When a crypto recovery contact reaches you first: what to do

Source-tracked CryptoRescue article.

Summary: If someone claiming they can recover your lost crypto contacts you first, treat the message as high risk until you verify it independently. The safest order is: do not pay, do not share sensitive information or account access, preserve only the evidence already visible to you, check the claimed organization through contact details you find yourself, then block and report the sender.

Date checked: 2025-02-14. Reporting routes, support processes, and platform tools can change by country and service.

CISA warns that social engineering and phishing often rely on unsolicited contact, urgency, impersonation, malicious links or attachments, and requests for sensitive information. FTC guidance also tells consumers not to pay more money to recover from a scam and to keep records of the contact. Those broad warnings fit cold outreach from someone claiming they can get funds back.

A convincing story is not proof that the sender is real. A message can use a genuine company name, copied branding, or details from a prior incident without showing that the sender actually represents that organization. The safer standard is independent verification through a public website or published contact channel you locate yourself.

Do not send money. Do not share passwords, one-time codes, private keys, or wallet recovery phrases. Do not click links, open attachments, connect a wallet, or install software just because the sender says it is needed for tracing, verification, or release of funds.

Save only what is already visible. Useful evidence can include the chat thread, timestamps, sender profile, phone number or email shown, claimed organization name, visible website address, wallet address, and any payment request. Avoid clicking anything suspicious while collecting that information. FTC guidance says to keep records related to the scam, while CISA warns against interacting with suspicious content.

If the sender says they represent an exchange, wallet provider, support team, or public authority, check that through the organization's official website or published contact page that you find independently. Do not rely on phone numbers, links, or documents sent in the message itself.

Use a narrow checklist. The goal is to preserve identifiers and requests, not to continue the exchange.

• Screenshots of the chat, ideally with visible timestamps
• The sender's displayed name, handle, profile link, phone number, or email
• Any wallet address, QR code, payment instruction, or transaction reference shown
• Any website address, domain, app name, or software download mentioned
• Any request for fees, release payments, verification payments, codes, or account access
• The date, time, and platform where the contact happened

Do not test links, open files, connect a wallet, or keep the conversation going just to see what happens next. CISA's phishing guidance warns that interacting with suspicious messages can increase risk.

After you save key evidence and verify any claimed organization independently, the lower-risk next step is usually to stop replying, block the sender, and use the platform's reporting tools if available. FTC guidance says to stop contact with scammers and keep documentation. Platform-specific reporting options still need to be checked live because they vary by service.

• Screenshot the conversation and sender profile first
• Do not pay, click, connect, install, or share sensitive information
• Verify any claimed organization through a public channel you found yourself
• Block the sender
• Report the account through the platform, if that option exists
• Keep your records together in case you later need them for official reporting or support

The next step depends on what you exposed. If you only replied, you may mainly face more scam contact. If you shared access details, recovery information, one-time codes, opened links, connected a wallet, or installed software, stop relying on the unsolicited message and move to the official security or support pages for the affected service or device.

Treat that as serious exposure. Do not send more money and do not continue following instructions from the unsolicited contact. Go to the official security guidance for the wallet or service involved, using a web address you find yourself.

Stop using the conversation as your guide and go directly to the official support or security pages of the affected service using independently found contact details.

Do not continue taking instructions from the sender. Use official support or security resources for the affected device or account instead.

Follow-up contact often changes names and roles after the first approach fails. Be cautious if you see:

• New accounts claiming to be from “compliance,” “investigations,” or “escalations”
• Pressure to move the conversation to another app, phone number, or private channel
• Fresh payment demands described as taxes, release charges, verification steps, or insurance
• Lookalike support pages or websites sent after you stop replying

Because reporting and support routes vary, check these items in real time before taking further steps:

• The official website of any company or institution named in the message
• The platform's current block and report tools
• The official support or security page for any wallet, exchange, email account, or device involved
• Country-specific cybercrime or fraud reporting options where you live

Usually, the safer approach is to preserve evidence, verify independently if needed, and then stop replying, block, and report.

That can make the message look more convincing, but it still does not prove the sender is legitimate. Verification should come from a trusted public source outside the message.

Do not assume a message is genuine just because it uses a real company's name. Check the official website and published contact methods independently before you act.

Do not send more money. Preserve the payment request and conversation, then move to independently verified support or reporting channels. FTC specifically warns against paying someone who promises to recover money lost to a scam.

Stop following instructions in the message and move to official support or security guidance you find independently for the affected service or device.

This article is based on public cyber-safety and consumer-protection guidance about unsolicited contact, phishing, impersonation, suspicious links and attachments, software-install requests, and preserving records after a scam approach. It is harm-reduction guidance, not a promise of recovery or a complete legal guide for every country.

• CISA: Avoiding Social Engineering and Phishing Attacks
• FTC: What To Do if You Were Scammed
• CERT Polska