What To Do If a Crypto Recovery Service Contacts You

Quick answer: If a crypto recovery service contacts you out of the blue, do not pay, do not share wallet credentials, and do not use links or phone numbers they provide. Preserve the message, verify any claimed organization through an independent official channel, and report suspicious contact to the relevant consumer-protection or law-enforcement body in your country.

Crypto scam victims are often targeted again by people who claim they can recover lost funds. The safest starting point is refusal: treat unsolicited recovery contact as high-risk until the claim is independently verified. The U.S. Federal Trade Commission warns that refund and recovery scams commonly target people who have already lost money, while its cryptocurrency guidance warns that scammers may demand crypto payments or impersonate trusted organizations.

This guide focuses on reducing further harm. It does not recommend any recovery provider and does not promise that funds can be traced, frozen, refunded, or returned. For broader warning signs, see our recovery-scam pillar on [how to verify a recovery service](/recovery-scams/).

Refuse or pause immediately if the contact asks for any of the following:

• Seed phrase, recovery phrase, or private key: Wallet providers warn that these credentials control wallet access and should not be disclosed to another person.
• Exchange password, one-time code, or two-factor authentication code: Sharing login credentials or security codes can enable account takeover.
• Remote access to your phone or computer: Remote-control requests can expose wallets, exchange sessions, documents, and saved passwords.
• Upfront crypto payment: Be especially cautious of “tax,” “release,” “gas,” “clearance,” “verification,” or “wallet activation” fees demanded before any result. Recovery and refund scams often use advance-payment pressure.
• Secrecy or urgency: Pressure to act immediately, avoid police, avoid your bank, or keep the contact private is a common manipulation signal in fraud warnings.

Some information is less sensitive because it is already visible on a public blockchain or describes the incident without granting account access. Even then, share only after independent verification and redact unrelated personal details.

Examples of lower-risk information include public wallet addresses, transaction hashes, dates and amounts, the scammer’s public contact handles, and screenshots with balances, account numbers, email addresses, identity documents, seed phrases, and private keys removed.

Do not click the contact’s links, scan their QR codes, install their wallet tools, or call numbers they send. Search separately for the organization’s official website, regulator entry, court record, bar association listing, exchange help page, or law-enforcement reporting page.

If they claim to be from a government agency, exchange, wallet company, or police unit, verify that claim using a phone number or web address you found independently. The FBI’s Internet Crime Complaint Center accepts online cybercrime reports, and Action Fraud is the UK’s national reporting center for fraud and cybercrime.

A legitimate professional should not require you to disclose wallet credentials or pay a crypto “release fee” before you can verify who they are. Ask for a legal business name, jurisdiction, written engagement terms, licensing or registration details where applicable, and a non-urgent way to verify their identity through public records.

Be cautious if the answer is vague, if the person switches names or organizations, or if they says verification is impossible because the recovery is “confidential,” “blockchain classified,” or “time sensitive.” Those claims should be treated as risk signals, not proof.

• Stop communicating until you preserve evidence: Save messages, usernames, phone numbers, email headers, wallet addresses, payment requests, transaction hashes, websites, and receipts.
• Secure accounts from a clean device: Change exchange and email passwords, review active sessions, and enable or reset two-factor authentication using official account-security guidance.
• Assume exposed wallet credentials are compromised: If a seed phrase or private key was shared, follow official wallet guidance and consider moving any remaining assets to a new wallet you control, using a device you believe is not compromised.
• Avoid unknown “revocation” or “recovery” tools: If you need to review token approvals or wallet permissions, use official wallet documentation or a reputable security professional; do not connect your wallet to a tool sent by the alleged recovery service.
• Report promptly: In the U.S., file with IC3 and consider FTC reporting; in the UK, report to Action Fraud. In other countries, use your national cybercrime, consumer-protection, or police reporting channel.

For large losses, identity-theft risk, or threats, consider speaking with a qualified lawyer or your financial institution before taking further action. This article is safety information, not legal or financial advice.

Treat guarantees as a major warning sign. Public consumer warnings describe recovery and refund scams that promise help but demand more money, and lawful recovery can depend on many factors outside any private service’s control.

Do not pay based on that claim. Advance fees described as taxes, gas, clearance, unlocking, or release charges are consistent with refund and recovery scam patterns described by consumer-protection guidance.

A transaction hash is generally public blockchain data, but it can still help someone profile your activity. Share it only when needed, and do not share it together with passwords, seed phrases, private keys, identity documents, or live account access.

First preserve evidence. After you save the contact details, messages, payment addresses, links, and transaction records, blocking can reduce further pressure and repeated manipulation attempts.

Date checked: June 20, 2026. Scam tactics and reporting routes can change, so verify current instructions on the official source pages before acting.

1. FTC: Refund and Recovery Scams
2. FTC: What To Know About Cryptocurrency and Scams
3. FBI IC3: Cryptocurrency Crime
4. FBI IC3: File a Complaint
5. MetaMask Support: Secret Recovery Phrase and private keys
6. Coinbase Help: Avoiding crypto scams
7. Action Fraud: Report fraud and cyber crime

Cover image plan: Use consumer-safety or regulator-style imagery showing a warning checklist, fraud report form, or cybersecurity alert. Avoid images that imply endorsement of a wallet app, exchange, or recovery provider.

• CERT Polska: aktualności i ostrzeżenia - CERT Polska.
• NASK: cyberbezpieczeństwo - NASK.
• Gov.pl: cyberbezpieczeństwo - Gov.pl.
• What data and evidence do you need to see what difference you are making? - Bristol University Press.