knowledge Hub › The first 48 hours
The first 48 hours after a crypto scam
The first hours matter more than the following months. In order: stop sending money, secure the accounts involved, preserve the evidence before it disappears, contact the platform your funds left, and file an official report. The goal is not to fix everything today, it is to stop further loss and protect the information that makes anything else possible.
1. Stop all further payments
End communication with the suspected scammer. Do not pay a "tax", "unlock fee", "verification fee", "gas fee", or "withdrawal fee". These demands are standard across investment, romance, impersonation and recovery scams.
If a platform tells you that you must deposit more in order to withdraw money already showing in your account, that is not a hurdle. That is the scam's final stage, and the balance on screen does not exist.
Do not confront them either. An accusation prompts account deletion, and with it the evidence you are about to need. Say nothing and stop replying.
2. Secure every account involved
Work outward from your email, because email controls password resets for everything else.
Email first. Change the password to something unique. Turn on multi-factor authentication. Then check for forwarding rules and filters you did not create, this is the step people skip, and it is how attackers keep reading your mail after you have locked them out.
Exchange accounts. New password, MFA on, then review login history, connected devices, API keys, and withdrawal-address allowlists. An API key with withdrawal permission is a standing door.
Self-custody wallets. If you connected a wallet to an unfamiliar site, revoke token approvals using a reputable wallet-security tool. If there is any chance your recovery phrase was exposed, move remaining assets to a newly created wallet, a compromised phrase means the attacker can keep draining the wallet indefinitely, and no amount of password changing helps.
Never enter a seed phrase into a website, and never send it to anyone, including anyone claiming to be support, an investigator, or a government official. There is no legitimate reason for that request to exist.
Banking and cards. Contact the fraud department directly if money moved from a bank account.
3. Preserve the evidence before it disappears
Scam infrastructure is temporary. Platforms go offline, accounts get deleted, messages get edited. Capture everything before you block anyone.
Transaction records
The most important category by a distance. Collect every wallet address you sent to, the transaction hash for each transfer, the blockchain network, dates and times with timezone, amounts, and the asset. Copy them, never retype. A single wrong character makes an address useless.
Messages
Screenshots are the weakest form of this evidence because they lose timestamps and context. Where the app permits it, export the full chat history: WhatsApp, Telegram and Signal all have this built in, and the export produces a file an investigator can work with.
Capture screenshots too, including the account name, date, time and surrounding conversation rather than a cropped fragment. Save profile URLs, handles, phone numbers, group and channel names, invite links, and any images or documents they sent.
For email, save the original message file with full headers where you can, not just a screenshot of the body. Headers carry routing information that a screenshot destroys.
For calls, keep call logs, voicemails, and notes written immediately afterwards. Recording laws vary by jurisdiction, do not record covertly where local law prohibits it.
Platform records
The website addresses used, including any that now error or redirect. Screenshots of your account showing the claimed balance, that fake profit screen is evidence of what you were told. The app name and where you downloaded it. Account numbers, usernames, client IDs. Any documents they sent: contracts, certificates, licence numbers, tax notices.
Your own paper trail
Bank statements showing money moving to the exchange, exchange purchase receipts, and wire or card confirmations. These prove the loss is real and yours.
4. Build a timeline
A timeline turns a confusing experience into a reportable sequence. It matters most where the fraud developed over weeks or months: a romance connection, a fake trading platform, repeated deposits, shifting instructions.
Use five columns:
| Date and time | Event | People or accounts | Evidence file | Transaction details |
|---|
Start at first contact. Record when you were introduced to the platform, when you opened an account, each deposit, each claimed profit, and every obstacle you hit when trying to withdraw.
Be precise. "28 April 2026, approximately 10:00 local time" is worth far more than "late April". Where you are unsure, write that it is approximate, do not guess silently. Keep transaction hashes and wallet addresses in their own columns so they are never mangled by retyping.
Do not try to make the timeline flattering. Investigators need the whole sequence, including the parts that embarrass you. Especially those.
5. Contact the platform your funds left
If you sent funds from an exchange, report it through that exchange's official fraud, compliance or support channel, using contact details from the exchange's verified website. Never a phone number given to you by a stranger, and never one from a search advertisement without checking the domain.
Send a concise report: transaction hash, network, receiving address, amount, asset, time of transfer, your account details, and a short factual summary. Attach your police or IC3 reference number if you have one, plus proof you controlled the sending account.
If the funds reached a receiving exchange, contact that one too. A regulated exchange may be able to confirm whether an address belongs to its service, restrict an account, or preserve records in response to an appropriate request. It will not tell you who owns the account, that requires legal process, and it is not obliged to act on your say-so.
If money left a bank, card or payment app, contact the fraud department and ask specifically about recall, chargeback and dispute options. Same day matters.
6. Report the crime
Reporting is free everywhere and takes about twenty minutes. It is also the step with the best documented odds, which is why it comes before considering anyone paid.
The complication is that most countries have several channels and they do very different things. Some can start a police investigation; others only collect intelligence and will never respond to you. Filing with the wrong one alone means nothing happens.
Our country guides label every channel by what it does. If you are in Australia in particular, read that page before you file, the obvious choice is not the one that leads to an investigation.
Attach your transaction hashes. Reports are grouped by wallet address, so the hashes are what connects your case to others.
7. Expect a second approach
Recovery scammers target people who have already lost money, usually within weeks. They will present as investigators, lawyers, government agents, or someone who has "found your assets".
The tells: they contacted you first, they want a fee before recovering anything, they guarantee an outcome, or they ask for your seed phrase. A credible organisation does none of those things.
Read how to spot a crypto recovery scam before you reply to anyone.
Frequently asked questions
Should I block the scammer straight away?
Not before you have preserved everything. Blocking can cut off access to the conversation history on some platforms, and it signals that you have realised what happened, which prompts them to delete accounts. Export the chats first, then stop replying, then block.
I already deleted some messages. Is my case ruined?
No. Report what you have. Partial evidence is far better than none, and some platforms retain data that can be obtained through legal process even after you have deleted your copy. Note in your timeline what is missing and why.
How quickly do I need to contact the exchange?
Same day if possible. Where funds are still sitting at a regulated exchange, a fast report is occasionally enough for a freeze. That window is measured in days, and it closes for good once the funds move on.
What if I do not know what a transaction hash is?
It is a long string of letters and numbers identifying a specific transfer, sometimes called a TXID. Your exchange or wallet app lists them under transaction history, look for a "details" or "view on explorer" option next to each transfer. Copy them rather than retyping.
Do I need a lawyer at this stage?
Almost not in the first 48 hours. The steps above are free and you can do all of them yourself. Legal advice becomes relevant later, and mainly for larger losses where a counterparty can be identified.
Is it worth reporting if the scammer is overseas?
Yes. Most are. Cross-border cases limit civil options but reports are shared internationally, and large networks are dismantled on aggregated reports from many countries. Your report contributes to that picture whether or not you hear back.
Work through the evidence checklist
The interactive version tracks what you have collected and produces a summary you can attach to a report.
Open the case evaluator