RECOVERY SCAM · FAKE EXPERT · RECOVERY PHRASE
How to avoid a crypto recovery scam: a guide to secondary fraud
After financial fraud or crypto theft, a person may receive a recovery offer from a supposed lawyer, investigator or blockchain expert. This recovery scam seeks another payment, login details or access to a wallet that still holds assets.
A victim may be contacted because details of the loss circulated or public transaction records are visible. Knowing the amount lost does not prove an investigation or an ability to return the assets.
1. Understand secondary victimisation
A fraudster may obtain your contact details from an earlier scam, data leak or public statement. They mention the exact loss and impersonate a specialist firm or public authority. Such details do not authenticate the contact.
A fake message may use AMF, Europol or police branding and claim that funds have been frozen or located. A supposed escrow account then demands release fees or tax. The French AMF states that it does not approach individuals to recover lost funds or collect tax for doing so.
2. Spot requests inconsistent with a credible recovery process
No credible lawyer, investigator or service provider needs your recovery phrase, private key, MFA code or password to trace a transfer. Sharing a phrase can expose remaining assets. Signing a transaction, approving a contract or granting remote access can also put wallets and accounts at risk.
A publicly traceable transaction does not mean its owner is known or that funds can be returned. Recovery may depend on an exchange, an investigation and legal action. Treat promises of guaranteed recovery within days and upfront release fees as strong warning signs.
Spot fake cyber-fund recovery experts and protect your teams
After fraud or crypto theft, a company may be approached by someone impersonating a lawyer, blockchain expert or public official. They promise recovery in exchange for advance fees, a transaction signature or wallet access.
SecurCheck Business helps management, legal and finance teams review an offer before paying or granting access. The module flags requests for recovery phrases, upfront payments and guaranteed outcomes, then points teams to independent checks.
Text and link analysis does not certify a firm's identity, verify an official mandate or guarantee asset recovery.
Explore the Business offer3. Verify a contact and protect remaining assets
Pause unsolicited approaches
Pause any unsolicited approach on social media, by email or phone after your loss. Do not call the number in their documents; independently find contact details for the organisation they claim to represent.
Verify identity independently
For a French lawyer, use the official national bar directory, then call the contact details listed there. A business registry entry establishes registered existence, not expertise, an official mandate or the identity of its website. Fraudsters can reuse genuine registration numbers.
Use the right reporting route
Preserve messages, addresses, contracts, transactions and contact details. Contact your bank or exchange quickly if a recent transfer might be stopped. Report the fraud to police; France's THESEE online process applies to certain scams depending on the circumstances. Cybermalveillance.gouv.fr offers guidance, without any recovery guarantee.
Sources: AMF · Cybermalveillance.gouv.fr · CNB · Service-Public.fr.
Conclusion: pause the second-chance promise
A tool can flag upfront fees, requests for secrets and unrealistic guarantees in an offer. Independently confirm a contact's identity and secure any exposed access. This reduces the risk of a second loss without certifying a provider or promising recovery.