Crypto Recovery Scams: Practical Guide and Checklist

Date checked: 2026-06-20. This guide is for consumer-safety awareness, not legal, financial, tax, or incident-response advice. Public consumer and cybercrime guidance warns that scammers may promise refunds or cryptocurrency recovery for a fee, including schemes that target people who have already lost money.

• Do not share a recovery phrase, private key, password, two-factor code, wallet file, or remote-device access with a recovery contact.
• Save messages, websites, usernames, payment requests, wallet addresses, and transaction IDs before blocking or deleting anything.
• Verify any claimed company, exchange, law firm, regulator, bank, or law-enforcement connection through contact details you find independently.
• Treat reporting as documentation, not as a promise of investigation, refund, or fund recovery.

A crypto recovery scam is a follow-on scam in which someone claims they can recover lost cryptocurrency, stolen funds, or frozen assets while asking for money, sensitive information, or account access. The FTC describes refund and recovery scams as schemes where scammers promise to get money back for a fee, and the FBI IC3 has warned about cryptocurrency recovery schemes targeting crypto scam victims.

Use this crypto recovery scam checklist before you respond to a recovery service, pay a fee, or send documents. A safer first response is to pause, preserve records, and verify each claim outside the message, website, phone number, or link provided by the person contacting you.

A legitimate review of public blockchain activity should not require a recovery phrase, private key, wallet password, two-factor code, wallet file, or remote access to your device. Wallet safety guidance from MetaMask says a Secret Recovery Phrase controls access to a wallet and should not be shared.

Recovery scams exploit pressure after an earlier loss: the pitch may offer urgency, certainty, or special access when the victim is looking for a fast solution. The FTC warns people not to pay someone who says they can recover money for a fee.

The FBI IC3 says criminals may pose as recovery companies, financial institutions, or government agencies in cryptocurrency recovery schemes. Treat logos, titles, certificates, social profiles, screenshots, and polished websites as claims to verify, not proof of authority.

Be skeptical of claims such as “funds already secured,” “100% refund,” or “we have located your assets.” A visible transaction record may help document what happened, but it does not prove that a private recovery service can return the funds.

An advance-fee recovery scam may describe a payment as a tax, clearance fee, unlock fee, gas fee, processing charge, or final step. The risk pattern is the same: someone promises recovery, then asks you to pay before you can independently verify the service, authority, and limits.

Stop if anyone asks for a recovery phrase, private key, wallet password, two-factor code, wallet file, or remote access to your device. A recovery phrase or private key is access to the wallet, not ordinary evidence for a recovery service.

A recovery contact may claim to work with an exchange, regulator, law firm, bank, or law-enforcement agency. Verify the claim through the official organization’s website or public contact route, not through links, phone numbers, screenshots, or documents sent by the recovery contact.

Record who contacted you, what they promised, what they want you to pay or share, the deadline they gave, and the channel they used. Writing down the claim helps separate evidence from pressure before you decide whether an asset recovery scam warning sign is present.

Search for the company, person, exchange, regulator, or public agency using sources you find independently. If the recovery pitch names a real organization, use that organization’s official website or public contact route to ask whether the relationship exists.

Transaction IDs, public wallet addresses, redacted screenshots, invoices, emails, and chat logs may help document what happened. Recovery phrases, private keys, passwords, two-factor codes, wallet files, and remote access are access risks, not evidence a recovery contact needs.

Ask for written scope, fee terms, limitations, legal identity details, and the exact work the service claims it can perform. Be especially cautious if the price keeps changing or each payment creates another “final” fee.

Look for warnings from consumer-protection, law-enforcement, cybersecurity, wallet, exchange, or regulator sources. The FTC and FBI IC3 publish U.S. consumer and cybercrime guidance; CERT Polska and NASK are Poland-based official cybersecurity information sources that may be useful examples, not universal reporting routes for every country.

1. Save the recovery service’s website, messages, usernames, emails, phone numbers, invoices, wallet addresses, and payment requests.
2. Verify the person or company through official channels you find independently, not through links they provide.
3. Refuse any request for a recovery phrase, private key, wallet password, two-factor code, wallet file, or remote-device access.
4. Ask for written scope, fees, limitations, legal identity, and the exact work the service claims it can perform.
5. Check whether any claimed exchange, regulator, law firm, bank, or law-enforcement relationship is real.
6. Treat upfront recovery fees, tax demands, unlock charges, clearance fees, and repeated “final payments” as serious advance-fee recovery scam warning signs.
7. If you already paid, pause before sending more, preserve evidence, secure related accounts, and use official reporting routes where appropriate.

A transaction ID, public wallet address, timestamp, and related screenshots can help organize a record of what happened. Those records may be useful when reporting a suspected crypto recovery scam, but they are not the same as proof that a private service can identify a person, freeze funds, or recover assets.

Treat a tracing report as one possible evidence record, not as a recovery promise. Outcomes may depend on facts outside a private service’s control, including the platform involved, the jurisdiction, the timing, and whether an official process is available.

• Transaction IDs and public wallet addresses.
• Chat logs, emails, usernames, phone numbers, and social profile links.
• Websites, invoices, payment addresses, receipts, and screenshots.
• Dates, times, platform names, support ticket numbers, and claimed company or legal identities.
• Original files where possible; avoid editing, fabricating, or “cleaning up” evidence.

Stop sending additional payments if the service introduces new fees, threats, or deadlines. The FTC’s recovery-scam guidance warns against paying someone who says they can recover money for a fee.

Secure related accounts by reviewing email access, passwords, active sessions, and two-factor authentication settings. If you shared wallet secrets or gave remote access, treat the wallet, device, and related accounts as potentially compromised and get help through trusted security support or the official wallet/provider channel.

Consider reporting through official channels such as local law enforcement, a national cybercrime portal, consumer-protection agencies, the platform or exchange involved, and IC3 if the matter falls within its reporting scope. A report may help document the incident, but it does not promise an investigation, refund, or recovery.

No recovery pitch should be trusted just because it promises certainty. A service may help organize evidence or explain visible transaction activity, but that is different from controlling funds or ensuring a return.

No. Do not share a recovery phrase, private key, wallet password, two-factor code, wallet file, or remote access with a recovery contact. MetaMask says a Secret Recovery Phrase controls access to a wallet and should not be shared.

No. Tracing may document visible activity such as transaction IDs or public wallet addresses, but recovery depends on additional facts and processes that tracing alone cannot control.

Verify that claim through the official exchange, regulator, or organization using contact details you find independently. Do not rely only on documents, links, phone numbers, or screenshots sent by the recovery contact.

Pause before sending more money, preserve evidence, secure related accounts, and consider reporting through official channels. Be especially cautious of another person or company claiming they can reverse the first loss for an additional fee.

• FTC: Refund and Recovery Scams — consumer guidance on scammers who promise to recover money for a fee.
• FBI IC3: Cryptocurrency Recovery Schemes Target Cryptocurrency Scam Victims — public warning about cryptocurrency recovery schemes and impersonation patterns.
• MetaMask: What is a Secret Recovery Phrase and how to keep your crypto wallet secure — wallet-safety guidance on protecting recovery phrases.
• FBI IC3: File a Complaint — official cybercrime complaint portal information.
• CERT Polska — Poland-based official cybersecurity warnings and public safety updates.
• NASK: Cybersecurity — Poland-based official cybersecurity information and public digital-safety resources.

• CERT Polska: aktualności i ostrzeżenia - CERT Polska.
• NASK: cyberbezpieczeństwo - NASK.
• Gov.pl: cyberbezpieczeństwo - Gov.pl.
• Understanding the Need for Recovery - Human Kinetics.